Privacy Policy

Last updated: June 25, 2026

1. Introduction and Who We Are

CSS Crème (csscreme.com) is a curated web design gallery and educational resource. The site has been online in some form since 2007 and was relaunched in 2026. This Privacy Policy explains what personal information we collect when you visit or interact with the site, why we collect it, how we use it, who we share it with, and the rights you have over it. The data controller responsible for your personal information is Combo Ventures, LLC, which operates CSS Crème from the United States (Florida). If you have any questions, you can contact us through our contact form. We describe only the data practices that we actually have. We do not run advertising, we use only a privacy-friendly, cookieless analytics service (Plausible) that does not collect personal information, we do not sell or share personal information, and we do not require you to create an account.

2. The Personal Information We Collect and How We Collect It

We only collect or process personal information in the limited situations described below.

2.1 Submission Form

If you choose to suggest a site to be featured, you may provide the name of the site, its URL, an optional email address, and a free-text description. Providing your email is optional and is not required to use the site or to submit a suggestion: if you provide it, we can reply to you; if you leave it blank, you can still submit. When you submit, the information is transmitted to and processed by Formspree, a third-party form provider, which forwards it to us by email. We use it only to evaluate your suggestion and, where you gave an email, to respond.

2.2 Site Indexer Tool

When you paste a URL into the indexer, that URL is sent to Microlink, a third-party API, which returns a screenshot and public metadata for that address. The URL is processed solely to generate the preview you request.

2.3 Hosting Logs

The site is hosted on Vercel, which automatically processes standard server and request logs (such as IP address, user agent, requested URL, and timestamps) for security, reliability, and abuse prevention.

2.4 Fonts

The site loads fonts from Google Fonts. Google may receive your IP address when your browser requests them.

2.5 Analytics (Plausible)

We use Plausible Analytics, a privacy-focused website analytics service, to understand overall, aggregate traffic to the site, for example which pages are popular and general referrer, device, and country information. Plausible does not use cookies, does not collect or store personal information, and does not store full IP addresses or any identifier that would let us recognize you on a return visit. It does not track or follow you across other websites or devices, and it does not build a profile of you. All metrics are aggregated and anonymous. Plausible is owned and hosted in the European Union.

2.6 Favorites and Saved Items

Favorites and Saved items are stored only in your browser using localStorage. This information never leaves your device, is not transmitted to CSS Crème, and we never receive or store it.

3. How and Why We Use Information

We use the limited information described above only to review and decide on site suggestions; to respond to you where you provided an email; to generate the preview you request in the indexer; to understand aggregate, anonymous traffic so that we can improve the site; to keep the site secure, reliable, and available and to prevent abuse using server and request logs; and to display the site correctly, including loading fonts. We do not use your information for advertising or to build a profile of you. Our analytics is privacy-friendly and aggregate only, and does not identify you. We practice data minimization: we collect only what is necessary for these purposes, and we do not ask for more information than we need.

4. Legal Bases for Processing

If you are in the EEA or the UK, the legal bases we rely on are:

You may object to processing based on legitimate interests as described in Section 11. Providing a suggestion or an email address is voluntary. It is not a statutory or contractual requirement, and you are not obliged to provide it; if you do not, the only consequence is that we cannot evaluate or respond to a suggestion.

5. Cookies and Local Storage

We do not use first-party tracking cookies, and our analytics service (Plausible) is cookieless and sets no cookies. We use localStorage to remember your Favorites and Saved items; that information stays in your browser and is never sent to us. Third parties whose services we rely on may set their own cookies or use similar technologies when your browser communicates with them; their use is governed by their own policies.

6. Third-Party Processors and Sub-Processors

We rely on a small number of providers, each receiving only what it needs:

Please review their own privacy policies for details about how they handle information.

7. How We Share Information

We do not sell or rent your personal information. We do not share it for cross-context behavioral advertising. The only sharing is the limited, functional sharing with the processors described in Section 6. We may also disclose information if legally required, for example to comply with a valid legal request, to enforce our Terms of Use, or to protect the rights, safety, or property of CSS Crème, our visitors, or the public.

