Privacy & cookies

Last updated: 24 September 2026. A plain-English summary of how we handle your information.

Who we are

Hanbrook Studio is a web design and AI agent studio run by Alex, based in Leicester, UK. We are responsible (the “controller”) for the personal information described here. If you have any questions about your data, email hello@hanbrookstudio.co.uk.

What we collect

Only what you choose to give us, plus the basics needed to run a secure website:

• Enquiries: your name, business name, email, phone number, address (if given), the service you’re interested in, your budget, timeframe, preferred style and message.
• Client accounts: if you create an account, your name, email and a password. Your password is stored scrambled (hashed) by our sign-in provider; we can never see it.
• Project work: messages you send us in your client portal, and any files you attach or we share with you (such as designs, photos and invoices).
• Emails: anything you send to our email addresses, and our replies.
• Technical information: like every website, our hosting provider processes your IP address and basic browser details to deliver pages and protect the site from abuse.

We don’t use analytics or advertising trackers, and we don’t follow you around the web.

Why we use it (and our lawful basis)

• To reply to your enquiry and discuss working together: taking steps at your request before a contract.
• To run your account and deliver your project: performing our contract with you.
• To keep the site and your account secure: our legitimate interest in protecting our clients and systems.
• To keep business and tax records: our legal obligations.

Who helps us run things

We never sell your information. We only share it with the trusted services we use to run the studio, each of which handles it on our instructions:

• Supabase stores enquiries, accounts, portal messages and uploaded files (EU servers, Ireland).
• Resend sends our emails, such as replies, account and password emails (EU region, Ireland).
• Cloudflare hosts this website, forwards our email and protects the site from attacks (global network).
• Google: our business inbox is Gmail. Our main fonts are served from this website, but a few pages that show design previews (the homepage, styles, website design and AI agents pages) load extra preview fonts from Google Fonts, which means your browser shares your IP address with Google on those pages.

Some of these companies may process data outside the UK. When they do, it is protected by legally recognised safeguards such as UK adequacy regulations or the UK International Data Transfer Agreement.

How long we keep it

• Enquiries that don’t turn into a project: up to 12 months, then deleted.
• Accounts and project messages/files: for as long as we’re working together, and up to 12 months after, unless you ask us to delete them sooner.
• Invoices and financial records: 6 years, as UK law requires.

Your rights

Under UK GDPR you can ask to see a copy of your information, correct it, delete it, restrict or object to how we use it, or receive it in a portable format. Just email hello@hanbrookstudio.co.uk and we’ll respond within one month.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Cookies and browser storage

We don’t use advertising or tracking cookies, so there’s no cookie banner. We only store a few small, essential things in your browser:

• Sign-in: if you log in, a secure token keeps you signed in. It’s removed when you sign out.
• Preferences: a note that you’ve already seen the enquiry pop-up, and your reduced-motion setting, so the site remembers them.

These never leave your device except to keep you signed in.

Changes

If we change how we use your information, we’ll update this page and the date at the top.