Privacy Policy

Last updated: 2 August 2026

This policy explains what personal data thedesigntools.site collects, why we collect it, what legal basis we rely on, who it is shared with, and what rights you have. It is written to meet the transparency requirements of the EU/UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act as amended by the CPRA, along with comparable US state privacy laws.

The short version

• We collect an email address only if you subscribe to the newsletter or choose to give one when submitting a tool.
• We do not sell your personal information, and we do not share it for cross-context behavioural advertising.
• Our hosting provider keeps standard server logs, as every website does.
• Some outbound links are affiliate links. These are disclosed, and they never influence our editorial picks.
• You can ask us to show you, correct, or delete your data at any time by emailing hello@thedesigntools.site.

1. Who is responsible for your data

The Design Tools (thedesigntools.site) is the data controller for the personal data described in this policy — meaning we decide what is collected and why. The Design Tools is operated by an individual, not a registered company.

Contact for all privacy matters: hello@thedesigntools.site. We reply to every genuine privacy request sent to this address, and treat it as the primary and fastest way to reach us for anything in this policy — including exercising any of the rights in sections 8 and 9.

We have not published a postal address on this page. We’re in the process of setting one up (a registered mailbox, not a home address) to fully satisfy the geographic-address requirement of the EU e-Commerce Directive (2000/31/EC, implemented in Sweden as Lag (2002:562) om elektronisk handel); this section will be updated with it. In the meantime, a postal address can be requested by emailing us for any legitimate legal purpose.

We are a small independent publisher. We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR — our processing is limited in scale, is not systematic monitoring on a large scale, and does not involve special-category data.

2. What we collect, why, and on what legal basis

Under GDPR we must tell you the specific lawful basis for each processing activity. Here it is in full.

Newsletter subscription

• Data: your email address, and the date/time you subscribed.
• Purpose: to send you the newsletter you asked for.
• Legal basis: your consent (Article 6(1)(a) GDPR). You give it by submitting the form; you can withdraw it at any time by unsubscribing or emailing us, and withdrawing it does not affect the lawfulness of anything we sent beforehand.
• Is it required? No. Subscribing is entirely optional and nothing on the site is gated behind it.

Tool submission form

• Data: the tool’s name, website, category, description, pricing and your stated reasoning — plus your email address if you choose to provide it (that field is optional).
• Purpose: to assess the tool for inclusion in the directory, and to contact you if we have a question about your submission.
• Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in curating and maintaining the directory, and in replying to people who contact us. We consider this proportionate because you choose to initiate contact, the data is minimal, and you can ask us to delete it at any time.
• Is it required? No — only if you want to submit a tool. The email field within the form is optional even then.

If you contact us by email

• Data: your email address, your message, and anything else you choose to include.
• Purpose: to read and answer your enquiry.
• Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in responding to people who contact us, or performance of a contract (Article 6(1)(b)) where your message concerns an agreement between us.
• Retention: correspondence is kept while your enquiry is open and for a reasonable period afterwards for reference, then deleted.

Server logs

• Data: IP address, browser and device type, pages requested, referring page, timestamps. This is generated automatically by our hosting infrastructure.
• Purpose: security, abuse prevention, and diagnosing technical faults.
• Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in keeping the site secure and functioning. We do not use these logs to profile or identify individual visitors.

Analytics — Google Analytics 4

We use Google Analytics 4 to understand aggregate traffic — which pages get read, roughly how visitors arrive, broad device and country-level trends. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which handles this processing for EEA/UK/Swiss users on Google’s behalf.

• Data: pages viewed, approximate location (city/country level, derived momentarily from IP — Google Analytics 4 does not log or store your full IP address in reports by design), device and browser type, how you arrived at the site, and how long you spend. This is tied to a randomly generated identifier stored in your browser, not to your name or email.
• What we have deliberately left off: we have not enabled Google Signals or any ads-personalisation feature. This is analytics only — your Analytics activity is not linked to any Google advertising identifier, and is not used to serve you ads anywhere.
• Legal basis: your consent (Article 6(1)(a) GDPR and, for the underlying cookies, § equivalent Swedish implementation of the ePrivacy Directive). We ask before anything loads — see “How consent works” below.
• Retention: Google retains event-level data for 14 months on a rolling basis, after which it is automatically deleted, per Google’s default Analytics retention setting.
• International transfer: personal data processed by Analytics may be transferred to and processed in the United States. This is safeguarded under the European Commission’s Standard Contractual Clauses, which Google incorporates into its data processing terms.
• Google’s own policy: policies.google.com/privacy.

How consent works

No part of Google Analytics loads for you until you actively click Accept on the banner shown on your first visit. This isn’t just a signal we send to Google asking it to behave — the script itself is not requested from Google’s servers at all unless you accept. If you click Decline, nothing loads, and we remember that choice in your browser (via localStorage, not a tracking cookie) so you aren’t asked again.

