Clear about what we collect.

01 / Scope

Who this notice covers

Shapes Above ("Shapes Above," "we," "us" or "our") provides brand strategy and design services. This notice applies to personal information handled through shapesabove.com, our Brand Review form and related email communications. It does not cover third-party websites or services that have their own privacy notices.

02 / Information

Information we collect

We collect this information directly from you, automatically from your browser and device, from service providers that protect and operate the site, and from public sources you ask us to review.

03 / Use

How we use information

• Prepare and deliver the Brand Review you request.
• Respond to questions and communicate about our services.
• Evaluate whether our services may be a good fit for your business.
• Operate, maintain, troubleshoot and improve the website and form.
• Detect abuse, protect the site and keep our systems secure.
• Maintain business records and comply with legal obligations.

We do not use personal information for automated decisions that produce legal or similarly significant effects.

04 / Disclosure

Who receives information

We disclose information only as needed for the purposes above, including to the following service providers:

Cloudflare

Website hosting, security, Turnstile abuse prevention and a temporary delivery buffer.

ClickUp

Customer relationship management and review-request workflow.

Resend

Transactional email delivery.

Google Workspace

Business email and communication.

Google Fonts

Font delivery; a request may disclose your IP address and browser information to Google.

We may also disclose information to professional advisers, regulators or law enforcement when reasonably necessary; to protect rights, safety and security; or as part of a merger, financing, acquisition or transfer of the business, subject to appropriate protections.

05 / Your choices

Your privacy rights

Depending on where you live and subject to applicable law, you may have the right to ask whether we process your personal information; access or obtain a portable copy; correct inaccuracies; delete information; or receive information about the categories, sources, purposes and recipients of personal information. You may also have the right to opt out of a sale, targeted advertising or certain profiling, limit some uses of sensitive information, use an authorized agent, appeal a decision, and receive equal service when you exercise a right.

To make a request, email marcelo@shapesabove.com with the subject “Privacy Request” and describe your request. We may ask for information reasonably necessary to verify your identity or an agent’s authority. We will respond within the period required by applicable law and explain if an exception applies.

To appeal a privacy-request decision where that right applies, reply to our decision with the subject “Privacy Appeal.” You may also contact the attorney general in your state.

California notice

The categories of personal information we may have collected in the preceding 12 months are identifiers and contact information; professional or employment-related information; internet or other electronic activity; approximate location derived from a business location or technical data; and inferences created when we assess a public brand presence. The examples, sources, business purposes and categories of recipients are described in Sections 2–4 above.

We may disclose these categories to service providers for the business purposes described above. We have not sold or shared these categories for cross-context behavioral advertising. We do not knowingly sell or share personal information of consumers under 16. California residents may exercise the rights described in this section, subject to the law’s scope and exceptions.

Browser privacy signals

Because we do not sell personal information or use it for targeted advertising, there is no advertising opt-out to apply today. If our practices change, we will update this notice and honor legally required browser-based opt-out signals, including Global Privacy Control, where applicable.

06 / Retention + security

We keep information only as needed

Completed form submissions in our temporary Cloudflare delivery buffer are scheduled for deletion 30 days after they have been handed off successfully. Records with an unresolved delivery issue may be retained while we recover the request and are reviewed for deletion afterward. Information in our CRM, mailboxes and service-provider records is kept only as long as reasonably necessary for the request, our business relationship, security, recordkeeping and legal obligations.

We use administrative, technical and organizational measures designed to protect personal information. No online transmission or storage system is completely secure, so we cannot guarantee absolute security.

07 / Other information

Children, transfers and updates

Children

Our website and services are intended for businesses and are not directed to children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided information, contact us so we can review and delete it as appropriate.

Processing locations

We and our service providers may process information in the United States and other countries. Privacy and data-protection laws may differ from those where you live.

Changes to this notice

We may update this notice when our services, providers or legal obligations change. We will post the revised notice here and update the effective date. If a change materially affects how we use information already collected, we will provide additional notice when required.