Privacy Policy

• When you request a quote: your name, email address, the brief you write, and the configuration you selected.
• During a project: messages, revision notes, and any files you upload as reference or concept material.
• Automatically: a salted, one-way hash of your IP address, used only to rate-limit the quote form against abuse.

We never store your raw IP address. The hash is one-way — it can check whether two submissions came from the same place, and nothing else.

• No advertising or marketing trackers, and no pixels of any kind.
• No third-party analytics. We don't run Google Analytics or an equivalent.
• No tracking in our emails — no open tracking, no click tracking, no remote images.
• No payment card details. Payment is handled by invoice; card data never touches this site.
• No profiling and no automated decisions with legal or similarly significant effects.

One cookie exists on this site: a session cookie set when a member of our team signs in to the internal operations area. It is never set for visitors or customers.

Because we set no analytics or advertising cookies, there is no consent banner to click through.

Reference images, concept art, and video you send are stored in a private bucket. They are not publicly accessible: every view is authorised by our servers first, and the links our pages generate expire within minutes.

We process your information to perform the contract you asked for (quoting and building your commission), and — for the rate-limit hash and our internal records — because we have a legitimate interest in keeping the service working and defensible.

We use a small number of service providers, each holding only what their function requires:

• Vercel — hosting and delivery of this site.
• Supabase — the database holding quotes, projects, and messages.
• Cloudflare R2 — storage for uploads, proofs, and delivered files.
• Resend — sending transactional email.
• Google Workspace — our own email inboxes.

These providers are based in the United States, so your information is processed there. We do not sell your information, share it for advertising, or hand it to anyone outside this list — except where the law requires it.

• Quote requests that never become projects: up to 12 months, then deleted.
• Project records — scope, approvals, and the event history: seven years, because they are the record of what was agreed and paid for.
• Uploaded reference material: for the life of the project, then on request at any time.
• Delivered asset packs: at least 90 days after delivery.

Wherever you live, you can ask us to show you what we hold, correct it, delete it, or send you a copy. If you are in the EU or UK you also have the right to object to processing, restrict it, and complain to your data protection authority. If you are in California, you have the right to know and delete — and note that we do not sell or share personal information, so there is nothing to opt out of.

Email us and we'll action it within 30 days. We may keep the minimum needed for tax and legal records even after a deletion request, and we'll tell you exactly what that is.

Traffic is encrypted in transit. Uploaded files sit in a private bucket behind authorisation checks. Project pages are reached through an unguessable private link — treat that link like a password, and tell us if it gets out so we can replace it.

This service is for adults. We don't knowingly collect information from anyone under 18; if we learn we have, we delete it.

If this policy changes materially we will say so here and update the date at the top. Questions, requests, or complaints: email us.