Last updated: 16 October 2026
Needlerow Digital (“Needlerow”, “we”, “us”) provides subscription-based design services. This page explains what personal information we collect, why, and what you can do about it. It covers this website, our client portal at portal.needlerow.com, and the emails we send you.
We have written this in plain English rather than legal boilerplate. If anything here is unclear, email info@needlerow.com and we will explain it.
The short version
- We use Google Analytics to count visits and see which pages and buttons people use. We do not use advertising pixels, and we do not use analytics data for advertising.
- Google Analytics sets cookies so it can tell a new visit from a returning one. For visitors in the UK, the European Economic Area and Switzerland, those cookies are switched off. Apart from Google Analytics, the site makes no requests to third-party servers — even the fonts are served from our own domain.
- We receive browsing and device information through Analytics and server logs. We also receive information you provide when you contact us, subscribe to a plan, or use the client portal.
- We do not sell your personal information or share it for advertising. Service providers process information as described below.
Browsing this website
You can read needlerow.com without creating an account or submitting a form. We use Google Analytics, a service from Google, to understand how the site is used: how many people visit, which pages they read, how they found the site, roughly where they are (country and city), what kind of device and browser they use, and which buttons they click, such as the plan checkout and email links. We use these reports to improve the website. Our website tracking does not send the contents of your emails, project briefs or payment details to Analytics, and we do not use Analytics for advertising. Checkout and email events record a click on a link; they do not confirm a completed purchase or a sent email.
Google Analytics is set up with its advertising features and Google signals turned off. Google handles this information under its own terms, described in Google’s privacy policy and on its page about how Google uses information from sites that use its services. You can opt out of Google Analytics on every website with Google’s opt-out browser add-on.
Our web server keeps standard access logs, which record your IP address, the page requested, the time, and your browser’s user-agent string. These exist so we can investigate errors and abuse. They are not used to build a profile of you, are not linked to any other information, and are not shared with anyone. They are kept for a short period and then deleted.
Cookies
Browsing this website sets only the Google Analytics cookies, named _ga and _ga_PLQ1CT4JK9. They hold a random ID so Analytics can recognise a returning browser, and they last up to two years. You can block or delete them in your browser settings or with Google’s opt-out add-on, and the site works exactly the same without them.
For visitors in the UK, the European Economic Area and Switzerland, our tag configuration tells Google not to read or write analytics cookies. Google can still receive measurements without cookies, including page and event information, a timestamp, referrer and browser information. Cookie-free measurement does not mean that no information is sent to Google. The website currently has no on-site analytics consent control. You can use the opt-out add-on linked above or browser controls to limit tracking.
Two other kinds of cookie only appear if you take an action:
- The client portal. Signing in at portal.needlerow.com stores a session token in your browser so you stay signed in. This is strictly necessary — without it, the portal cannot know who you are. It is not used for tracking or advertising.
- Stripe checkout. If you click Subscribe, you are taken to a payment page hosted by Stripe, which sets its own cookies on its own domain, including some used to detect fraud. Those cookies are governed by Stripe’s privacy policy, not this one.
Administrators signing in to manage the website receive WordPress login cookies. That applies to us, not to you.
What we collect, and why
If you email us
We receive your email address, your name if you give it, and whatever you write. We use it to reply and to keep a record of the conversation. Our email is hosted by MXroute.
If you subscribe to a plan
Payments are handled entirely by Stripe. Your card details are entered on Stripe’s own pages and never reach our servers — we cannot see your full card number. Stripe passes us your name, email address, billing country, the last four digits of your card, and your subscription and invoice history, so that we can deliver the service, provide support, and meet our tax and accounting obligations.
If you use the client portal
The portal holds your email address, the sign-in links we send you, and the work-related information you and we put there — project briefs, quotes, appointments, files, and messages. We use it to run your subscription and to communicate with you about the work. Signing in uses a one-time link sent to your email address rather than a password, so we never hold a password for you.
Who else processes your information
We keep this list short on purpose. Each of these is a service provider acting on our instructions, except Stripe, which is also independently responsible for its own payment processing, and Google, which handles Google Analytics data under its own terms.
- Stripe — payments, subscriptions and billing.
- Supabase — the database and sign-in system behind the client portal.
- Vercel — hosting for the client portal.
- MXroute — our email.
- Google Analytics — statistics about how this website is used.
- Our web host — the server this website runs on.
We do not sell your personal information or share it for advertising. We disclose information to the providers listed above as needed to operate the service, and when legally required.
Where your information is held
Needlerow operates from the United States, and the providers above process data mainly on servers in the United States. If you are in the United Kingdom or the European Economic Area, this means your information is transferred outside your country. Where that happens, those transfers rely on the safeguards our providers put in place, such as the European Commission’s standard contractual clauses. You can ask us for details.
Our legal grounds for using it (UK and EU)
- To perform our contract with you — delivering the design work, running your subscription, and supporting you through the portal.
- Our legitimate interests — replying to enquiries, keeping server logs to protect the site, and keeping records of the work we have done.
- Legal obligation — keeping invoices and tax records for as long as the law requires.
The Browsing this website and Cookies sections describe our current analytics configuration and the controls available to you. If you have a question or objection about analytics processing, contact us at info@needlerow.com.
How long we keep it
Enquiry emails are kept while there is a live conversation and for a reasonable period afterwards. Client records and project files are kept for the life of your subscription and then for a limited period in case you come back or a question arises. Invoices and payment records are kept for as long as tax law requires. Server logs are deleted after a short period. Our Google Analytics property is configured to retain user and event data for 14 months. The user-data retention period resets when there is new activity. These settings do not control most standard reports based on aggregated data.
Your rights
Wherever you live, you can ask us to show you what we hold about you, correct it, or delete it. Email info@needlerow.com and we will respond within 30 days.
If you are in the United Kingdom or the European Economic Area, you also have the right to restrict or object to how we use your information, to receive a copy in a portable format, and to complain to your data protection regulator — the Information Commissioner’s Office in the UK, or your national authority in the EEA. We would rather you came to us first so we can put it right.
If you are a California resident, you have the right to know what we collect, to have it deleted, to have it corrected, and to opt out of the sale or sharing of personal information. We do not sell or share personal information, so there is nothing to opt out of. We will not treat you differently for exercising any of these rights.
Children
Our services are for businesses. We do not knowingly collect information from children. If you believe a child has given us personal information, email us and we will delete it.
Changes to this policy
If we change how we handle personal information, we will update this page and change the date at the top. If a change is significant and we hold your email address, we will tell you directly rather than expecting you to notice.
Contact
Needlerow Digital
Email: info@needlerow.com
Needlerow Digital is the data controller for the information described on this page.