Privacy policy

The short version: we collect what you type into the contact form and send us afterward, we use it to answer you and do the work, we have never sold or traded any of it, there is no newsletter and no advertising pixel on bumfuzzledjane.com, and asking us to delete your thread deletes it, usually the same day. The detail follows.

Who we are

Bumfuzzled Jane is the trading name of Jane Halloway, a sole proprietor working as an independent interior design consultant. For privacy-law purposes she is the data controller: the person who decides what is collected and why. Here that is also the person who reads it.

• Post: 1420 NW Kearney Street, Studio 3, Portland, OR 97209, United States
• Email: hello@bumsfuzzledjane.com
• Telephone: +1 (503) 555-0148

The practice is in Oregon and consulting is delivered remotely across the country, so your information is stored and processed on servers in the United States.

What we collect

The contact form

The form on the contact page asks for your name, email address, an optional phone number, an optional city and state, which service you think you need, a budget range, a timeline and a description of the problem. There is a required consent checkbox and one hidden field that only bots fill in; if that field comes back filled, the message is discarded unread. Only name, email, service, budget, timeline and message are required.

Email correspondence and project files

Most projects arrive as attachments: photographs of rooms, floor plans, inspection reports, contractor bids with company names and prices on them, sometimes a street address so we can work out which way the windows face. Clients also have a file of the agreed scope, invoices and deliverables.

Analytics and server logs

Every web server records requests. Logs hold the page, the time, the referring page, a truncated IP address and a user-agent string describing your browser. Aggregate analytics tell us which journal article gets read most: useful for deciding what to write next, useless for identifying anybody.

What we deliberately do not collect

• No card details anywhere on bumfuzzledjane.com. Invoicing happens on the provider’s own secure page.
• No accounts, logins or passwords. There is nothing here to log into.
• No advertising pixels, retargeting tags or social tracking scripts.
• No session recording, heatmaps or mouse-movement capture.
• No purchased data or broker enrichment appended to an inquiry.

Why we use it, and on what basis

Nothing is used for automated decision-making or profiling. No software scores whether an inquiry deserves a reply; Jane reads all of them.

Cookies and analytics

No advertising cookies, no cross-site tracking. What does exist:

• Strictly necessary. Hosting and security may set a cookie to keep the site online and protect it from abuse. No marketing purpose, and it cannot follow you elsewhere.
• Analytics. An aggregate-only service counting page views and referrers, building no cross-site profile.
• Web fonts. The two typefaces load from Google’s font servers, so Google receives your IP address and browser string. No cookie is set, a content blocker stops it, and the site falls back to system fonts without breaking.
• Embedded media. None. No third-party players, maps or chat widgets.

Block or delete cookies freely; nothing here requires a login.

Who else touches your data

A one-person practice rents its infrastructure. These providers process data on our behalf, under contract and only on our instructions: web hosting and CDN (serves pages, keeps logs), form handling, email (the mailbox and backups), analytics, cloud file storage (project photographs and deliverables), scheduling, video calling (calls are not recorded unless you ask, and if you ask you get the file too), and invoicing through an accounting provider whose secure page takes the payment. We never see or store a card number.

Ask and we will name the current providers. We would rather give you the live list than publish one that goes out of date.

How long we keep it

Anything goes sooner if you ask, except records we must keep for tax. Those are locked away rather than used.

Sharing, and not selling

We have never sold personal information and do not share it for cross-context behavioral advertising. In California’s terminology there has been no “sale” and no “sharing” in the preceding twelve months, or in any twelve months before that. Information leaves this studio in four circumstances only:

1. To the processors above, so the work can happen.
2. To people you ask us to talk to — your contractor, cabinet maker, architect or partner — at your direction, never on our own initiative.
3. Where the law requires it: a subpoena, a court order, a tax audit.
4. If the practice were sold, records would pass to the buyer under these same obligations, and you would be told first.

No supplier, brand or showroom receives your details as a lead. That would be an odd thing for a practice taking no commission of any kind to do, and the ASID code of ethics requires disclosure of supplier compensation in any case. Ours is always none.

Security

• Every page is served over HTTPS.
• Unique passwords in a password manager, with two-factor authentication wherever supported.
• Project files in access-controlled cloud storage rather than loose on a laptop.
• Devices encrypted at rest and locking themselves.
• One person has access: no shared inbox, no contractor login, nobody offshore reading client email.

No system is perfect, and anyone claiming otherwise is selling something. If a breach put your information at genuine risk you would hear it from us promptly, in plain language, with what we were doing about it.

California residents: CCPA and CPRA

Californians may ask what we hold, get a copy, have it corrected or deleted, opt out of sale or sharing, limit the use of sensitive personal information, and not be treated worse for asking. The categories collected in the last twelve months are identifiers (name, email, phone, IP), commercial information (service, budget range, timeline), internet activity, coarse city-level geolocation, and photographs of your home that you chose to send.

We collect no sensitive personal information as the CPRA defines it, so there is nothing to limit, and no sale or sharing, so no opt-out link to click. Email us with “Privacy request” in the subject. We verify by replying to the address already on the thread, acknowledge within ten days and respond within forty-five. An authorized agent may act for you with written permission.

Other US states

The Oregon Consumer Privacy Act gives residents access, correction, deletion, portability and an opt-out from targeted advertising, plus the right to ask for a list of the specific third parties we have disclosed data to — unusual, and we are happy to answer it. Colorado, Connecticut, Texas, Virginia and a growing number of others grant similar rights. Same email, same process, same answer: less is held here than most people expect.

Visitors from the EU and the UK

We are a US practice serving US homes and do not market to Europe, but the journal is read everywhere. Where the GDPR or UK GDPR applies you have rights of access, rectification, erasure, restriction, portability and objection, and may withdraw consent at any time without affecting what was lawful beforehand. Your data is held in the United States, and where a transfer mechanism is required our processors operate under standard contractual clauses. You may complain to your supervisory authority, or the Information Commissioner’s Office in the UK, though we would rather you wrote to us first.

Children

This service is for people who own or rent homes and is not directed at children. We do not knowingly collect personal information from anyone under sixteen. When sending photographs of a nursery or a teenager’s bedroom, make sure no child is identifiable in the frame; we do not need it and will ask you to resend. If you believe a child has sent us information, write and it will be deleted.

Changes to this policy

The date at the top changes whenever the policy does. Where a change is significant — a new category of data, a new purpose, a different retention period — current clients are told by email rather than left to spot it. Changes never apply retroactively to reduce rights you already had, and earlier versions are available on request.

How to reach us about any of this

Email is best, with “Privacy request” in the subject so it is not filed as a project inquiry. Phone and post work too, and every route reaches the same person rather than a ticketing system. The rest of the small print is on the terms of service and the disclaimer, the accessibility statement covers getting any of it in another format, fees are on the services page, and the free advice is in the journal.