© 2026 Black Heron. All rights reserved.
Start a projectBlack Heron LLC ("Black Heron," "we," "us," or "our") respects your privacy. This Privacy Policy explains what personal information we collect when you visit blackheroncreativestudio.com, submit an inquiry, or engage our services; why we collect it; who we share it with; how long we keep it; and the rights you have. It includes the information required under the EU and UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).
This policy is a notice of our practices. It is not a contract, and you do not need to agree to it for it to apply.
Black Heron LLC is the controller of the personal information described in this policy. You can reach us at:
Black Heron LLC
2091 Augusta, Weston, FL 33326, United States
hello@blackheroncreativestudio.com
We have not appointed a Data Protection Officer, as we are not required to. Any privacy question or request can be sent to the email address above.
When we work on a client's behalf. When we build or maintain a website or system for a client that collects information about that client's own customers or visitors, we act as the client's processor. In that case the client's privacy policy governs that information, and we handle it only on the client's documented instructions under a data processing agreement.
We collect information directly from you and, in limited cases, automatically when you use our website. We do not buy personal information or obtain it from data brokers.
Information you provide
Contact details: your name, company name, email address, and phone number, when you submit our inquiry form or contact us.
Project information: details you share about your business, goals, and the engagement you are interested in.
Communications: messages you send us by email or phone, and our replies.
Engagement and billing details: information needed to contract with and invoice you or your company. Payments are processed by Stripe; we do not receive or store full payment card numbers.
Information collected automatically
Technical data: when your browser loads our website, our hosting provider and font provider receive your IP address and basic browser information, as any web server does, in order to deliver the site.
Analytics data (only with your consent): if you select Accept in our cookie banner, Google Analytics 4 collects information about how you use the site, such as pages viewed, time on site, device and browser type, and approximate location derived from your IP address. If you decline, or your browser sends a Global Privacy Control signal, analytics never loads.
Your cookie choice: we store one item in your browser's local storage to remember whether you accepted or declined analytics. It never leaves your device. See our Cookie Policy.
Whether you must provide information
You are never required to give us personal information. However, we need your contact and project details to respond to an inquiry, and we need engagement and billing details to enter into and perform a contract with you. Without them, we cannot provide those services.
GDPR requires us to identify a legal basis for each use of personal information. The table below sets out each purpose and the basis we rely on.
Where we rely on legitimate interests, we have weighed those interests against your rights and concluded they do not override them. You can ask us for more detail on that assessment.
We do not sell your personal information, and we do not use it for targeted advertising. We do not make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects.
We share personal information only as needed to run our business, with the following recipients:
Webflow: website hosting and delivery.
Google: Google Fonts and Google Hosted Libraries, which deliver typefaces and a font-loading script and receive your IP address when pages load; and Google Analytics 4, only if you accept analytics.
Stripe: payment processing.
Business tools: providers of our email, file storage, scheduling, and customer relationship management (CRM) systems.
Professional advisers: our accountants, lawyers, and insurers, where necessary.
Authorities: where required by law, regulation, or legal process, or to protect the rights, safety, or property of Black Heron LLC or others.
Business transfers: a successor in connection with a merger, acquisition, or sale of assets, subject to this policy.
Our service providers process personal information on our behalf under contracts that require them to protect it and use it only to provide their services to us.
We are based in the United States, and most of our service providers process data there. If you are in the European Economic Area (EEA), the United Kingdom, or Switzerland, your information will be processed in the United States, which may not offer the same level of protection as your home country.
Where our providers are certified under the EU–U.S. Data Privacy Framework (and its UK Extension and Swiss–U.S. counterpart), we rely on that framework. Otherwise, we rely on the European Commission's Standard Contractual Clauses and, for UK data, the UK International Data Transfer Addendum. You can request a copy of the relevant safeguards by contacting us.
We may keep information longer where necessary to establish, exercise, or defend a legal claim. When information is no longer needed, we delete or anonymize it.
If GDPR or similar law applies to you, you have the right to:
Access: obtain a copy of the personal information we hold about you.
Rectification: have inaccurate or incomplete information corrected.
Erasure: have your information deleted in certain circumstances.
Restriction: ask us to limit how we use your information in certain circumstances.
Portability: receive information you gave us in a structured, machine-readable format, or have it sent to another organization, where processing is based on consent or contract.
Withdraw consent: at any time, where we rely on consent. Withdrawal does not affect processing that took place before it. To withdraw analytics consent, select "Cookie Settings" in the footer of any page.
Complain: lodge a complaint with your local data protection authority (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concern first.
Your right to object. You may object at any time to our use of your information based on legitimate interests, on grounds relating to your particular situation. We will then stop unless we have compelling legitimate grounds that override your interests, or we need the information for legal claims. You may also object at any time to direct marketing, including any profiling related to it; if you do, we will stop using your information for marketing. Every marketing email includes an unsubscribe link.
To exercise any of these rights, email hello@blackheroncreativestudio.com. We may ask you to verify your identity. We will respond within one month, which may be extended by two further months for complex requests; we will tell you if that applies. Exercising your rights is free of charge.
If you are a California resident, the CCPA, as amended by the California Privacy Rights Act, gives you the right to know what personal information we collect, use, and disclose; to access, correct, and delete it; and not to receive discriminatory treatment for exercising these rights.
In the past 12 months, we have collected the following categories of personal information from the sources described in Section 2, for the purposes described in Section 3: identifiers (such as name, email, and IP address); commercial information (such as engagement and billing records); internet or network activity (such as website usage, with consent); and professional information (such as company name and role). We disclosed these categories only to the service providers listed in Section 4, for business purposes.
We do not sell or share personal information, as those terms are defined under California law, and we do not use or disclose sensitive personal information. We honor Global Privacy Control signals as a request to opt out.
To exercise your rights, email hello@blackheroncreativestudio.com. We will verify your request and respond within 45 days, which may be extended once by a further 45 days with notice. You may use an authorized agent to submit a request on your behalf.
We use reasonable technical and organizational measures to protect personal information, including encrypted connections (HTTPS), access controls on our accounts, and providers that maintain recognized security standards. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If a breach affects your personal information and is likely to put your rights at risk, we will notify you and the relevant authorities as required by law.
Our Cookie Policy explains the cookies and similar technologies we use, including Google Analytics, which loads only with your consent. You can change your choice at any time through the "Cookie Settings" link in the website footer.
Our website may link to other websites. We are not responsible for their privacy practices, and we encourage you to read their policies.
Our services are for businesses and are not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.
We will update this policy when our practices change. The "Last updated" date at the top shows the latest version. If we make a material change, we will post a notice on our website and, where we have your email address and the change affects you, notify you directly.
For questions about this policy or to exercise your rights, contact:
Black Heron LLC
2091 Augusta, Weston, FL 33326, United States
hello@blackheroncreativestudio.com