Privacy Policy

1Definitions

In this Policy:

• (a) "Personal Information" means information that identifies, relates to, or could reasonably be linked with a particular individual or household. It does not include aggregated or deidentified information.
• (b) "Processing" means any operation performed on information, including collection, use, storage, disclosure, and deletion.
• (c) "Service Provider" (or "processor") means an entity that processes information on our behalf and under our instructions.
• (d) "Aggregated Data" means information combined across users so that no individual can be identified.
• (e) "Deidentified Data" means information that cannot reasonably be used to infer or be linked with a particular individual. We maintain and use such data without attempting to reidentify it.
• (f) "Device Identifier" means the salted, truncated cryptographic hash we derive from a browser fingerprint, as described in Section 2. We never store the raw fingerprint.
• (g) "Site" means pieterstudio.com. "GPC" means Global Privacy Control. "DNT" means Do Not Track.

2Information We Collect

We collect the following categories of information when you use the Site.

2.1Information You Provide

If you email us at membership@pieterstudio.com or hello@pieterstudio.com, we receive your email address, your name if you include it, and the contents of your message, including any application materials you choose to send. The Site's forms do not transmit form contents to us: the Access page's sign-in fields are submitted only to the separate member portal, and our measurement never captures anything you type (see Section 2.2).

2.2Information Collected Automatically (First-Party Analytics)

We operate our own analytics. No third-party analytics service runs on the Site; the third-party advertising pixels are described in Section 2.7. If your browser sends a Global Privacy Control or Do Not Track signal, this measurement never starts. Otherwise, we collect:

• (a) a random session identifier, stored in your browser's sessionStorage and discarded when your browsing session ends;
• (b) a device signature: a browser fingerprint computed in your browser by the open-source ThumbmarkJS library, which our server immediately converts to a salted, truncated cryptographic hash. The raw fingerprint is never stored. The hash lets us count returning devices without cookies and support the security functions in Section 2.3;
• (c) device and browser information: screen and viewport size, pixel ratio, browser family and version, operating system, device class, language, timezone, connection type, and dark-mode preference;
• (d) usage information: pages viewed, time on page, referring page, UTM campaign parameters, scroll depth, aggregated click and cursor-position grids (heatmaps), clicks on links and buttons, hover times, outbound-link destinations, file-download names, the length (never the content) of text you copy or select, page-performance metrics, and JavaScript errors;
• (e) form interaction metadata: which form fields you focus and for how long, and whether a form was submitted or abandoned. We record field names and timings only. Our code structurally excludes password fields, hidden fields, and payment-related fields, and never records what you type into any field; and
• (f) approximate location: your country, region, and city, derived by our content-delivery network from your IP address. Our analytics systems do not store your IP address.

2.3Security Information

To protect the Site against bots, fraud, and abuse, our security service receives the device signature described above along with coarse signals (browser family, operating system, timezone, language, screen size, automation indicators such as headless-browser flags) and simple behavior counters (page count, interaction count, hidden "honeypot" trap-field activity, form timing). From these we compute an anonymous risk score. Your IP address is used transiently to build a salted hash for rate and reputation purposes and is not stored in raw form.

2.4Local Storage and Cookies

We set no first-party cookies. The Site uses browser storage for a small number of first-party items: a session identifier (sessionStorage), a returning-visitor flag, your light/dark theme preference, a 24-hour cache of your city name for the clock display, a per-session note of which of our service areas, if any, your approximate city falls in (Section 2.8), and, if you use it, your advertising-pixel opt-out flag (Section 2.7). The only cookies on the Site are set by the advertising pixels in Section 2.7, and only when they load. You can clear all of these at any time through your browser settings without breaking the Site.

2.5IP-Based City Lookup (Third Party)

To show your city in the Site's navigation clock, your browser requests your approximate city directly from ipapi.co, a third-party geolocation service, which necessarily receives your IP address to answer. We receive the resulting city label, which is cached in your browser for 24 hours, and the center-point coordinates of that city, which are held in your browser's memory for the current page only and used solely as described in Section 2.8. ipapi.co's own privacy policy governs its processing.

