Effective Date: August 27th 2026

1. Introduction

This Privacy Policy provides details about our processing of your personal data, including how and why we use your personal data and how we keep it safe, and explains the rights you have over your personal data. The company responsible for processing your personal data is Steven Volpe Design, Incorporated, a California corporation, doing business as Studio Volpe (“Studio Volpe,” “we,” “us,” and “our”), located at 727 Sansome Street, San Francisco, CA 94111. This Privacy Policy applies to visitors to https://stevenvolpe.com/ (the “Site”) and to prospective and current clients and other persons who engage or communicate with us (“you” and “your” being interpreted accordingly). Please read this Privacy Policy so that you know what we do with your personal data, and see the “Contact Us” section below for how to reach us.

2. Definitions

In this Privacy Policy:
· Personal Data (also referred to as personal information): any information that relates to you from which you can be directly or indirectly identified.
· Process: any activity relating to personal data, including collection, use, sharing, storage, and transmission.

3. How Do We Obtain Your Information?

Most of the personal information we process is provided to us directly by you when you engage with us (for example, when you complete our contact form, email us, or call us to inquire about our interior design services).
When you visit, use, or navigate the Site, we may also process certain information about you automatically. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, referring URLs, approximate location, and information about how and when you use the Site. This information is collected through server logs and is needed to maintain the security and operation of the Site.

4. What Information Do We Collect and Why?

We collect the following limited categories of Personal Data:
· Identity and Contact Information: first name, last name, email address, telephone number, and any other information you choose to include when you contact us through the Site’s contact form, by email, or by phone.
· Communications: the contents of your inquiries, emails, and other communications with us, including feedback.
· Device and Usage Information: as described in Section 3.
We do not collect financial or payment information, health information, or other sensitive personal information through the Site. Our design services are engaged under separate written agreements, which govern any information collected in the course of an engagement.
We use this information for the following legitimate business purposes:
· Responding to your inquiries and communicating with you about our services;
· Providing our design services and managing our relationships with clients;
· Managing, evaluating, and improving our business, our marketing, and the Site (including through consented analytics);
· Ensuring the security of the Site, including protecting our contact form from automated abuse; and
· Complying with applicable law.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.

5. Cookie Policy — Cookies and Similar Technologies

5.1 What cookies are
Cookies are small text files that may be placed on your device when you visit a website. Similar technologies include session storage, local storage, pixels, scripts, and server logs. In this Privacy Policy, we use the term “cookies” to refer to cookies and similar technologies unless the context indicates otherwise.

5.2 Cookies and similar technologies we use
The Site uses limited cookies and similar technologies that are necessary to operate, secure, and provide the Site’s core functionality. The Site does not currently use advertising or retargeting pixels, social-media tracking widgets, chat widgets, session-recording tools, embedded video players, embedded maps, or embedded Instagram/social-media feeds.

Strictly necessary cookies. The Site uses a first-party Ruby on Rails session cookie to support session handling, security, and cross-site-request-forgery protection. The exact cookie name is application-specific and is expected to follow the format _[app_name]_session. This cookie is session-based and is not used for advertising or cross-site tracking.

Content Delivery Infrastructure. We use Amazon CloudFront, an Amazon Web Services (“AWS”) content-delivery network, to deliver Website assets, including images and project photography. CloudFront receives device and network information, including IP address, as necessary to deliver requested content. CloudFront is a service provider supporting Website infrastructure and is not used by us for targeted advertising or cross-context behavioral advertising. CloudFront does not ordinarily set cookies in its default configuration.

Third-Party Links. The Site includes an ordinary hyperlink to our Instagram profile. This link does not embed Instagram content, load Meta resources, or cause Meta to set cookies through the Site. If you select the link, you leave the Site and Instagram’s terms and privacy policy govern its processing of information about you
We do not use cookies to sell or share personal information for cross-context behavioral advertising.

5.3 Your choices
Because the Site currently uses only strictly necessary cookies and similar technologies, there is no on-site cookie preference center at this time. You may manage cookies through your browser settings. Blocking or deleting strictly necessary cookies may affect the availability, security, or functionality of the Site.

5.4 Do Not Track and opt-out preference signals
The Site does not currently use technologies to track visitors across third-party websites over time for targeted advertising. Accordingly, the Site does not respond to browser “Do Not Track” signals beyond the controls available through your browser settings.

6. Third-Party Websites and Social Media

The Site may contain links to third-party websites and services, including our Instagram profile. These links are provided for convenience only. A link to a third-party website does not mean that Studio Volpe controls, endorses, sponsors, or is affiliated with that third party unless expressly stated.
When you select a third-party link, you leave the Site. The third party may collect, use, disclose, and otherwise process information about you in accordance with its own terms and privacy policy. We do not control and are not responsible for the privacy, security, availability, content, or data practices of third-party websites or services. We encourage you to review each third party’s privacy policy before providing personal information or using its services.
Instagram. The Site currently links to Studio Volpe’s Instagram profile through an ordinary hyperlink. The Site does not currently embed Instagram content, load an Instagram or Meta plug-in, or use a Meta tracking pixel. Instagram may collect information after you elect to follow the link and visit its platform..

7. How We Disclose Information

We disclose Personal Data only to: (a) service providers that help us operate the Site and our business — such as our website hosting, form-handling, and email providers, and our Website-hosting, content-delivery, IT, and communications service providers, including AWS/CloudFront — who may process it only on our behalf and for the purposes described in this Privacy Policy; and (b) recipients required by law, subpoena, or court order, or where disclosure is necessary to protect our rights, safety, or property. The categories of service providers we use may change from time to time as we change vendors, but the categories of Personal Data we disclose and the purposes of disclosure will remain as described here unless we update this Privacy Policy.

