Privacy policy
in plain words.

The controller is NordicHost Oy (business ID 3480634-4), Kurikkahaantie 12 J 39, 90440 Kempele, Finland.

For anything about your personal data, email tuki@nordichost.fi.

• Account: your name, email address, password (kept only as a one-way hash), language and settings.
• If you sign in with Google or GitHub: the name, email address and profile picture they share with us.
• Your projects: what you write to the assistant, the files and images you upload, your sites’ content and code, and your design choices.
• Billing: your name or company name, address, VAT number and email address for invoices. Stripe handles card and bank details; we only see details such as the card type and its last four digits.
• Domains: the contact details the registry requires from a domain holder: name, address, email address and phone number.
• Connected apps: the access an app you connect gives your site.
• Use of Studio: the credits each request used and your sites’ traffic figures.
• Messages with us: what you write to us.
• Technical data: IP addresses, browser details, and logs of requests and errors.

• To provide Studio under our contract with you: your account, projects, sites, domains and payments, and the emails Studio sends about them.
• To meet our legal obligations, such as accounting and the rules of domain registries.
• For our legitimate interests: keeping Studio and its users safe, preventing abuse and fraud, and fixing and improving Studio.

We do not sell personal data or use it for advertising.

The assistant runs on Anthropic’s Claude models. What you write to it and the content of your project are sent to Anthropic to produce its replies. Under its commercial terms, Anthropic does not use this data to train its models. Don’t put special categories of personal data, such as health information, in your requests.

These services process data for us, under data processing agreements and only to run Studio:

• Supabase: our database and sign-in, in Stockholm, Sweden
• Cloudflare: hosting for Studio and your sites, the environments where your projects are built, backups and site databases in the EU, and bot protection on the sign-up and log-in forms
• Anthropic: the AI assistant
• Resend: the emails Studio sends and your sites’ form messages
• NordName: registering and managing domains
• Nango: connecting the apps you choose to your sites
• Refero: design references, found with search words taken from your project’s description
• Unsplash: photos, found with search words only
• Slack: our internal alerts, which carry account identifiers but no names or email addresses
• GitHub: copies of the code of sites published before 11 November 2026, which we are removing

Stripe also uses payment data as a controller of its own, for example to prevent fraud and to meet its legal duties. Domain registries, such as Traficom for .fi domains, receive a domain holder’s details as their rules require and may publish some of them. The font of the payment form and some font samples load from Google’s servers, which see your IP address. We hand data to authorities only when the law requires it.

Some of these companies are based in the United States or process data there, such as Anthropic, Cloudflare, Stripe, Resend and Google. We transfer personal data outside the EU and the EEA only with the safeguards the GDPR requires: the EU-US Data Privacy Framework where the company is certified under it, and otherwise the European Commission’s standard contractual clauses.

• Your account, projects and sites: as long as your account exists. When you delete your account or a project, it is deleted, and copies in backups disappear within 30 days.
• Projects of free accounts: deleted 30 days after we warn you that a project has gone unchanged for 120 days.
• Invoices and payment records: six years, as accounting law requires.
• A domain holder’s details: while the domain is registered through us, and as long as the registry’s rules require.
• Emails we send, including your sites’ form messages: Resend keeps them for 30 days.
• What the assistant receives: Anthropic keeps it for up to 30 days.
• Logs of requests, errors and sign-ins, which include IP addresses: a few days. IP addresses used to limit how often requests can be made: about an hour.

Studio uses only the cookies and browser storage it needs to work, so it does not ask for consent. It has no analytics or advertising cookies.

• nh_session: keeps you signed in when the app talks to Studio’s servers, for one day
• nh_language: remembers your language, for one year
• __Host-pv: lets you see your site’s live preview, for 12 hours
• Browser storage: your sign-in session, your language, choices such as a closed notice, and your first request while you sign up
• Stripe: its payment form loads on Studio’s pages and sets its own cookies to prevent fraud

Sites with sign-in for visitors keep their members signed in with a cookie for 30 days.

You can ask for a copy of your personal data, have it corrected or deleted, restrict or object to its use, and receive the data you gave us in a machine-readable form. Where we rely on your consent, you can withdraw it at any time.

You can change your name and email address in Settings and delete your whole account there. For anything else, email tuki@nordichost.fi. We answer within a month and may ask you to confirm who you are.

If you think we handle your data wrongly, you can complain to the Data Protection Ombudsman, the supervisory authority in Finland, or to the authority where you live or work.

When a site made with Studio collects data from its visitors, the site’s owner decides what is collected and why, and NordicHost processes it for them under the data processing agreement in our terms. If you visited such a site, contact its owner about your data.

Studio is meant for adults. We do not knowingly collect data from children under 18.

We update this page when how we handle data changes, and email account holders about significant changes before they take effect.