Privacy Policy

When you use the contact form

The form asks for your name, email address, the kind of work you’re after, your budget range, and whatever you’d like to tell me. I use it to reply to you and to work out whether I’m the right person for the job. The lawful basis is my legitimate interest in responding to enquiries about my work. Form entries are stored in this site’s database and emailed to me.

When we email

Whatever you send me lives in my inbox. I keep correspondence so I can pick up threads later and so there’s a record of what was agreed.

When you become a client

I’ll hold your contact details, project notes, invoicing details, and whatever project material you share with me. That’s processed to perform our contract, and to meet my legal obligation to keep accounting records.

When you visit the site

My hosting and Cloudflare keep short-lived server logs, including IP addresses, for security and to keep the site running. Images and video are delivered by Cloudinary, which receives your IP address when your browser loads them. I use Cloudflare Web Analytics, which sets no cookies and doesn’t track you across sites. I can see that a page was viewed, not who viewed it. There’s no advertising, no profiling, and nothing sold to anyone.

How long I keep it

Enquiries that don’t turn into work are deleted after twelve months. Client records are kept for the duration of the project and then for six years afterwards, which is what HMRC expects for accounting records. Form entries in the site database are cleared on the same twelve-month cycle. If you’d like your information removed sooner, ask and I’ll do it, unless I’m legally required to keep it.

Who else is involved

Running a studio means using other people’s software. Your information may pass through my website hosting and server infrastructure, DNS and security, image and video delivery, transactional email, the contact form on this site, email and file storage, invoicing and accounting, and cookieless site analytics. Each is a processor acting on my instructions, under a contract that limits what they can do with your information.

Some of those providers are based outside the UK. Where they are, the transfer is covered either by the UK extension to the EU–US Data Privacy Framework, where that provider is certified under it, or by standard contractual clauses with the UK addendum.

I don’t sell your information, and I don’t share it with anyone for marketing.

How I use AI

I use AI tools in my work, and I’d rather be specific about it than leave you guessing.

For my own work, research, drafting, code, design exploration, I use Claude (Anthropic), ChatGPT (OpenAI), Gemini (Google), DeepSeek, and AI features built into tools like Figma and GitHub Copilot.

For anything that identifies you or your customers, the rule is different. Personal data doesn’t go into a cloud AI service unless you’ve agreed to it and it’s covered by our contract. Where a task genuinely needs AI applied to sensitive material, customer records, health information, financial detail, anything under an NDA, I run the model locally on my own machine. Nothing leaves my desk, nothing is transmitted, and nothing is shared with any third party.

All final decisions are mine. AI accelerates the work, sparks ideas and assists with research, and it doesn’t replace the perspective, intent or authorship behind what I make. There’s more on this in my AI statement.

When I’m working on your systems

If I’m building or maintaining a website, CRM or automation for you, your customers’ data passes through my hands. In that arrangement you’re the controller and I’m the processor, which means I only act on your written instructions, I keep what I see confidential, I don’t use it for anything of my own, and I return or delete it when the work ends. The specifics sit in our contract rather than in this policy.

What this site stores

There are no advertising or tracking cookies on this site, and my analytics doesn’t use cookies or store anything on your device. That’s why you aren’t greeted by a consent banner.

What the site does store is small and practical. Gravity Forms uses a cookie to keep your place if a form spans more than one step, and Cloudflare may set a security cookie to tell humans from bots, both are needed for the site to work. The site also remembers your accessibility choices, such as a reduced-motion or colour-scheme preference, so you don’t have to set them again on every visit. Those are stored in your browser and never sent anywhere. If you’d rather they weren’t kept, switch the preference back or clear this site’s data in your browser, and nothing is stored.

There’s more detail in my cookie policy.

How I keep it safe

The site runs over HTTPS with Cloudflare in front of it. My machine is encrypted, accounts use two-factor authentication where it’s available, and client material is kept in access-controlled storage rather than scattered across services. No system is perfect, so if something goes wrong that affects your information, I’ll tell you promptly and tell you what I’m doing about it.

Your rights

Under UK data protection law you can ask me for a copy of the information I hold about you, ask me to correct it if it’s wrong, ask me to delete it, ask me to restrict what I do with it, ask for it in a portable format, or object to my processing it on legitimate interests grounds.

Email man@horton.studio and I’ll respond within one month. There’s no charge.

If you’re unhappy with how I’ve handled your information, you’re entitled to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. I’d appreciate the chance to put it right first.

If this changes

If this policy changes, the date at the top changes with it. Material changes will be flagged on the site.