Privacy Policy

Draft of November 2026

1. Who is responsible for what

• Your clients' data: each studio decides whose details go into its studio and why. The studio is the controller of its clients' personal data, and is its processor: we store and handle that data only to run the studio, on the studio's instructions.
• Studio accounts: for the studio owner's and team's own details (name, email, billing), is the controller.
• A data processing agreement between each studio and us is part of the terms. [To be drafted.]

2. What we keep

• Studio owners and teams: name, email, studio name and address, and when the terms were accepted and from which IP address at sign-up.
• Billing: plan and subscription details. Card details are handled by Stripe; we never see or store card numbers.
• Clients (added by a studio): name, email, and what they share in the studio: comments, messages, files and approvals, with the times they signed in.
• Electronic signatures: the signer's name and email, the time, their IP address and browser, and a fingerprint of the exact document signed. This is the record that makes the signature hold up.
• Technical: a sign-in cookie, and short-lived counters by IP address to stop abuse.

3. What we use it for

To run each studio, send the sign-in links and the emails a studio has set up, bill studios for their plan, keep the service secure, and answer support questions. We don't sell personal data, show ads, or use tracking or advertising cookies.

4. Who else handles it (sub-processors)

• Cloudflare: hosting, the database, file storage and the network files stream over.
• Stripe: billing studios for their plan.
• Amazon Web Services (Amazon SES): delivering sign-in links and studio emails. It receives each email's addresses and contents in order to deliver it, and tells us when one bounces or is marked as spam.
• OpenRouter, and the AI model provider it routes to (currently Anthropic, the maker of Claude): our support assistant. When you write to support, your message and the details of your own studio that the assistant looks up to answer you (such as your plan, billing status and storage) are sent to them to write the reply. Our settings only allow providers that do not store or train on these messages. (If we connect to Anthropic directly instead, Anthropic alone does this.)

[For the lawyer's review: the support assistant line above, and the safeguards for sending support messages to these providers.]

[To settle: where data is stored and the safeguards for international transfers.]

5. How long we keep it

• For as long as the studio's account is open, and delivered projects for the time the studio's plan includes.
• A sign-up that is never confirmed is deleted after 24 hours.
• Signature records are kept for as long as the signed contract is.
• [To settle: what is kept, and for how long, after a studio closes its account, including backups.]

6. Your rights

You can ask to see, correct, export or delete your personal data. If you are a studio's client, ask that studio first, since it decides about your data; we help studios answer. Studio owners can ask us directly. [To settle: the rights under GDPR, UK GDPR and US state laws, and how to complain to a regulator.]

7. Security

Your data is protected while it travels and while it is stored. Sign-in works by one-time emails, so there are no passwords to leak. Each studio's data is kept apart from every other studio's.

8. Changes and contact

We'll post changes here and tell studio owners about the ones that matter. [Contact address to be added before launch.]

See also our Terms.