Privacy Policy

Effective Date: October 4, 2025
Last Updated: October 2, 2026

‍

GOODNOTBAD ("we," "our," or "us") values your privacy and aims to make our practices clear, minimal, and respectful. This Privacy Policy explains how we collect, use, and safeguard your information across our website, communications, and services.

1. What We Collect

We collect only the information we need to run our business and serve you well.

Information You Provide Directly

When you contact us, request a service, fill out a form, or download resources, we may collect:

Your name
Your email address
Your company name
Project information or preferences
Other details you choose to share

Information We Collect Automatically

Through cookies or analytics tools, we may collect:

IP address and browser type
Device information and approximate location
Website usage, such as pages visited and time on site

We may use tools such as Google Analytics. We choose vendors carefully and use them responsibly.

Client Portal Account Information

If your team has access to the GOODNOTBAD client portal, we also collect:

Account credentials. Your name, email address, and a securely hashed password. We never store your password in plain text.
Session data. An HTTP-only authentication cookie issued when you sign in.
Activity logs. A record of each sign-in, sign-out, resource view, and resource download, including the time, your IP address, and the browser/device you used. These records help us secure the portal and improve how we deliver resources to your team.
Files we deliver to you. Documents, guides, and templates we upload to your account on your behalf.

2. How We Use Your Information

We use the information we collect to:

Respond to inquiries and client requests
Improve our website and services
Send transactional emails required to use the portal, such as sign-in links, password resets, and account provisioning
Keep marketing emails strictly opt-in
Understand our audience and make thoughtful business decisions
Provide secure access to your client portal account
Deliver and personalize the resources assigned to your team
Detect and investigate suspicious sign-ins or account activity
Troubleshoot issues you report, which may include authorized GOODNOTBAD staff previewing your portal exactly as you see it to provide support

We do not sell your data. We do not serve third-party ads. If our practices change in the future, we will be clear about it.

3. Legal Basis (for GDPR Users)

If you are in the EU or UK, we only collect and use your data when we have a legal reason to do so, such as:

You gave us consent
We need the information to provide a service
It is in our legitimate interest (for example, improving our services)

4. Data Sharing and Storage

We store your data using a small set of trusted providers, chosen for their security posture and privacy practices:

Cloudflare. Hosts our website and the client portal, and stores account data, activity logs, and the files we deliver to your team. All portal data is encrypted in transit (HTTPS) and at rest.
Google Workspace. Our internal email, documents, and project records.
Stripe. Processes payments when you pay us by card or bank. Stripe stores your billing details directly. We only see the transaction status, such as succeeded or failed, and never have access to your full card number.
Resend. Delivers inquiries submitted through our website's contact form to our team and, when enabled, sends transactional emails from the portal, such as sign-in links and password resets.

Beyond the providers listed above, we may use additional service providers (for example, project management, design, or scheduling tools) that handle limited operational data on our behalf. To request a current list of our subprocessors, email us at privacy@goodnotbad.studio.

We share information with these vendors only as needed to provide our services to you, and never for their own marketing.

If we work with subcontractors (such as developers or collaborators), they will be under contract to keep your information safe.

Our portal infrastructure operates globally, which means data may be processed and stored outside your country, including in the United States. If you are in the EU or UK, this transfer is covered by Standard Contractual Clauses included in Cloudflare's Data Processing Addendum.

5. Your Rights (Under GDPR and CCPA)

You have rights, including the right to:

Access the personal information we hold about you
Correct or delete your information
Withdraw consent at any time
Ask us to stop processing your data

To exercise any of these rights, email us at privacy@goodnotbad.studio.

6. Cookies

We use two kinds of cookies, depending on whether you are visiting our marketing site or signed into the client portal.

Essential authentication cookie (client portal only). When you sign into the portal, we set a single HTTP-only, same-site cookie that keeps you signed in until you sign out. It does not track you across other sites, and it cannot be disabled while you are signed in. Signing out clears it.

Analytics cookies (marketing site). On goodnotbad.studio, we use cookies sparingly to analyze how visitors use the site, improve speed and experience, and remember preferences. You can manage these in your browser or use a blocker.

7. Data Retention

We retain personal data only as long as we need it. For the client portal specifically:

Account and client records. Kept while your engagement with GOODNOTBAD is active, and deleted at offboarding.
Activity logs. Kept for 365 days, after which we anonymize IP addresses and user-agent strings so aggregate usage counts remain but personally identifiable detail is dropped.
Files we deliver to you. Kept in your portal account for the duration of the engagement, and deleted at offboarding.

For everything else, such as inquiries, project records, and marketing contacts, we keep data only as long as needed for project records, legal requirements, or ongoing communication. If you request deletion, we will comply unless we are legally required to retain it.

8. Children's Privacy

We do not knowingly collect personal information from children under 13. If you believe a child has submitted information to us, contact us and we will delete it.

9. Changes to This Policy

If our policies change, we will update this page with a new date. If the changes are significant, we will notify you directly when we have your contact information.

10. Contact

For questions or concerns:

Email: privacy@goodnotbad.studio
Website: https://www.goodnotbad.studio