You can change your mind at any time using the “Cookie preferences” link in the footer of every page. Choosing to decline after previously accepting stops future data collection and clears the Analytics cookies already set in that browser.

3. Cookies and similar technologies

We do not set any advertising or cross-site tracking cookies. If you accept analytics on the consent banner, Google Analytics sets the following cookies in your browser, on our domain:

Cookie	Purpose	Duration
_ga	Distinguishes visitors with a randomly generated ID	13 months
_ga_<container-id>	Persists session state for Analytics	13 months

Your browser may also hold strictly necessary technical cookies used by our website software (WordPress) to keep the site functioning — for example to maintain a session if you log in as an editor. Under the ePrivacy Directive these are exempt from the consent requirement because the site cannot function without them, and they are not used to track you.

We do not set any cookie to remember your consent choice — that’s stored locally in your browser (localStorage) instead, which never leaves your device and isn’t accessible to us or anyone else.

Tool logos loaded from a third party

Each tool listed in the directory displays that company’s site icon. To avoid storing hundreds of logo files ourselves, these icons are requested from DuckDuckGo’s public icon service (icons.duckduckgo.com) as your browser renders the page.

This means your IP address and browser user-agent are visible to DuckDuckGo when a page containing tool cards loads, in the same way they would be for any externally hosted image. We chose this service specifically because DuckDuckGo does not build advertising profiles from these requests; their handling is governed by the DuckDuckGo privacy policy. No cookie is set by this request, and we receive nothing back about you from it.

Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in presenting a usable, recognisable directory without hosting and maintaining several hundred third-party trademarks ourselves.

4. Affiliate links and how we make money

Some links from this directory to a tool’s own website are affiliate links. If you follow one and subsequently subscribe or purchase, we may receive a commission from that company. This costs you nothing extra.

In line with the US Federal Trade Commission’s Endorsement Guides (16 CFR Part 255), we disclose this material connection clearly and close to the links themselves, not only on this page. Affiliate relationships have no bearing on whether a tool is included in the directory, how it is described, or where it ranks — every listing is written with its drawbacks as well as its strengths, and no company can pay to be listed. Where a placement is paid, it is labelled “Partner” and kept visually separate from editorial listings.

When you click an outbound link you leave our site. The destination operates under its own privacy policy and may set its own cookies. We have no control over, and accept no responsibility for, how third-party sites process your data — we would encourage reading their policy.

How affiliate tracking works

Affiliate programmes are administered by the tool vendor or by an affiliate network acting for them. So that a sale can be credited to us, these networks typically set a cookie or comparable identifier in your browser when you follow one of our links, recording that you arrived from this site. Any such cookie is set by that network, on their domain, after you leave our site — we neither set it nor read it, and we receive only aggregate commission reporting, never your identity.

Where an affiliate link would place such an identifier on a visitor in the EEA or UK, the relevant consent obligation sits with the network under whose domain it is set. If we ever introduce affiliate tracking that runs on our own pages rather than after the click-through, we will gate it behind consent and say so here first.

5. Who we share data with

We do not sell your personal data, and we do not disclose it for anyone else’s marketing. We share it only with the service providers needed to operate the site, each acting as a processor on our instructions and bound by a data processing agreement under Article 28 GDPR.

Hosting — HOSTINGER, UAB

This website is hosted by HOSTINGER, UAB, a company organised under the laws of Lithuania (company code 302710386), registered at Švitrigailos str. 34, LT-03230 Vilnius, Lithuania. Hostinger stores the website, its database and its media, and generates the server logs described in section 2 — including your IP address.

• Legal basis: our legitimate interests (Article 6(1)(f) GDPR) in providing a reliable, secure website.
• Data processing agreement: Hostinger’s terms incorporate a data processing addendum governing their handling of personal data on our behalf.
• Their policy: Hostinger Privacy Policy. Their data protection contact is gdpr@hostinger.com.

Email delivery

We do not yet use a third-party email service to send the newsletter. Before we begin, we will name the provider here, confirm a data processing agreement is in place, and describe any transfer safeguards — so you will always be able to see who handles your address before they receive it.

Analytics — Google Ireland Limited

Google Analytics 4, as described in section 2, and only after you consent. Google acts as our processor under its own data processing terms; the international transfer safeguard is the Standard Contractual Clauses referenced above.

Separately, and as described in section 3, your browser makes a direct request to DuckDuckGo’s icon service to fetch tool logos. DuckDuckGo receives your IP address as a consequence of that request; it is not something we send them, and we share no other data with them.

We may also disclose data where we are legally obliged to — for example in response to a valid legal request — or to establish or defend legal claims.

6. International data transfers

Some of the service providers described above may store or process data outside your country, including in the United States. Where personal data of individuals in the EEA or UK is transferred outside those areas, we rely on an appropriate safeguard under Chapter V GDPR — normally the European Commission’s Standard Contractual Clauses, or the provider’s certification under the EU–US Data Privacy Framework where applicable.

