Privacy notice

This draft explains the information used by the customer account, order, payment and project-workspace system.

1. Data controller

The controller is Campaign Kit Studio, operated by INSERT LEGAL NAME OR ENTITY, at INSERT POSTAL ADDRESS. Privacy enquiries should be sent to campaignkitstudio@outlook.com.

2. Information we collect

We may collect account identity and contact details; organisation and brand-profile information; order, quotation and payment status; campaign briefs; uploaded logos, artwork and photographs; proof responses; project messages; and technical records needed to keep the service secure.

3. Why we use it

We use personal data to create and manage accounts, provide quotations and contracted design services, take and reconcile payments, communicate about projects, keep business and tax records, prevent misuse and improve the service. DOCUMENT THE LAWFUL BASIS USED FOR EACH PURPOSE.

4. Service providers

The planned account system uses Supabase for authentication, database records and private file storage; Stripe for secure checkout and payment records; and Netlify for website hosting and server-side functions. Email and other suppliers may also process limited information for us. Payment-card details are entered into Stripe's checkout rather than stored in the Campaign Kit Studio database.

5. Who can see project files

Customer files, briefs and messages are intended to be visible only to the relevant signed-in customer and authorised Campaign Kit Studio administrators. Temporary signed links may be generated to allow secure downloads. Customers should not share those links while they remain active.

6. Retention

Account and project information is kept only for as long as it is needed for service delivery, legal records, dispute handling and legitimate business administration. INSERT YOUR RETENTION PERIODS FOR DRAFT ORDERS, CUSTOMER ASSETS, COMPLETED ARTWORK, MESSAGES AND ACCOUNT RECORDS.

7. International processing

Some technology providers may process data outside the United Kingdom. REVIEW YOUR CHOSEN PROVIDERS, REGIONS AND TRANSFER SAFEGUARDS BEFORE LAUNCH.

8. Your choices and rights

You may ask about the personal data held about you and request correction, deletion or another applicable data-protection right. Some information may need to be retained where the law or an ongoing contract requires it. Send requests to campaignkitstudio@outlook.com.

9. Security and account access

The system is designed to use verified email sign-in, private storage, row-level access controls and server-side payment operations. No online service can promise absolute security, so customers should use a secure email account and tell us promptly if they believe an access link or account has been compromised.

10. Cookies and local storage

Authentication may use browser storage that is necessary to keep a customer signed in. The demonstration version also stores sample data locally in the browser. ADD A COOKIE AUDIT AND CONSENT MECHANISM BEFORE ADDING NON-ESSENTIAL ANALYTICS OR ADVERTISING TECHNOLOGY.

11. Complaints

Please contact us first so concerns can be addressed. You may also have the right to complain to the relevant data-protection supervisory authority.

Draft last updated: 11 September 2026.