2.6Third-Party Fonts

Some pages load fallback fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). When your browser fetches them, Google receives your IP address and browser information under Google's privacy policy. Our primary brand fonts are self-hosted and involve no third party.

2.7Advertising Pixels (Third Party)

Our public pages load advertising measurement tags from the companies listed below. Each lets us measure whether its advertising brings people to the Site and lets us reach Site visitors with ads on its platform. When a pixel loads, that company receives from your browser:

• (a) the page you are viewing and the page that referred you;
• (b) your IP address, browser, and device information;
• (c) identifiers stored in cookies that the company sets on your browser, and, if you are signed in to that company's service in the same browser, its own account identifiers; and
• (d) a page-view event for each public page you open, and, for the vendors named below, up to six conversion events: "lead" when you open the membership inquiries page, "view content" when you open a portfolio page or the plans page, "contact" when you click one of our email addresses, "submit form" when you complete the membership intake step, and "purchase" and "subscribe" when a membership payment succeeds. A conversion event carries its own name and nothing else. We send no form contents, no names, and no email addresses to any of them; clicking an address tells them that a click happened, never which address or what you then write; the submit form event carries no field value, not one; and the purchase and subscribe events carry no amount, no order number, and no customer identifier.

The pixels in use, and the date each was added:

• (i) Snap Pixel, Snap Inc., added October 6, 2026, for Snapchat advertising. Snap's privacy policy: values.snap.com/privacy/privacy-policy.
• (ii) Meta Pixel, Meta Platforms, Inc., added October 7, 2026, for Facebook and Instagram advertising. Meta's privacy policy: facebook.com/privacy/policy. We have not enabled Meta's server-side Conversions API; the Meta Pixel sends only from your browser.
• (iii) Google tag (Google Ads), Google LLC, added October 7, 2026, for YouTube and Google advertising. Google's privacy policy: policies.google.com/privacy. We have turned Google signals off, so this tag does not link your visit to your Google account for personalization across devices.
• (iv) LinkedIn Insight Tag, LinkedIn Corporation, added October 7, 2026, for LinkedIn advertising. LinkedIn's privacy policy: linkedin.com/legal/privacy-policy. This tag reports the first public page of a visit, not every page you open within it, and we have enabled none of LinkedIn's conversion or server-side features: the conversion events in (d) are not sent to LinkedIn.
• (v) TikTok Pixel, TikTok Inc., added October 12, 2026, for TikTok advertising. TikTok's privacy policy: tiktok.com/legal/page/us/privacy-policy/en. We have switched off TikTok's Automatic Advanced Matching and its enhanced data collection, so this pixel sends page views and the six conversion events described above, never form fields or time on page, and we have not enabled TikTok's server-side Events API.

No advertising pixel loads on the member portal, the concierge tools, or this page. The plans page carries them as of October 15, 2026, so that we can measure which advertising leads to a membership. The payment page is different: it loads no advertising pixel at all while a payment link is open, because that link is a credential and a pixel reports the address of the page it runs on. Only after a payment has succeeded, and only once the link has been removed from the address bar, does a pixel load there to record the purchase event. None loads if your browser sends Global Privacy Control or Do Not Track (Section 11.1). You can also switch all of them off together, in this browser, here:

Opt out of advertising pixels
Status: loading.

The opt-out is stored in your browser's local storage, so it applies to this browser only and is cleared if you clear site data. Cookies a pixel already set can be removed through your browser settings.

2.8Service-Area Lookup (First Party)

Active as of this version (previously described in Version 1.50 as built but switched off; turning it on changed nothing described here).

Once per browsing session and only after the city lookup in Section 2.5 has answered, your browser sends the center-point coordinates of the city that lookup named (a public place center, not your position) to our own server on Google Cloud, which answers which of our service areas, if any, contain that point. The server stores nothing about the request. Its access log records the request path, the response status, and the identifiers of any matching service areas; it never records the coordinates or your IP address.

The answer, a short list of service-area identifiers, is kept in your browser's sessionStorage for the rest of the session. A page may use it to choose which one of its existing items appears first. It changes no wording. If the answer names a service area, our first-party analytics (Section 2.2) records one event carrying that identifier, so that we can count visits per service area; no coordinates travel with it. The lookup does not run if your browser sends Global Privacy Control or Do Not Track, and the event is subject to every limit in Section 2.2.