You may request a copy of the relevant safeguard by emailing hello@thedesigntools.site.

7. How long we keep data

• Newsletter subscribers: until you unsubscribe or ask for deletion, after which your address is removed from the mailing list promptly.
• Unsubscribe (suppression) records: when you unsubscribe, your address may be kept on a minimal suppression list for the sole purpose of making sure you are not accidentally re-added and contacted again. This is in your interest as much as ours, and rests on our legitimate interests (Article 6(1)(f) GDPR) in honouring your opt-out. It is never used for any other purpose, and you can ask for it to be erased entirely — accepting that we then lose the ability to recognise the opt-out.
• Tool submissions: retained while under review and for a reasonable period afterwards to avoid re-reviewing the same submission, then deleted. In practice this means no longer than 24 months.
• Server logs: retained on a short rolling basis by our hosting provider, typically measured in weeks, then overwritten.

8. Your rights if the GDPR applies to you (EEA and UK)

You have the right to:

• Access — obtain confirmation of whether we process your data, and a copy of it.
• Rectification — have inaccurate data corrected.
• Erasure — have your data deleted (“right to be forgotten”).
• Restriction — ask us to limit how we use your data while a concern is resolved.
• Data portability — receive data you gave us in a structured, machine-readable format, or have it sent to another controller.
• Object — object to processing based on legitimate interests, including at any time and for any reason where the processing is for direct marketing.
• Withdraw consent — at any time, where we rely on consent.

To exercise any of these, email hello@thedesigntools.site. We will respond within one month, as required by Article 12(3) GDPR. We do not charge for this.

Right to complain: if you believe we have handled your data improperly you may lodge a complaint with a data protection supervisory authority — in particular the authority in the EU or UK country where you live, where you work, or where the issue arose. A list of EEA authorities is published by the European Data Protection Board, and UK residents can contact the Information Commissioner’s Office (ICO). You are not required to raise it with us first, though we would welcome the chance to put things right.

9. Your rights if you are in the United States

Residents of California and of other states with comprehensive privacy laws — including Colorado, Connecticut, Virginia, Texas, Oregon, Delaware, Montana, New Jersey, Minnesota, Maryland, New Hampshire, Nebraska and others — have rights over their personal information. We extend the rights below to all US visitors regardless of state, rather than tracking which law applies to whom.

Categories of personal information we collect

Using the categories defined in the CCPA, in the past 12 months we have collected:

• Identifiers — an email address, if you provided one; IP address via server logs.
• Internet or network activity — pages requested, browser/device type, referring page, via server logs.

We collect these directly from you (forms) and automatically from your device (server logs). We do not buy personal information from data brokers, and we do not collect sensitive personal information, biometric data, precise geolocation, or information about your employment, education or finances.

Sale and sharing

We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined under the CCPA/CPRA. We have not done so in the preceding 12 months. Because of this, we are not required to publish a “Do Not Sell or Share My Personal Information” link — if that ever changes, we will add one and update this policy first.

Your rights

• Right to know what personal information we have collected, the sources, the purposes, and who it was disclosed to.
• Right to delete personal information we hold about you.
• Right to correct inaccurate personal information.
• Right to opt out of sale or sharing — nothing to opt out of at present, as described above.
• Right to limit use of sensitive personal information — we do not collect any.
• Right to non-discrimination — we will never deny you service, change the site’s quality, or charge you differently for exercising any privacy right.

To make a request, email hello@thedesigntools.site. We will verify your request by replying to the email address concerned, and respond within 45 days (extendable once by a further 45 days where reasonably necessary, in which case we will tell you). An authorised agent may submit a request on your behalf with written proof of authorisation.

Global Privacy Control

We honour opt-out preference signals such as Global Privacy Control (GPC) transmitted by your browser. As we do not currently sell or share personal information, such a signal has nothing to act upon here — but it will be respected automatically if that ever changes.

10. Automated decision-making

We do not carry out automated decision-making that produces legal or similarly significant effects concerning you, and we do not build behavioural profiles of visitors, within the meaning of Article 22 GDPR.

11. Children

This site is aimed at working design professionals and is not directed at children. We do not knowingly collect personal data from anyone under 16 (or under 13 in the United States). If you believe a child has given us personal data, contact us and we will delete it.

12. Security

We apply reasonable technical and organisational measures appropriate to the limited data we hold — including encrypted connections (HTTPS) across the whole site, access controls on the administrative interface, and keeping the underlying software updated. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

13. Changes to this policy

If we make a material change — for example enabling analytics, naming a new processor, or beginning to use data for a new purpose — we will update this page and revise the “last updated” date above before the change takes effect. Where the change requires your consent, we will ask for it rather than assume it.

14. Contact

For any question, request or complaint about this policy or your personal data:
hello@thedesigntools.site