Denormalized™ is Denormalized OÜ, registered in Estonia under registry code 17499908, at Sepapaja tn 6, 15551 Tallinn, Harju maakond, Estonia. We are the data controller for this website and we are subject to the GDPR. Anything below can be actioned by writing to ding@denormalized.co.

What We Collect

• If you file a case request: your name, email, company, what you need, when you want to begin, your brief, and — if you tell us — how you found us.
• If you subscribe to the newsletter: your email address and the date you gave it.
• If you accept analytics: pages viewed, clicks, referrer, device and browser, and an approximate location worked out from your IP address. All of it is tied to a random ID, not to your name.
• If you accept analytics we also record the session — a replay of your visit, reconstructed as a redrawing of the page, showing where you moved, clicked and scrolled. It is how we find out which parts of the site confuse people. There is no camera, no microphone and no audio: it is our own page, rebuilt from a log of what changed on screen.

What you type into the forms is deliberately excluded from both the analytics and the recording. The case form and the “how’d you find us” field are blanked out in your browser before anything is sent, so the words of your brief never reach our analytics provider at all — they come only to us, by the route described below. Password and email fields are masked the same way. We do not collect special-category data, we do not buy data about you, and we do not sell or share any of it for advertising.

Why, And On What Legal Basis

• Case requests — to reply to you and to take steps before a possible contract. Article 6(1)(b), and our legitimate interest in answering enquiries, Article 6(1)(f).
• Newsletter — your consent, Article 6(1)(a). Withdraw it at any time and we delete the address.
• Analytics — your consent, Article 6(1)(a), and only once you have given it.

Who Else Touches It

• Vercel — hosts and serves this site.
• PostHog — our analytics, on their EU cloud.
• Notion — where case requests and newsletter signups are stored. Notion is in the US; the transfer runs on the European Commission’s Standard Contractual Clauses.
• Resend — delivers the notification email when you file a case request.
• Google Workspace — our mailbox, so anything you email us lives there too.

They process this data on our instructions and for nothing else.

How Long We Keep It

• Case requests — 24 months after we last spoke, then deleted. If we end up working together, the records that belong to that engagement are kept for as long as Estonian accounting and tax law requires.
• Newsletter — until you unsubscribe, then deleted.
• Analytics and session recordings — held in our PostHog account under its standard retention and deleted when that expires. We keep no separate copy of either.

Your Rights

• Ask for a copy of what we hold on you.
• Have it corrected, or deleted.
• Restrict or object to what we do with it.
• Ask for it in a portable form.
• Withdraw consent — for the newsletter, or for analytics — without it costing you anything else.

Write to ding@denormalized.co and we will answer within a month. If we get it wrong, you can complain to the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon (aki.ee).

Cookies

Before you make a choice, we store nothing on your device — no cookies, no local storage. Analytics runs in memory only and is discarded when you close the tab. If you decline, we stop entirely. If you accept, these are set, and nothing else:

• fs-cc — remembers the choice you just made. 180 days. This one is set whether you accept or decline, because otherwise we would have to keep asking.
• ph_…_posthog (cookie) — a random visitor and session ID. 365 days.
• ph_…_posthog (local storage) — the same ID, plus your analytics settings. Until you clear it.
• __ph_opt_in_out_… (local storage) — records that you opted in. Until you clear it.
• ph_…_posthog (session storage) — this visit only. Cleared when you close the tab.

We use no advertising or marketing cookies. Session recording runs only after you accept, never before, and stops if you decline. If your browser sends Do Not Track or Global Privacy Control, we skip analytics and recording altogether and take that as your answer.

Changes

If any of this changes, we update it here and move the date at the top.