Privacy Policy
Short version: we collect as little as we can get away with. We do not sell or share your personal information, we do not run advertising trackers, and nothing optional loads on this site until you say yes. If you want your data gone, email us and it is gone.
Effective 24 August 2026. This policy applies to commercial.offthegridstudios.com. Our merchandise store is hosted by Shopify and is additionally governed by Shopify’s own privacy practices.
1. Who we are
Off the Grid Studios is a film and television production company based in Bend, Oregon, United States. For the purposes of the EU and UK General Data Protection Regulation we are the data controller for information collected through this website.
Privacy contact: ra@offthegridstudios.com · General contact: our contact page.
2. What we collect, why, and for how long
This is our notice at collection. We do not collect anything not listed here.
| Category | Where it comes from | Why we use it | Legal basis (EU/UK) | How long we keep it |
|---|---|---|---|---|
| Email address | You, via a newsletter or film-updates form | To send you the updates you asked for | Consent | Until you unsubscribe, then 12 months in a suppression list so we do not re-add you |
| Name, company, message, subject | You, via a contact or “work with us” form | To answer you and to discuss possible work | Consent / steps prior to a contract | 3 years from last contact |
| Order and delivery details | You, at our Shopify store | To take payment, ship your order, and handle returns | Performance of a contract; legal obligation for tax records | 7 years (US and Oregon tax and accounting rules) |
| Server log data — IP address, browser type, page requested, timestamp | Automatically, by our host | Security, abuse prevention, and keeping the site up | Legitimate interests (site security) | Retained by our hosting provider on their standard schedule, typically 30 days |
| Your privacy choice | Automatically, when you use the consent banner | To remember that you accepted or rejected optional cookies | Legal obligation to record consent | 12 months, stored on your own device |
We do not collect sensitive personal information — no government identifiers, precise geolocation, biometric data, health data, racial or ethnic origin, religious beliefs, union membership, sexual orientation, or the contents of your private communications. We do not collect payment card numbers; those go directly to our payment processor and never touch our servers.
3. Data minimisation
We limit collection to what is reasonably necessary and proportionate to provide the specific thing you asked for. If a form field is not needed to answer you or fulfil your order, it is not on the form. We apply this standard to everyone, not only to residents of states that require it.
4. We do not sell or share your personal information
We have not sold or shared personal information in the preceding twelve months, and we do not intend to. Specifically:
- We do not sell personal information for money or other valuable consideration.
- We do not share personal information for cross-context behavioural or targeted advertising.
- We do not use personal information for profiling that produces legal or similarly significant effects.
- We do not use automated decision-making technology to make decisions about you.
- We do not knowingly sell or share the personal information of anyone under 16.
5. Cookies, embeds, and tracking technologies
We use no advertising pixels, no analytics tags, and no social media trackers. The only storage this site places on your device without asking is the record of your own privacy choice, which is strictly necessary to honour it.
Embedded video is served by YouTube (Google). Embedded video does not load until you click to play it. When you do, YouTube may set cookies and read information from your device under Google’s own privacy policy. Full detail is in our Cookie Policy.
You can change your choice at any time: .
6. Do Not Track and Global Privacy Control
Do Not Track (DNT): there is no common industry standard for responding to browser DNT signals, and this site does not respond to them. This disclosure is made under California Business & Professions Code § 22575(b)(5).
Global Privacy Control (GPC): we do honour GPC. If your browser or extension sends a GPC signal, we treat it as a valid request to opt out of any sale or sharing of personal information and we switch off all optional storage automatically, without showing you a banner. We honour GPC for every visitor worldwide, not only for residents of states that require it. You can enable GPC at globalprivacycontrol.org.
7. Third-party tracking on this site
Under California Business & Professions Code § 22575(b)(6) we must tell you whether third parties may collect personally identifiable information about your online activities over time and across different websites when you use this site.
Answer: only if you choose to play an embedded video. If you click to load a YouTube embed, Google may collect information about you across sites under its own policies. If you never click one, no third party receives information about your activity here beyond the ordinary server logs kept by our hosting provider.
8. Who we share information with
We disclose personal information only to the service providers we need to run the business, each under a written agreement that restricts them to processing on our instructions. We name them so you do not have to guess:
| Provider | What they do | What they receive | Location |
|---|---|---|---|
| Netlify, Inc. | Website hosting and form delivery | Server log data; form submissions in transit | United States |
| Brevo (Sendinblue SAS) | Email newsletter delivery | Email address, name, message, consent record | France (EU) |
| Shopify Inc. | Merchandise store and payments | Order, delivery and payment details | Canada / United States |
| Google LLC (YouTube) | Video hosting | Only what your browser sends if you click to play a video | United States |
We may also disclose information where we are legally required to, or to protect our rights or the safety of others. If the business is ever sold or merged, personal information may transfer as part of that transaction; we would tell you first.
