Privacy Policy
Last updated: 16 August 2026
1. Who we are
Penumbra Works operates as an individual activity registered in the Republic of Lithuania, certificate no. 1547328. - T. Sevcenkos g. 19 - Vilnius - Lithuania
For the purposes of the EU General Data Protection Regulation (GDPR), we are the data controller for the personal data described in this policy. In this policy, "we", "us" and "our" refer to Penumbra Works.
Contact for all privacy matters:
2. Scope
This policy covers personal data we process through penumbraworks.com, including the contact form, the asset store, the portfolio and blog, and any email correspondence with us. It does not cover third-party websites we link to, which have their own policies.
3. What we collect, and why
3.1 Contact and enquiry form
When you submit our contact form, we collect:
- First name and surname
- Email address
- Company or organisation name
- The enquiry category you select
- Your subject line
- The content of your message
Where this is stored. Submissions are delivered by email to info@penumbraworks.com and are also stored in our website's database, hosted by Hostinger within the European Economic Area. Both copies are covered by the retention period in section 6.
We do not record your IP address or browser information when you submit the form.
We use this to respond to your enquiry, assess whether we can take on the work, prepare quotations and proposals, and manage the resulting client relationship.
Spam protection. Our forms are protected by Cloudflare Turnstile. When you submit a form, Turnstile processes your IP address, browser information and interaction signals in order to distinguish human visitors from automated traffic. It does not set cookies and does not track you across websites. Cloudflare's Turnstile privacy policy explains how it handles this data.
3.2 Newsletter and marketing
If you tick the optional subscription box on our contact form, we will use your name and email address to send occasional updates about our products, releases and services.
You can withdraw consent at any time, either by using the unsubscribe link in any message or by emailing info@penumbraworks.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and does not affect our handling of your enquiry or contract.
We do not add enquiry contacts to any mailing list without this separate opt-in.
3.3 Purchases and licences
Payments for products sold through this website are processed by Lemon Squeezy acting as our Merchant of Record. This means Lemon Squeezy is the seller of record for the transaction and processes your payment data as an independent data controller under its own privacy policy. We never receive or store your full payment card details.
Our product pages load a checkout script from Lemon Squeezy. When this loads, your browser contacts Lemon Squeezy's servers directly and they receive your IP address and browser information. This is necessary to offer checkout on those pages.
From Lemon Squeezy we receive, and process as controller, a limited set of order data: your name, email address, billing country, the products purchased, order and licence key identifiers, and order status. We use this to deliver files, validate licences, provide product support, honour refunds, and meet our accounting obligations.
Please review Lemon Squeezy's own privacy policy for how it handles your data as merchant of record.
3.4 File downloads
Product files are hosted on Cloudflare R2 and delivered through a Cloudflare Worker that verifies your licence key before releasing a download. This process handles your licence key and IP address in order to authorise the download and detect abuse of licence keys.
3.5 Hosting, security and analytics
Our website is hosted by Hostinger and served through Cloudflare. Our servers and Cloudflare's network automatically process technical data including IP address, browser and device type, referring page, and request timestamps. This is unavoidable in the operation of any website and is used for delivery, security, abuse prevention and troubleshooting.
We use Cloudflare Web Analytics to understand aggregate site traffic. This tool does not use cookies, does not store anything in your browser, does not fingerprint visitors, and does not track individuals across sites or sessions. Source IP addresses are discarded at the nearest Cloudflare data centre and are not stored in databases or logs.
4. Third-party services and embedded content
Video. Product and portfolio pages may embed video hosted on YouTube. We do not load YouTube until you click play. Until then, only a thumbnail served from our own server is displayed, and no data is sent to Google. When you click play, the video loads from youtube-nocookie.com, and Google receives your IP address and may set cookies.
Fonts. All typefaces are hosted on our own servers. We do not use Google Fonts, and no font request leaves our domain.
