Privacy
Privacy & cookies.
This page covers openframe.design. I keep it short because I collect very little: what you send me, and, only if you allow it, visit stats from Google Analytics.
Who I am
Open Frame is the design studio of Graham Ivy, based in Barcelona, Spain, working with clients in the US and Europe. I'm the one responsible for your data here (the "controller" under EU law). Questions or requests go to hello@openframe.design.
What I collect and why
When you write to me
The contact form sends your name, email and message to my inbox through Web3Forms, a form service. Emails you send me directly land in the same place. I use them to reply and, if we work together, to run the project. The legal basis is your request (taking steps toward a contract) and my legitimate interest in answering messages.
Visit stats, only if you say yes
If you tap Allow on the cookie card, Google Analytics records which pages you view, roughly where you are (city level), your device and browser, and how you got here. I use it to see which work people look at and where visitors come from. The legal basis is your consent. If you tap No thanks, or don't choose, Google Analytics never loads. Advertising features and Google Signals are off, and nothing is used for ads.
Studio sign-in (clients only)
Studio sign-in is paused since November 3, 2026, so no new sign-ins happen. When it was open, invited clients could sign in at openframe.design/studio with an emailed code or with Google. Google sign-in only shares your name, email address and profile picture with me, nothing else. The Open Frame Hub, a private Google Apps Script, stores your email, a scrambled (hashed) session token and when you signed in, in a private Google Sheet that also holds your project files, review notes and approvals. A session lasts 30 days. The legal basis is our contract: I need it to share work with you and record your approvals.
Things that happen on any website
- The site is hosted on GitHub Pages. GitHub logs visitor IP addresses for security, as described in its privacy statement.
- The site's fonts come from Google Fonts, so your browser sends your IP address to Google when it loads them. Google says it doesn't use this to build profiles.
- "Book a call" buttons open Calendly. Anything you enter there is covered by Calendly's privacy notice.
Cookies and local storage
| Name | What it does | How long | Needs consent? |
|---|---|---|---|
| of-consent, of-consent-at | Remembers your cookie choice so the card doesn't keep popping up. Stored in your browser only. | 12 months, then I ask again | No, it's needed to respect your choice |
| of-studio | Keeps clients signed in to the Studio page. Only set if you sign in. | 30 days, or until you sign out | No, it's needed for sign-in |
| _ga, _ga_RF906YB2TT | Google Analytics. Tells one visit from the next without knowing who you are. | 2 years | Yes, only set after Allow |
Change your mind any time. Saying no removes the Google Analytics cookies from this site.
Who else handles your data
Google (Analytics, Fonts, Google sign-in, the Apps Script and Sheet behind the Studio, and the Google Workspace account my email runs on), Web3Forms (the contact form), GitHub (hosting) and Calendly (booking, if you use it). Some of them are in the US. Google, GitHub and Calendly take part in the EU-US Data Privacy Framework, and where that doesn't apply, transfers rely on the European Commission's standard contractual clauses. I don't sell your data and I don't share it with anyone for advertising.
How long I keep it
Studio sign-in records stay while you're an active client, and I delete them when the project ends or you ask. Messages stay in my inbox while we're talking or working together, and I delete them on request. If we sign a contract, Spanish tax law makes me keep invoices and related records for up to 6 years. Google Analytics keeps visit data for up to 14 months, then deletes it.
Your rights
Wherever you live, you can ask me what I have about you, ask me to correct or delete it, or ask me to stop using it. Email hello@openframe.design and I'll answer within 30 days. I won't treat you differently for asking.
In the EU and UK you can also ask for a copy in a portable format, object to processing based on legitimate interest, and withdraw consent at any time without affecting what happened before. If you think I've got it wrong, you can complain to the Spanish data protection authority, the AEPD, or the authority where you live.
US visitors
I don't sell or share personal information, as California and other state privacy laws define those terms, and I don't use it for targeted advertising. The categories I collect are the ones above: contact details and messages you send, and, with your consent, device and usage data from Google Analytics.
If your browser sends a Global Privacy Control or Do Not Track signal, I treat it as a no: Google Analytics stays off unless you turn it on yourself on this page.
Children
This site is for businesses and organizations. It isn't aimed at children under 16, and I don't knowingly collect their data. If you think a child has sent me something, email me and I'll delete it.
Changes
When I change this page, I'll update the date at the top. If a change affects analytics, the cookie card will ask you again.