1. Who this policy covers
Indiana Studio operates websites and online services from Indiana, United States. This policy applies to Indiana Studio-operated services and also describes the Indiana Analytics technology that customers may install on their own websites.
When a customer installs Indiana Analytics on a website it controls, that customer determines why the website collects visitor data. Depending on the context and applicable law, Indiana Studio may process that data as a service provider or processor on the customer's behalf.
2. Information we may process
- Account information: name, username, email address, authentication status and account preferences.
- Orders and website projects: purchased product, project name, order status and related account records.
- Payment-related information: payment status and transaction references. Payment-card details may be handled directly by payment providers such as Stripe rather than stored by Indiana Studio.
- Support communications: information a person chooses to provide when contacting support.
- Technical information: browser, operating system, device type, screen dimensions, language, page path, referrer and similar diagnostic information when the relevant service is enabled.
- Analytics and behavior information: page views, sessions, click locations, scroll depth, form interaction state, performance measurements and error events when Analytics consent has been granted where required.
Indiana Analytics is designed not to collect the contents typed into form fields. Website owners should not modify the tracker to capture passwords, payment details, health data or other sensitive form contents.
3. Why information is used
Information may be used to provide and secure accounts; fulfill purchases and downloads; operate websites; respond to support requests; prevent abuse; diagnose errors; measure performance; understand website usage; maintain records required for business or legal purposes; and improve Indiana Studio services.
Where a jurisdiction requires a legal basis for processing, the basis may include performance of a contract, legitimate interests, compliance with legal obligations, or consent, depending on the purpose and data involved.
4. Cookies and similar technologies
Indiana Studio distinguishes between technologies that are necessary to deliver a requested service and optional technologies used for preferences, analytics or marketing. Optional categories are designed to remain off until a visitor makes a choice when prior consent is required.
| Technology | Purpose | Category | Typical duration |
|---|---|---|---|
indiana_studio_session | Authentication, CSRF protection and authenticated session state. | Necessary | Browser session |
indiana_studio_remember | Optional "remember me" login requested by the account user. | Necessary / requested authentication | Configured period, typically up to 30 days |
indiana_privacy_<site> local storage | Stores the visitor's consent choices so the banner does not repeatedly ask. | Necessary | Until cleared or consent version changes |
is_consent_<site> local storage | Communicates whether Indiana Analytics is allowed to start. | Necessary consent state | Until cleared or changed |
| Indiana Analytics visitor/session identifiers | Measures sessions and usage after Analytics permission is granted. | Analytics | Visitor identifier persists locally; session identifier is session-scoped/timeout based |
Third-party services may set additional cookies or identifiers when configured by a website owner. Those services must be listed in the website's own cookie inventory and should not be loaded before the required permission exists.
Browser and CDN caching: ordinary caching stores copies of website resources to improve delivery and is not treated by this consent manager as an advertising or analytics cookie. Sensitive authenticated responses should use appropriate cache-control headers so private account information is not stored in shared caches.
5. Your cookie choices
The Indiana Studio consent manager provides three primary choices: Accept all, Reject optional, and Manage preferences. Necessary technologies stay active because they support functions such as security, authentication, checkout, or remembering the privacy choice itself.
Visitors can reopen the privacy choices control to change their decision. When Analytics is revoked, Indiana Analytics stops sending analytics events and removes its locally stored visitor and session identifiers. If a third-party script was already loaded before permission was withdrawn, a page reload may be required to fully stop that script.
When a supported browser sends a Global Privacy Control signal, Indiana Studio's consent manager keeps the marketing / sale-sharing category disabled.
6. Analytics details
When enabled by the website owner and allowed by the visitor, Indiana Analytics may process sessions, page views, acquisition source, device/browser information, click coordinates and element selectors, scroll depth, page duration, Core Web Vitals, JavaScript errors and failed network-request metadata.
Analytics identifiers are not created by the updated tracker until Analytics permission exists, except when a website owner deliberately uses a controlled test mode or an external consent platform has already established valid permission.
7. Sharing and service providers
Indiana Studio may use hosting, payment, email, security, domain, analytics or other service providers to operate its services. Providers should receive only the information reasonably necessary for their role and are subject to their own contractual and legal obligations.
Indiana Studio does not state that every disclosure is a "sale" or "sharing" under every privacy law. Those terms have specific statutory meanings and depend on the actual data flow and jurisdiction.
8. Data retention
Information is retained only for as long as reasonably necessary for the purpose for which it was collected, to provide the service, resolve disputes, maintain security, comply with law, or enforce agreements. Indiana Analytics provides configurable raw-data retention settings for tracked properties.
Website owners should choose retention periods that match their actual business need and legal obligations rather than keeping identifiable analytics indefinitely.
9. Security
Indiana Studio uses technical and organizational safeguards intended to reduce unauthorized access, alteration, loss or disclosure. No Internet service can guarantee absolute security. Security measures are reviewed and expanded as the platform evolves.
Examples include HTTPS, secure and HttpOnly authentication cookies, CSRF protections, prepared database statements, access controls and restricted storage for protected application data. Additional network and application security controls are implemented separately from cookie consent.
10. Privacy rights
Depending on where a person lives and whether a particular law applies to the business, privacy rights may include access, correction, deletion, portability, restriction or objection, and opt-out rights relating to targeted advertising, sale or sharing of personal information, or certain profiling activities.
Indiana's Consumer Data Protection Act became effective January 1, 2026 and provides rights for covered processing when its applicability thresholds and conditions are met. California law provides additional rights for covered businesses, including recognition of qualifying opt-out preference signals such as Global Privacy Control. Individuals in the EEA or other jurisdictions may have additional rights under applicable data-protection and electronic-privacy rules.
Requests should be submitted through the privacy or support contact identified by the relevant website or Indiana Studio service. Identity verification may be required where permitted or required by law.
11. Children
Indiana Studio services are not intentionally designed to collect personal information from children in circumstances where parental consent would be required. Website owners using Indiana Studio tools remain responsible for evaluating whether their own audience or service creates additional obligations.
12. Changes to this policy
Indiana Studio may update this policy when services, data practices or legal requirements change. The effective date and version appear at the top. When a material change affects optional tracking purposes, the consent-manager version can be changed so visitors are asked to make a new choice.
13. Official privacy resources
For general reference, official resources include the Indiana Attorney General's Consumer Data Bill of Rights, the California Privacy Protection Agency, the European Union online privacy guidance, and the Federal Trade Commission privacy and security guidance.
14. Contact
For privacy questions or requests concerning Indiana Studio, use the current support channel published on indianastudio.net. For a website operated by an Indiana Studio customer, contact that website owner first because the owner determines the purposes of its visitor-data processing.