Privacy Policy
What we keep, and what we don't.
How this site and our contact form handle your data, in plain words.
At a glance
- On your device
- Your draft form entries and a tab-session flag for the opening scroll lock.
- When you submit
- Your message is sent as an email to our mailbox at Hostinger. No copy is sent back to you.
- Tracking
- No analytics or advertising pixels are installed on this site.
- Hosting
- Our hosting provider processes connection data to deliver the site.
- Your rights
- You can contact us about your personal data, including requests for access, correction or deletion.
Who is responsible
nicy&spicy Ltd, the company operating nicy&spicy, is responsible for how this website processes your personal data. Its details are below.
- Company
- nicy&spicy Ltd
- Registered office
- SOHO The Strand, Fawwara Building, Triq l-Imsida, Gzira GZR 1401, Malta
When you visit
This site is hosted with Hostinger. When you open a page, the host handles the connection so the page can be delivered: the address you asked for, the time, the browser, and the IP address.
We do not keep our own log of what you read or what you type. The host's legal name, where the servers are, and how long the host keeps connection logs are still to be confirmed. The legal basis for this processing is part of the review this draft is waiting on.
The contact form
The form asks whether you are a creator or a brand or business, which platforms or needs you choose, a handle or a company, your idea, your name, your email, and a consent checkbox.
Sending posts those fields to our server. The server turns them into one email and sends it, encrypted, through the mail server of our host, Hostinger, to our mailbox hello@nicyandspicy.com. The email holds your answers, your name, your email address, and the time you sent it. Your address is set as the one we reply to. No copy is sent to you. Nothing you type is written into a log.
A field that is not shown, and a check that the form was open for a moment before it was sent, keep automated submissions out. There is no captcha and no third-party check.
The same server uses the IP address as the key of two limits: how often the form can be posted within ten minutes, and how many messages can be sent within a day. For an IPv6 address, it uses the network the address belongs to. The address is held in the memory of that server process, not in a database, for at most a day. An entry drops when the process restarts, or when the memory list passes its cap and forgets the entries that have been quiet longest. So that a message sent twice goes out only once, the server also keeps, for ten minutes, a fingerprint made from the kind of inquiry, your email address, and your message. It is a hash, not the text itself.
You can also write to hello@nicyandspicy.com.
On your device
Two entries stay in this browser. Neither is sent to us.
A draft of the form is stored in localStorage under the key nicyandspicy:contact-draft:v1. It keeps what you chose and typed. It does not keep the consent checkbox. It is written as you go. If it is older than 30 days, it is deleted the next time the form reads it. The browser does not expire it on its own. Choosing Start fresh deletes it. A send that the server accepts deletes it too.
A flag in sessionStorage under the key nicyandspicy:intro-seen remembers that the opening scroll lock has already run in this tab. It is there so the lock happens once in the tab, not as a count of your visits. Closing the tab clears it.
Whether either entry is strictly necessary, or needs consent, is part of the legal review. This page does not decide that.
No tracking
This site does not use analytics, advertising pixels, or third-party scripts. The typefaces are served from this site.
Links to Instagram, Facebook, LinkedIn, and WhatsApp load nothing from those companies until you follow them. What happens then is under their terms. If you write to us there, that company holds the message as well.
Who else sees your data
The host sees the connection data described above, because it delivers the site. Hostinger also runs our mailbox, so it holds the emails the form sends.
We do not sell personal data, and we do not pass it on for advertising.
Transfers outside the EU
Where the host keeps connection data, and where the mailbox keeps messages, is still to be confirmed. Until that is known, this page does not claim that data stays in the EU, and it does not name a transfer tool.
How long we keep things
Connection logs: for as long as the host keeps them. That period is still to be confirmed.
What you type in the form: the server reads it to send the email and does not store a copy. The email stays in our mailbox for up to 6 months after our last contact, unless we work together. The IP address used for the limits stays only in memory, for at most a day, as described above.
The draft: up to 30 days in this browser, then deleted on the next read, or sooner if you choose Start fresh.
The opening flag: until the tab closes.
Your rights
You can ask us for access, correction, deletion, or a copy of the personal data we hold, and to limit how we use it. Where a basis is consent, you can withdraw it. The basis for each activity on this site is part of the review, so this draft does not name one.
You can also complain to the Information and Data Protection Commissioner in Malta.
Write to hello@nicyandspicy.com.
Do you have to give us data?
No. You can read the site without an account and without the form. Without a name, an email address, and the consent checkbox, the form cannot take the message.
No automated decisions
We do not make decisions about you by automated means, and we do not build profiles of you.
Changes
The date in the line above is the date of this wording. When the wording changes, that date changes with it.