Residents of Oregon may request the specific names of third parties to which we have disclosed their personal data. The table above is that list; email us and we will confirm it in writing.
9. International transfers
We are based in the United States. If you are in the EU, the UK, or Switzerland, information you give us is transferred to and processed in the United States. Where that happens we rely on the European Commission’s Standard Contractual Clauses (2021/914), the UK International Data Transfer Addendum, or the EU–US Data Privacy Framework where the recipient is certified. You may request a copy of the safeguards we rely on by emailing ra@offthegridstudios.com. Our email provider, Brevo, stores newsletter data within the EU.
10. Email and marketing
How people end up on our list. Most of our email contacts either signed up on this site, bought something from our store, or gave us their details at a screening, film festival or industry event. Our press and industry lists also include professional contacts compiled from public trade sources, so we can tell working media and outfitters about new films. We are in the process of moving every list onto confirmed opt-in.
Getting off it. Every marketing email we send carries a working one-click unsubscribe link. One click removes you permanently, and we honour it immediately — in all cases within 10 business days. If you would rather we deleted your record entirely rather than just suppressing it, email ra@offthegridstudios.com and we will.
If you are in the EU or the UK and we do not hold a record of you opting in, tell us and we will remove you rather than ask you to justify it. You have an absolute right to object to direct marketing under GDPR Art. 21(2) and we will not argue about it.
Every marketing email identifies who it is from and carries a valid physical postal address. Contacting us about work is not a subscription and does not add you to any marketing list.
11. Your rights
Everyone, everywhere
Whatever law applies where you live, we will honour these requests from anyone: tell me what you have on me; correct it; delete it; give me a copy; stop emailing me; do not sell or share my information. We do not discriminate against you for exercising any of these rights — no worse service, no different prices.
If you are in the EU, the UK, or Switzerland
Under the GDPR and UK GDPR you have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on our legitimate interests. You have an absolute right to object to direct marketing at any time. Where we rely on consent, you may withdraw it at any time, which does not affect the lawfulness of what we did before you withdrew it. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month.
You also have the right to lodge a complaint with your supervisory authority. In the UK that is the Information Commissioner’s Office (ico.org.uk); in the EU it is the authority in your country of residence.
If you live in a US state with a privacy law
Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia have rights to know, access, correct, delete, obtain a portable copy, and opt out of sale, targeted advertising and profiling. As set out above, we do not sell, share for targeted advertising, or profile — so there is nothing for you to opt out of, but we honour GPC anyway.
We confirm receipt of a request within 10 business days and respond substantively within 45 days, extendable once by a further 45 days where reasonably necessary, in which case we will tell you why. Opt-out requests are actioned within 15 business days.
Appeals. If we refuse a request, you may appeal by replying to our decision with the word “appeal” in the subject line. We will respond in writing within 45 days explaining our reasoning. If we still refuse, we will give you a link to submit a complaint to your state Attorney General.
Your California privacy rights
California Civil Code § 1798.83 (the “Shine the Light” law) permits California residents to request information about personal information disclosed to third parties for those third parties’ own direct marketing purposes. Off the Grid Studios does not disclose personal information to third parties for their direct marketing purposes. To make a request or confirm this in writing, email ra@offthegridstudios.com with “California Shine the Light” in the subject line, or write to us at the postal address on our contact page. We respond within 30 days.
How to make a request
Email ra@offthegridstudios.com from the address you gave us, or use our contact page. We only ask for enough information to confirm the request is really yours. An authorised agent may act for you with written permission, which we may verify with you directly.
12. Children
This site is not directed to children under 13 and we do not knowingly collect personal information from them. We do not knowingly sell or share the personal information of anyone under 16. If you believe a child has given us information, email us and we will delete it.
13. Security
The site is served over HTTPS, form submissions are encrypted in transit, and API credentials are held as server-side environment variables and never exposed to the browser. No system is perfectly secure, but we do not hold much: no card numbers, no passwords, no sensitive categories of data.
14. Changes to this policy
If we change this policy we will update the effective date at the top and post the revised policy at this URL. If the change is material — for example, if we ever started collecting a new category of information or sharing it with someone new — we will say so prominently on the site, and we will email anyone on our list before the change takes effect. Your continued use of the site after a change means you accept the updated policy.
15. Contact us
Privacy questions, requests, or complaints: ra@offthegridstudios.com. If you would rather write, our postal address is on the contact page. We read everything and we answer.