8. Data Retention

We keep personal information only as long as necessary for the purposes described in this policy. We determine retention based on whether the purpose has been fulfilled (for example, once a suggestion has been evaluated and any correspondence is complete), whether we are subject to a legal obligation to retain it, and whether retention is needed to establish, exercise, or defend legal claims. Submission information is retained while needed to evaluate the suggestion and correspond with you, then may be deleted, subject to any retention applied on Formspree's side under its own policies. URLs pasted into the indexer are processed to generate a preview and are not retained by us as a profile of your activity. Aggregate, anonymous analytics do not identify you and are not personal information. Server and request logs are retained by our hosting provider for a limited period under its own policies. Favorites and Saved items remain in your browser until you clear them; we never hold them.

9. Security

We take reasonable measures to protect the limited personal information involved in running the site, and we rely on reputable providers that maintain their own security practices. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. International Data Transfers

We operate from the United States, and our providers may process information in the United States or other countries. If you are in the EEA, the UK, or another region with data protection laws, your information may be transferred to and processed in the United States or elsewhere, where laws may differ from those in your jurisdiction. Where such transfers occur and a safeguard is required, we and our providers rely on appropriate safeguards, which may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism.

11. Your Privacy Rights

Depending on where you live, you may have some or all of the rights described below. To exercise any right, contact us through our contact form. We may need to verify your identity before acting on a request, and we will respond within the timeframes required by applicable law. We will not discriminate against you for exercising your rights.

11.1 EEA and UK Rights (GDPR)

If you are in the EEA or the UK, you have the right to: access your personal information; request rectification of inaccurate information; request erasure; restrict processing; object to processing, including processing based on legitimate interests; data portability; and withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority, for example your national or regional data protection authority in the EEA, or the Information Commissioner's Office (ICO) in the United Kingdom.

11.2 California Rights (CCPA and CPRA)

If you are a California resident, you have the right to: know and access the categories and specific pieces of personal information we have collected about you; delete personal information we have collected from you, subject to legal exceptions; correct inaccurate personal information; opt out of the sale or sharing of personal information; and not receive discriminatory treatment for exercising your rights. We do not sell your personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of, but you retain the right. You may submit a request yourself or through an authorized agent acting on your behalf; if you use an authorized agent, we may require proof of the agent's authorization and may still verify your identity directly. The categories of personal information we collect, our sources, our purposes, and the parties to whom we disclose information are described in Section 12.

12. California Categories of Personal Information

This section provides the disclosures required by the CCPA and CPRA about the categories of personal information we handle.

12.1 Categories We Collect, Sources, and Purposes

12.2 Sensitive Personal Information

We do not collect or process sensitive personal information as defined by the CPRA. Because we do not use or disclose sensitive personal information for purposes that would trigger it, the right to limit the use of sensitive personal information does not apply.

12.3 Sale, Sharing, and Disclosure

In the preceding 12 months, we have not sold and have not shared (for cross-context behavioral advertising) any personal information, and we do not do so now. In the preceding 12 months, we may have disclosed the categories above to our service providers for the business purposes described in this policy. The categories of third parties to whom we may disclose information for a business purpose are: our form provider (Formspree), our preview API provider (Microlink), our hosting provider (Vercel), our analytics provider (Plausible), and our font provider (Google Fonts), each as described in Section 6.

13. Children's Privacy

The site is not directed to children. We do not knowingly collect personal information from children under 13, or under 16 in the EEA. If you believe a child has provided us with personal information, contact us through our contact form and we will take steps to delete it.

14. Do Not Track

Because we do not track visitors across third-party websites, and because the only analytics we use (Plausible) is cookieless, aggregate, and does not follow you across sites, our practices already align with the goal of such signals. We do not respond to Do Not Track signals separately, because there is no cross-site tracking to disable.

15. Changes to This Policy

We may update this Privacy Policy from time to time. When we make changes, we will revise the "Last updated" date at the top of this page. We encourage you to review it periodically.

16. How to Contact Us

If you have questions, requests, or concerns about this Privacy Policy, you can contact us through our contact form. The data controller is Combo Ventures, LLC, which operates CSS Crème from the United States (Florida).