Our service providers are:
- Cloudflare, Inc. — CDN, security, Turnstile spam protection, file delivery, and cookieless analytics
- Hostinger International Ltd. — web hosting and email
- Lemon Squeezy, LLC — payments and merchant of record
We also link out to our listings on Fab, Gumroad, the Unity Asset Store and ArtStation, and operate a Discord server as an informal support channel. These are external services. Once you follow a link or join our Discord, this policy no longer applies and the destination service's own terms and privacy policy govern.
5. Cookies
We do not use cookies for analytics, advertising or tracking. Our analytics tool does not use cookies and does not identify individual visitors. Our spam protection does not set cookies.
Third-party content sets cookies only where you have chosen to load it. Specifically, playing an embedded video causes YouTube to set cookies at that point.
Because we set no non-essential cookies, we do not display a cookie consent banner.
6. How long we keep your data
| Data | Retention period |
|---|---|
| Contact form submissions and related correspondence | 2 years from our last substantive contact, in both our email mailbox and our website database |
| Client project records, where a contract is signed | Duration of the engagement, then as required by contract and applicable limitation periods |
| Newsletter subscriber data | Until you withdraw consent or after a prolonged period of inactivity |
| Order, licence and support records | Duration of the licence, plus the retention period required by Lithuanian accounting and tax law |
| Server and security logs | 60 Days |
When a retention period ends, we delete the data or irreversibly anonymise it.
7. Who we share your data with
We do not sell your personal data, and we do not share it for third-party advertising.
We share data only with:
- Service providers acting on our instructions (processors): our hosting provider, email provider, CDN, and file delivery infrastructure.
- Lemon Squeezy, as merchant of record and independent controller for payment processing.
- Professional advisers - our accountant, and legal advisers where necessary.
- Public authorities, where we are legally required to disclose.
Where a project requires us to engage a subcontractor, we do so under written agreement, and we disclose only the minimum information necessary. We do not transfer client data to subcontractors without a contractual basis to do so.
8. International transfers
Our hosting and primary data storage are located within the European Economic Area.
Some of our providers are established in the United States or process data outside the EEA. Where personal data is transferred outside the EEA, we rely on the European Commission's Standard Contractual Clauses, the EU-US Data Privacy Framework where the recipient is certified, or another valid Chapter V GDPR transfer mechanism. You may request further information about the safeguards in place by writing to privacy@penumbraworks.com
9. Security
We apply appropriate technical and organisational measures to protect your data, including TLS encryption in transit, access controls on our hosting and email accounts, multi-factor authentication on administrative accounts, and restriction of access to those who need it. No system is completely secure, and we cannot guarantee absolute security of data transmitted over the internet.
10. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy
- Rectify inaccurate or incomplete data
- Erase your data, where one of the grounds in Article 17 applies
- Restrict processing in the circumstances set out in Article 18
- Data portability - receive data you provided to us in a structured, machine-readable format, where processing is based on consent or contract and carried out by automated means
- Object to processing based on our legitimate interests, on grounds relating to your particular situation
- Withdraw consent at any time, where processing is based on consent
To exercise any of these, email privacy@penumbraworks.com. We will respond within one month, which may be extended by two further months for complex requests, in which case we will tell you within the first month. We may ask you to confirm your identity where we have reasonable doubts about who is making the request.
11. Complaints
If you believe we have handled your personal data unlawfully, we would prefer you contact us first so we can address it. You also have the right to lodge a complaint with the Lithuanian supervisory authority.
You may alternatively complain to the supervisory authority in your EU country of residence or workplace.
12. Automated decision-making
We do not carry out automated decision-making producing legal or similarly significant effects, and we do not profile visitors or customers.
13. Children
Our services are directed at businesses and professionals. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it without exceptions.
14. Changes to this policy
We may update this policy from time to time. Material changes will be reflected in the "last updated" date at the top of this page. Where a change materially affects how we process your data, we will take reasonable steps to notify you.
Support
Have more questions?
Drop us a line.