The short version: we collect what you send us through the contact form, so we can reply, and your email if you sign up for our newsletter, so we can send it. We count visits with Plausible, which uses no cookies and keeps no personal data. We don’t use advertising or tracking cookies, so there is nothing to accept. We never sell your data.
Who we are
Buena (“Buena”, “we”, “us”) is a creative studio for good causes, founded in Portland, Oregon. We are responsible for the personal data described here. Questions or requests: [email protected].
What we collect, and why
When you contact us
The contact form asks for your name, email, organization and a message. We use it only to reply and, if we work together, to prepare a proposal. Legal basis: the steps you asked us to take before a possible contract, and our legitimate interest in answering messages. The form goes to our inbox through our email provider. If you email us directly, the same applies.
When you sign up for the newsletter
The newsletter form in the footer asks only for your email. We first send you a link to confirm it’s really you, and add you to the list only once you click it; until then, we keep nothing. Then we use your address to send the newsletter (new work and the causes behind it, a few emails a year) and to see which emails were delivered and opened, so we can do better. Legal basis: your consent, which you can withdraw at any time through the unsubscribe link in every email, or by writing to us. The list lives with our email provider, Resend.
When you browse
Our host keeps short-lived technical logs (IP address, browser, the page requested, time) to deliver the site and keep it secure. We count visits with Plausible Analytics, an EU-hosted service that sets no cookies and stores no IP addresses or other personal data: it reports totals only (pages viewed, referrers, country, device type), under our legitimate interest in knowing which pages work. We don’t use Google Analytics, ad pixels or any other tool that follows you across sites.
Spam protection
To keep bots out of the newsletter form we use Google reCAPTCHA, which looks at signals such as your IP address, browser and interactions with the page. It loads only once you start typing. It is used only to protect the form, under our legitimate interest in security, and is subject to Google’s Privacy Policy and Terms.
Cookies and similar technologies
Cookies are small files a site stores in your browser. We set none of our own and keep nothing in your browser. The only cookie you may get is a security cookie from Google reCAPTCHA, on the newsletter form, to keep bots out. Plausible sets none at all.
| Group | What | Why | Lasts | When |
|---|---|---|---|---|
| Security | Google reCAPTCHA (_GRECAPTCHA) | Tells people from bots when you send a form. | 6 months | Only on forms that use it |
| Analytics | Plausible Analytics (no cookies) | Counts visits in aggregate, without cookies or personal data. | Nothing is stored in your browser | Always on |
Your choices
- Block or delete cookies in your browser settings. The site works without them, though the newsletter form may need reCAPTCHA to send.
- Leave the newsletter with the unsubscribe link in any issue. It takes effect at once.
- Ask us what we hold about you, or to delete it, at any time (see Your rights).
Who we share it with
We don’t sell personal data, and we don’t share it for anyone else’s advertising. We use service providers who process it for us under contract: our website host (Vercel), our email provider (Resend, which also holds the newsletter list), Plausible (cookieless visit counts), and Google (reCAPTCHA on our forms). Films on case and news pages load from YouTube (privacy-enhanced mode) or Vimeo only when you press play. Our typefaces are served from our own site, so loading a page sends nothing to a font provider. We may disclose data if the law requires it.
Copyright
Everything on buena.org (the words, the photos, the films, the logo and the work shown) is © 2016–2026 Buena or its clients, all rights reserved. Press may reproduce the images in a story about the work, with a credit to Buena. For any other use, ask us first at [email protected].
International transfers
We are based in the United States, and our providers may process data in the US and other countries. Where the law requires it, transfers rely on safeguards such as the European Commission’s Standard Contractual Clauses.
How long we keep it
Messages from the contact form: up to 24 months after our last conversation, unless we start working together. Then we keep what the contract and the law require. Newsletter: until you unsubscribe; an unconfirmed sign-up stores nothing, and its link expires after 7 days. Plausible keeps only aggregate counts, with nothing that identifies you. Cookies: as listed in the table above.
Your rights
Depending on where you live (including the EU and UK under the GDPR, Brazil under the LGPD, and California and other US states), you can ask us to access, correct, delete or port your data, and to restrict or object to how we use it. We don’t “sell” or “share” personal data for targeted ads, so there is nothing to opt out of. Write to [email protected]. We answer within 30 days, we won’t treat you differently for asking, and you can also complain to your local data protection authority (in Brazil, the ANPD).
Security
The site is served only over HTTPS, with a strict Content Security Policy, and form data is checked on our server before it is sent on. No system is perfectly secure, but we collect as little as we can, which is the best protection there is.
Children
This site is for organizations and professionals. It is not directed at children under 16, and we don’t knowingly collect their data.
Changes
If we change how we use data, we’ll update this page and the date at the top. If the change needs your consent, we’ll ask again.