Privacy Policy

1. What I collect

I try to collect as little as possible. In practice, that means:

• Information you give me through the contact form— your name, email address, the service you’re interested in, an indicative budget, where you heard about me, and the details of your project.
• Information you give me by email — anything you choose to send when you reach out directly, including attachments.
• Technical data from your browser — IP address, browser type, device type, and pages visited. This is logged by my hosting provider (Vercel) as part of normal request handling and security.

I do not run third-party advertising trackers. I do not sell, rent, or trade personal data, ever.

2. Why I use it

• To reply to your enquiry and scope your project.
• To deliver work I’ve been commissioned to do and to invoice for it.
• To keep records required by HMRC and UK accounting law.
• To keep the site secure and to debug technical issues.

My lawful bases under UK GDPR and EU GDPR are consent (when you submit the contact form), performance of a contract (when we’re working together), legal obligation (tax records), and legitimate interest(running and securing the website). For US visitors, processing happens because you’ve asked me to respond, because we’re working together, or to comply with the law.

3. Who I share it with

I use a small number of trusted suppliers to actually run the business. Each one only sees the data they need to do their specific job:

• Vercel — hosts the website and handles request logs.
• Google Workspace (Gmail) — handles email correspondence.
• Stripe — processes any invoice payments. Stripe receives the data needed to take the payment; I never see your full card details.
• HMRC and my accountant — where required by UK tax and accounting law.

Some of these providers store or process data outside your country — including in the United States and the European Union. Where data leaves the UK or EEA, transfers are protected by an adequacy decision (such as the UK–US Data Bridge and the EU–US Data Privacy Framework) or by Standard Contractual Clauses with appropriate supplementary safeguards. I do not sell, rent, share, or otherwise disclose your personal information for cross-context behavioural advertising or any other commercial purpose.

4. Cookies

This site does not set marketing or advertising cookies. It uses only the strictly necessary cookies required for the site to load and function (for example, a session cookie from the host). If that ever changes, I’ll add a cookie banner that asks first.

5. How long I keep it

• Contact form enquiries that don’t turn into a project: up to 12 months, then deleted.
• Client correspondence and project files:for the duration of the project and up to 7 years afterwards, so I can honour any warranty period and meet HMRC’s record-keeping requirements.
• Invoices and payment records: 7 years (HMRC requirement).
• Server logs: typically 30 days, then rotated out.

6. Your rights

Your rights depend on where you live. To exercise any of them, email orizustudio@gmail.com and tell me which country or US state you’re in so I can verify your request. I’ll respond within 30 days (UK/EU) or 45 days (US), and I won’t discriminate against you for exercising any right.

7. How I keep it safe

Data in transit to and from this site is encrypted with HTTPS. Email correspondence is held in a Google Workspace account protected by two-factor authentication. Client files are kept in access-controlled storage. I keep things lean on purpose — fewer copies of your data means fewer places it can go wrong.

8. Complaints

If you’re unhappy with how your data has been handled, please tell me first so I can put it right. You can also complain to the relevant regulator:

• UK — Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.
• EU/EEA— your national data protection authority. You can find yours via the European Data Protection Board: edpb.europa.eu.
• California — the California Privacy Protection Agency (CPPA) at cppa.ca.gov or the California Attorney General at oag.ca.gov/privacy.
• Other US states— your state Attorney General’s office.

9. Changes to this policy

I’ll update this page whenever the way I handle data changes meaningfully. The “Last updated” date at the top will always reflect the latest version.