Privacy

The enquiry form receives the name, company and work email you enter, the scope you pick, the day and time you choose if you book a session, and your message. If you built a scope first, the answers you gave the builder travel with it, because a call that starts from your own numbers is the point of having built it.

If you reached us through a campaign link — one carrying utm_source, utm_medium, utm_campaign, utm_term or utm_content — those labels travel with the brief, so we know which piece of our own marketing you saw. They describe the link, not you: no identifier is created and nothing is recorded about anyone who does not send a brief.

Booking a session creates an event in the studio's Google Calendar with your name and email on it, so that the slot is genuinely held rather than provisionally noted.

Signing in is optional and it is done through Google. We never see your password — Google authenticates you and tells us three things about you: your name, your email address and the URL of your profile picture. We store those, together with the identifier Google uses for your account, so that we can recognise you next time.

Signing in creates a session, which is a random identifier stored in a cookie on your device and in a row in our database. It is what keeps you signed in between pages. It is not readable by JavaScript, it is only sent over HTTPS, and signing out deletes it at both ends.

Everything you make in your desk is kept against that account: the scopes you build and the ranges they were priced at, the sessions in your diary, the quotes we write back, the proposals issued to you and whether they have been opened or approved, the projects that come of them, and your brand profile. You can see all of it, all of the time, because it is your desk — that is what it is for.

A proposal lives at its own address and is opened with a password we send you. The password itself is never stored: the document carries a salted hash of it, and what you type is hashed and compared against that. We could not tell you your own password if you asked.

Opening one sets a second cookie, signed by the server, which says only that this browser has already been let into this document. It expires, and it does nothing anywhere else on the site.

Approving a proposal records the name and email typed into the approval box at the moment of approval, with the date. That is deliberate: an approval is a record of what a person actually wrote when they signed, not of who happened to be logged in.

A brief in progress is kept in your browser's local storage so that closing a tab does not throw away fifteen answers. So is the email address you gave the builder, and one or two small display preferences. None of it is sent anywhere until you send a brief or sign in, and clearing your browser's site data removes all of it.

Your answer to the storage notice is kept in a cookie for a year, so that the notice does not ask you again every time you arrive. If we ever add a category to it, the notice will ask again rather than assume your old answer covers the new question.

That is the whole list. There is no cookie on this site that exists to follow you, because there is nothing on this site that wants to.

Like every site on the internet, the servers that answer your request see the request: your IP address, the page you asked for, your browser's user-agent string and the time. Our host keeps that briefly in its own operational logs. We do not build profiles from it and we do not join it to anything else.

Our host also counts page views for us, with Vercel Web Analytics. It records the page, the country, the type of device and the site that linked here. It sets no cookie, stores nothing in your browser and keeps no identifier that would let a second visit be tied to the first. Pages behind a sign-in or a password, such as your desk and proposals, are not counted at all.

The endpoints that cost something — booking a session, generating a document — hold your IP address in memory for one minute to count how often it has called, so that one script cannot empty the studio's diary. Nothing is written down and the counter forgets you a minute later.

Vercel hosts the site, runs the code that answers your requests and counts page views without cookies. Neon runs the database your account and your work live in. Google authenticates you if you sign in, and holds the calendar a booked session lands in. Resend delivers the email your brief arrives in, and a Telegram bot notifies the studio that one has arrived.

That is the complete list. Each of them sees only the part it needs to do its job, none of them is paid to profile you, and nothing about you is sold or shared with anyone else — ever, and there is no version of this business where that changes.

An enquiry we do not take further is deleted within twelve months. Work that becomes a project is kept for as long as the engagement runs, and afterwards for as long as the law requires records of it — normally six years for anything with an invoice attached.

An account and everything in it is kept until you ask us to delete it, and then it goes, including the scopes, the proposals and the brand profile. Ask and it is done; you do not have to give a reason.

If you are in the EEA or the UK, the GDPR gives you the right to ask what we hold about you, to have it corrected, to have it deleted, to get a copy of it in a portable form, and to object to our using it. Those rights are real and they are not conditional on having been a client.

Write to the address below and we will answer within thirty days. If you think we have handled your data badly, you are entitled to complain to your national data protection authority, and you do not have to come to us first.

Everything you type into the builder stays in your browser until you either send a brief or sign in. Until then there is nothing on our side to look at: an abandoned half-answered scope is not sitting in our database, because it never reached it.

Signed in, it saves as you go — that is what makes a scope started on a laptop finishable on a phone — and it saves against your account and nobody else's.