2.9Email We Send (First-Party Open and Click Measurement)

Added in Version 1.74. This section is about email we send to you, not about the Site. It applies only to messages sent from our own pieterstudio.com addresses, and only to those that carry our measurement; it does not apply to anything you send us, and nothing here reads, scans, or stores the content of your replies.

A message may contain two things. The first is a single transparent one-pixel image hosted on our own domain, which your mail app requests if it loads remote images. The second is a link rewrite: a link in the message may point at our own domain first and then redirect you to where it says it is going, so that we can tell the link was used. Both run on our own servers on Google Cloud. No third party is involved, no advertising network receives anything, and no cookie is set.

When your mail app or you fetch one of those addresses, our server records the date and time, which message or correspondent the address belongs to, the destination for a link, your browser and operating system family as your mail app reports them, your country, region, and city as derived by our load balancer, and a salted one-way hash of your IP address. We do not store your IP address, your email address is not part of that record, and the record is keyed to the message, not to a profile of you.

Two honest limits. An open is a weak signal and we treat it as one: Apple Mail Privacy Protection fetches images on delivery whether or not you ever read the message, Google fetches images through its own proxy, and security scanners fetch them before anyone sees the message at all, so our server labels each fetch by who appears to have made it and we count the automated ones apart. A click is the reliable signal. And unlike the Site, email carries no Global Privacy Control or Do Not Track signal for us to honor, so the controls are the ones below.

Your controls. Most mail apps block remote images by default, and leaving that setting alone stops the pixel entirely; you can also hover a link to see where it goes before using it. If you would rather we did not measure your messages at all, email privacy@pieterstudio.com and we will switch it off for your address. We keep these records for 90 days (Section 8), and the registry that maps a message to a correspondent is kept until we no longer need it or you ask us to delete it.

3What We Do Not Collect

We do not collect: precise geolocation; the contents of any form field; keystrokes; payment card information (the Site processes no payments); biometric information; or information from data brokers. Apart from the advertising pixels described in Section 2.7, we use no third-party advertising, social-media pixels, or cross-site tracking. The email measurement in Section 2.9 is our own, on our own domain, and runs in email we send, never on the Site.

4Data Minimization and Privacy by Design

Pieter Studio is designed around the principle of collecting the minimum amount of information reasonably necessary to operate, secure, and improve the Site. Privacy protections are built into the Site by default, not added afterward:

• (a) the Site sets no first-party cookies; the only cookies come from the advertising pixels, which you can switch off (Section 2.7);
• (b) our analytics are first-party and never leave our own infrastructure for an advertising or analytics network;
• (c) we run only the advertising pixels listed in Section 2.7, on public pages only, and no other third-party advertising or social-media pixel;
• (d) we do not sell personal information, and the only sharing for advertising is through the pixels described in Section 2.7, which you can opt out of;
• (e) we honor GPC and DNT by not measuring you at all and by never loading an advertising pixel;
• (f) we hash device and network identifiers rather than store them raw, and we automatically expire the data we keep; and
• (g) password, hidden, and payment fields are structurally excluded from measurement at the code level.

5How We Use Information

We use the information above to:

• (a) operate, secure, and improve the Site, including understanding which pages and features are used and how the Site performs;
• (b) detect and prevent bots, fraud, abuse, and security threats, including scoring the risk that a device is automated;
• (c) respond to your inquiries and evaluate membership applications;
• (d) comply with legal obligations and enforce our Terms of Service; and
• (e) produce aggregated, non-identifying statistics.

We use the least identifying form of information that will accomplish each purpose, and we rely on aggregated or deidentified data wherever it is sufficient.

6Legal Bases

Where a law requires a legal basis for processing, we rely on: our legitimate interests in operating, measuring, and securing the Site (Sections 2.2 through 2.6); performance of steps you request before entering an agreement (membership inquiries); and compliance with legal obligations. The Site is not directed to the European Economic Area or the United Kingdom, and access from outside the United States, Canada, and Mexico is generally blocked at our network edge. A summary of purposes, categories, and legal bases appears in Appendix A.

