Privacy Policy

Version 1.1 · Effective 3 October 2026

Who we are

Sapience AS, trading as Sapience Design ("Sapience", "we"), is a Norwegian design and engineering studio. We are the data controller for personal data processed through sapience.design.

This policy covers what we collect when you visit the site, book a meeting, subscribe to our newsletter or get in touch, and why. Client engagements are covered by the Services Agreement and Statement of Work signed for that engagement — see Legal.

What we collect, and why

Visiting the site

We use Umami Cloud, a cookieless analytics service, to see how many people visit and which pages they read. It records page views, referrers, browser and device type, and country. It does not set cookies, does not store your IP address and does not follow you across other websites. We also count a few named interactions — for example a click on "Get in touch", a project card or the language switch — without any name or email attached.

We also use PostHog (EU cloud) to understand how the site is used, but only as far as you allow in the banner shown on your first visit:

• If you accept, PostHog sets a cookie that recognises your browser between visits and records how you use the pages: page views, clicks, scrolling and session recordings. Everything you type into forms is masked and never recorded.
• If you decline, PostHog stores nothing in your browser and records nothing beyond counting the visit, using a hash PostHog calculates on its servers from your IP address, browser and a random value that changes daily; the IP address itself is not kept.
• Until you answer, PostHog records nothing.

You can change your answer at any time with "Cookie settings" at the bottom of every page.

Our host, Hostinger, keeps standard server logs (IP address, time, requested page, browser) for security and operations.

Legal basis: our legitimate interest in running and improving the site (GDPR Art. 6(1)(f)); for PostHog tracking and recordings, your consent (Art. 6(1)(a) and ekomloven § 3-15).

Booking a meeting

The "Book a meeting" button on the contact page takes you to Cal.com, where you enter your name, email and any details you choose. Cal.com processes this under its own privacy policy and notifies us of the booking so we can prepare. We record that a meeting was booked, and its type and length, as an anonymous analytics event.

Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b)).

Newsletter

If you subscribe, we send your email address, the language you subscribed in, and a topic tag to Kit (formerly ConvertKit), which delivers our newsletter. Every email has an unsubscribe link.

Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time.

Contact form

The contact form sends your name, email and message to our own server, which delivers it to our inbox at Google Workspace, the email service we use for all our mail. No other service receives it. With your message we include some context to help us reply: which site you came from and the first page you visited (kept only in your browser tab until you send), the page you sent from, the time, your language, and your browser and device type. We do not record your IP address or location. You can also email or call us directly and skip the form.

Legal basis: steps taken at your request before a possible contract (Art. 6(1)(b)), or our legitimate interest in answering enquiries (Art. 6(1)(f)).

Blog and portfolio

Blog text and images are served from our content system, Sanity, through its CDN. Reading them sends no personal data to Sanity. Some posts embed YouTube videos in privacy-enhanced mode (no cookies until you press play) or Figma files, which load from those services under their own policies.

Fonts

All fonts are served from our own domain. Your browser makes no requests to third-party font services.

Cookies

The first two and the last are strictly necessary, so they need no consent; the PostHog cookie is set only with your consent (Norwegian Electronic Communications Act, ekomloven § 3-15). We use no advertising or cross-site tracking cookies.

Who receives data

Some of these providers are based in, or process data in, the United States. Where personal data leaves the EU/EEA, the transfer relies on the provider's safeguards: the EU–US Data Privacy Framework or the EU Standard Contractual Clauses.

We never sell personal data or use it for third-party advertising.

How long we keep it

• Server logs: for the limited period set by our hosting provider.
• Newsletter: until you unsubscribe.
• Enquiries and contact messages: as long as the enquiry or a resulting engagement is active, then up to three years after our last contact.
• Bookings: as long as needed to prepare for and follow up the meeting; Cal.com applies its own retention.
• Analytics: Umami keeps anonymous, aggregated statistics with no personal identifiers. PostHog deletes session recordings after 30 days.

Your rights

You can ask us for access to, correction of, or deletion of your personal data; object to or restrict processing based on legitimate interest; receive data you gave us in a portable format; and withdraw consent at any time. Email letstalk@sapience.design and we will reply within the time limits set by law.

You can complain to the Norwegian Data Protection Authority, Datatilsynet, or to the authority in your own EU/EEA country.

Changes

When this policy changes we update the version and date at the top. Subscribers will be told of material changes that affect the newsletter.