What we hold, and why.

Project briefs. If you use the project builder, we receive the details you enter: your name, email address, optionally your company, your notes, and the specification you selected (project type, page count, modules, timeline).

Correspondence. If you email us, we hold that email and any information in it for as long as needed to deal with your enquiry and keep a record of it.

Technical data. Our host records standard server logs, including IP address, browser type and pages requested. These are generated automatically by visiting any website and are used for security and diagnosing faults.

We do not ask for, and have no use for, special category data, payment card numbers, or identity documents through this website.

To reply to your enquiry and prepare a quote. Legal basis: taking steps at your request before entering a contract.

To deliver a project you have engaged us for. Legal basis: performance of a contract.

To keep the site secure and working. Legal basis: our legitimate interests in running a functioning, non-abused website.

To meet accounting and tax obligations. Legal basis: legal obligation.

We do not sell your data, and we do not use it for advertising or profiling.

Vercel — hosting and content delivery for this site. Server logs pass through their infrastructure.

Resend — delivers project briefs from the site to our inbox. Brief contents pass through their service in transit.

Mux — serves the background video on this site. Your browser requests video segments directly from them, which means they receive your IP address and standard request data.

Email provider — our inbox provider stores correspondence.

Each acts as a processor or independent controller for that narrow purpose. We do not authorise any of them to use your data for their own marketing.

Some of these providers operate outside the UK and EEA. Where data is transferred internationally, it is done under the safeguards those providers offer, such as standard contractual clauses or an adequacy decision.

Enquiries that do not become projects: up to 24 months, then deleted.

Project records: for the duration of the engagement and up to 7 years afterwards, where needed for accounting, tax and dealing with any dispute.

Server logs: retained on a short rolling basis by our host.

This site does not set advertising or tracking cookies, and there is no third-party ad network on it.

If privacy-friendly analytics are enabled, they record aggregate page views without cookies and without building a profile of you. If that changes in a way that requires consent, we will ask for consent before it runs.

AI tools are used as part of how this studio works — for drafting, code generation, research and producing assets — always under human direction and human review. A person is accountable for everything that ships.

We do not put your confidential material into AI services that train their models on what is submitted, and AI is not used to make automated decisions that produce legal or similarly significant effects about you.

You have the right to ask for a copy of your data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time.

Email harry@vexero.studio and we will respond within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

This site is aimed at businesses and is not directed at children. We do not knowingly collect data about anyone under 16.

If this policy changes, the revised version will be posted here with a new date at the top. Material changes affecting existing clients will be raised directly.