7How We Share Information

We share information only with:

• (a) service providers (processors) that host and operate our infrastructure, currently Google LLC through Google Cloud Platform (content delivery, hosting, serverless computing, and data warehousing) and, for the limited purposes described above, Google Fonts and ipapi.co (see Appendix B);
• (b) our corporate affiliates within the Pieter Studio corporate family, for the purposes in Section 5, under this Policy;
• (c) professional advisors, such as lawyers and accountants, under confidentiality obligations;
• (d) authorities or other parties where required by law, subpoena, or court order, or to protect the rights, safety, or property of Pieter Studio, our members, or others (see Section 14); and
• (e) a successor entity in connection with a merger, acquisition, reorganization, or sale of assets (see Section 16), in which case this Policy continues to apply until updated; and
• (f) the advertising companies listed in Section 2.7 (Snap Inc., Meta Platforms, Inc., Google LLC, LinkedIn Corporation, and TikTok Inc.), each of which receives its pixel information directly from your browser and uses it as an independent business for advertising measurement and audience building.

We do not sell personal information and have not sold it in the preceding 12 months. Sending pixel information to the companies in Section 2.7 may be "sharing" for cross-context behavioral advertising as California law defines that term. We began doing so on October 6, 2026 (Snap), October 7, 2026 (Meta, Google, and LinkedIn), and October 12, 2026 (TikTok), and had not done so before those dates. You can opt out at any time through the signals and the control described in Section 11.1.

8Data Retention

We keep information only as long as needed for the purposes above: raw analytics events, 90 days; aggregated daily analytics summaries, 24 months; aggregated heatmap data, 12 months; security event records, 30 days; device and network reputation records, 90 days; email open and click records (Section 2.9), 90 days; email correspondence and application materials, as long as needed to handle your inquiry and meet legal requirements; and the local city-name cache in your browser, 24 hours. Aggregated statistics that identify no one may be kept indefinitely.

9Security

We use commercially reasonable administrative, technical, and organizational safeguards designed to protect information, including:

• (a) encryption in transit (HTTPS everywhere) and encryption at rest for stored data;
• (b) least-privilege access controls and periodic access review;
• (c) audit logging and infrastructure monitoring;
• (d) managed secret storage and key rotation;
• (e) a web application firewall with rate limiting and geographic controls;
• (f) salted hashing of device and network identifiers;
• (g) closed-schema validation of everything our collection endpoints accept;
• (h) vulnerability management and patching of our infrastructure; and
• (i) automatic expiry and routine backup of stored data.

No system is perfectly secure, and we cannot guarantee absolute security.

9.1Incident Response

If we become aware of unauthorized access that affects personal information, we will investigate promptly, take reasonable steps to contain and mitigate the issue, and provide notifications to affected individuals and to regulators where required by applicable law.

10Automated Decision-Making and AI

Our security systems automatically score the risk that a device is a bot or is engaged in abuse, using the signals in Section 2.3. A high score can restrict access to sensitive actions in the member portal or trigger rate limiting. These systems use fixed, rule-based scoring; they are advisory, fail open (errors default to allowing access), and do not produce legal effects without the possibility of human review. To contest a restriction, contact privacy@pieterstudio.com.

10.1Artificial Intelligence

We do not use Site visitor information to train artificial-intelligence models. Specifically, we do not train public or foundation models on your information; we do not sell your information for AI training; and we do not share your information with third-party foundation-model providers. The first-party analytics and security systems described in this Policy do not use machine-learning models trained on your data. AI-related data practices for member services (the member portal and Platform) are governed by the Member Agreements and their Data Processing Addendum, not this Policy.

11Your Choices and Rights

11.1Universal Opt-Out Signals and Do Not Sell or Share My Personal Information

We honor Global Privacy Control (GPC) and Do Not Track (DNT). If your browser sends either signal, our analytics does not run at all, the service-area lookup in Section 2.8 does not run, no advertising pixel loads, and our servers additionally discard any GPC-flagged submissions. This is our supported opt-out mechanism and requires no account or request. To opt out of the advertising pixels alone, without changing anything else, use the control in Section 2.7. Either route is a complete opt-out of sharing for cross-context behavioral advertising.