8. Users Only of Legal Age of Majority

The Site is not intended for children under 18 years of age, and we do not knowingly collect personal information from children under 18. If you are under 18, do not use the Site or provide any information about yourself to us. If we learn we have collected personal data from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us at info@stevenvolpe.com.

9. Your California Privacy Rights (CCPA Notice)

This section applies to visitors, clients, and other individuals who reside in the State of California and is provided pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (the “CCPA”). Any terms defined in the CCPA have the same meaning when used in this section. This section supplements the other disclosures in this Privacy Policy.

9.1 Categories of Personal Information We Collect
We collect, and may have collected in the preceding 12 months, the following categories of personal information, which we do not sell or share:
· Identifiers, such as real name, email address, telephone number, and Internet Protocol (IP) address. Source: directly from you (for example, from the forms you complete and communications you send us) and, for IP addresses, indirectly from your device.
· Internet or other electronic network activity information, such as browsing history on the Site and information regarding your interaction with the Site, collected through server logs and, indirectly from you by observing your actions on the Site.
· Geolocation data, limited to the approximate location inferred from your IP address; we do not collect precise geolocation data.
We do not collect the following categories of personal information: characteristics of protected classifications under California or federal law; commercial information; biometric information; audio, electronic, visual, thermal, olfactory, or similar information; professional or employment-related information; education information; inferences drawn from personal information to create a profile about a consumer; or sensitive personal information.
Personal information does not include publicly available information lawfully made available from government records, deidentified or aggregated consumer information, or information excluded from the CCPA’s scope. We will not collect additional categories of personal information, or use the personal information we collect for materially different, unrelated, or incompatible purposes, without providing you with notice.

9.2 Use, Disclosure, Sale, and Retention
We collect personal information for the business purposes described in Section 4 and disclose it only to the recipients described in Section 7. We do not, and have not in the last 12 months, sold personal information, and we have not shared personal information for cross-context behavioral advertising, and we have no actual knowledge that we sell or share the personal information of consumers under 16 years of age. We retain personal information as described in Section 10.

9.3 Your Rights Under the CCPA
California residents have the rights listed below. These rights are not absolute, and we may be entitled to refuse requests, in whole or in part, where an exception under applicable law applies.
· Right to Know and Access. You have the right to request that we disclose the categories of personal information we have collected about you; the categories of sources of that information; the business purposes for collecting it; the categories of personal information we have disclosed and the categories of recipients; and the specific pieces of personal information we hold about you. You also have the right to receive your personal information in a structured, commonly used format so that it can be transmitted to another entity (“data portability”).
· Right to Delete. In certain circumstances, you have the right to request that we delete personal information we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete, and direct our service providers to delete, your personal information from our records, unless an exception applies.
· Right to Correct. In certain circumstances, you have the right to request correction of inaccurate personal information. Upon verifying a valid correction request, we will use commercially reasonable efforts to correct your personal information as directed, taking into account the nature of the personal information and the purposes of maintaining it.
· Right to Opt Out of Sale or Sharing. You have the right to opt out of the sale of your personal information and of its sharing for cross-context behavioral advertising. Because we do not sell personal information and do not share it for those purposes, there is no sale or sharing to opt out of.
· Right to Limit Use of Sensitive Personal Information. We do not collect sensitive personal information as defined by the CCPA, so this right does not apply to our processing.
· Right to Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not deny you goods or services; charge you different prices or rates (including through discounts, benefits, or penalties); provide you a different level or quality of goods or services; or suggest that you may receive any of the foregoing.

9.4 How to Exercise Your Rights
You may submit a verifiable consumer request by contacting us at info@stevenvolpe.com. Except as provided under applicable law, there is no charge to exercise your rights. To verify your identity, we may ask you to provide your first and last name, email address, and/or telephone number, and to confirm information unique to you (such as the details of a prior inquiry). If we cannot verify your identity with the required degree of certainty, we may only be able to provide category-level information, and we may be unable to fulfill some requests.
You may also use an authorized agent to submit a request on your behalf. We require a valid power of attorney or other documentation signed by you demonstrating the agent’s authority to act, which must be included with the request.

9.5 Response Timing and Format
We will confirm receipt of a request within 10 business days and endeavor to respond substantively within 45 days of receipt. If we require more time (up to 90 days total), we will inform you of the reason and extension period in writing. We will deliver our response by mail or electronically, at your option, and any disclosure will cover the 12-month period preceding receipt of the request. Our response will explain any reasons we cannot comply with a request.
We do not charge a fee to process or respond to a verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that a request warrants a fee, we will tell you why and provide a cost estimate before completing the request; alternatively, as permitted by the CCPA, we may refuse to act on such a request and notify you of the reason. If you wish to appeal a decision, please contact us at info@stevenvolpe.com and clearly denote that it is an appeal.

10. Data Retention and Security

We retain Personal Data for as long as needed for the purposes described above (inquiry correspondence for as long as needed to respond and maintain our business records, and server logs and analytics data for the periods set by our hosting provider and our data-retention settings). We use reasonable administrative and technical safeguards designed to protect Personal Data; however, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

11. Changes to This Privacy Policy

We keep this Privacy Policy under regular review and will post any future changes to this page.

12. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:
Studio Volpe
727 Sansome Street
San Francisco, CA 94111

Phone: 415-772-5550
Email: info@stevenvolpe.com