11.2Access, Deletion, and Correction

You may request access to, deletion of, or correction of personal information we hold by emailing privacy@pieterstudio.com. Note an honest limitation: our analytics and security records are keyed to pseudonymous hashed identifiers, not to names or contact details, so in most cases we cannot link those records to you and therefore cannot retrieve or delete them for a specific person, as permitted by applicable law. Email correspondence and application materials can be retrieved, corrected, and deleted on request, subject to legal retention needs.

11.3Marketing

We send marketing email only if you have asked to hear from us, and any such email will include an unsubscribe mechanism. Transactional and relationship messages (for example, replies to your inquiry) are not marketing. Email we send may carry the first-party open and click measurement described in Section 2.9, which has its own controls.

12State Privacy Rights (Including California)

Depending on your state of residence, you may have rights under state privacy laws, including the California Consumer Privacy Act as amended by the CPRA, such as the rights to know, access, correct, delete, and to opt out of sale or sharing, along with the right not to be discriminated against for exercising them. Whether or not a given statute applies to us at our current size, we voluntarily extend the rights in Section 11 to all United States residents.

For California residents: the categories of personal information we collect are identifiers (pseudonymous session and hashed device identifiers, and email address if you write to us), internet or other electronic network activity information, coarse (non-precise) geolocation, and inferences limited to security risk scores; the sources, purposes, and recipients are described in Sections 2, 5, and 7; we do not sell personal information; the advertising pixels (Section 2.7) may be "sharing" as the CCPA defines it, and we honor GPC as an opt-out preference signal and offer the opt-out control in Section 2.7. You may submit requests via privacy@pieterstudio.com, and you may use an authorized agent as permitted by law. We will verify requests to the extent verification is possible given the pseudonymous nature of our data.

13Cross-Border and U.S. Processing

The Site is operated from the United States, and all information is stored and processed in the United States on cloud infrastructure operated by our service providers. Access to the Site is generally limited to the United States, Canada, and Mexico, and access from outside those countries is generally blocked at our network edge.

If you access the Site from Canada or Mexico, you understand and agree that your information is transferred to and processed in the United States under this Policy. The Site is not directed to the European Economic Area, the United Kingdom, or Switzerland. Where an international transfer mechanism is ever required for a specific processing activity, we will implement an appropriate safeguard (such as standard contractual clauses) before that transfer occurs.

14Government and Law Enforcement Requests

We may receive requests from government agencies, courts, or other parties for information. We review every request for legal validity and appropriate scope before responding, we disclose only the information we are legally required to disclose, and we object to requests that are overbroad or improper.

We may preserve information when reasonably necessary to investigate abuse, to protect our legal rights or the rights and safety of others, or to comply with a valid preservation request. Where we are legally permitted to do so, we will endeavor to notify affected individuals of a request for their information.

15Children's Privacy

The Site is a business site for real estate professionals and is not directed to children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us personal information, contact privacy@pieterstudio.com and we will delete it.

16Business Transfers

If Pieter Studio is involved in a merger, acquisition, financing, reorganization, or sale of assets, personal information may be transferred as part of that transaction. This Policy will continue to apply to your information until the successor entity provides updated terms, and where required by applicable law we will notify you of any material change resulting from the transaction.

17Changes to This Policy

We may update this Policy from time to time. We will post the updated version with a new Last Updated date, and material changes will be indicated on the Site. For material changes, we will provide notice on the Site at least 15 days before the change takes effect where practicable. Your continued use of the Site after the Last Updated date constitutes acceptance of the updated Policy. Prior versions are summarized in Appendix C.

18Accessibility

If you need this Policy in an alternative format, contact privacy@pieterstudio.com and we will work with you to provide it.

19Contact Us

Privacy questions or requests: privacy@pieterstudio.com. General: hello@pieterstudio.com. Mail: Pieter Inc. d/b/a Pieter Studio, Attn: Privacy, 447 Sutter St, Ste 405, San Francisco, CA 94108.

AData Processing Summary

The following table summarizes the main categories of information, why we process them, the legal basis, how long we keep them, and who they are shared with.

BService Providers

The third parties that process information for the Site, and where they operate.

CVersion History

Prior and current versions of this Policy.