Privacy Policy

1. Who Can Use the Platform

The Platform is intended for users aged 18 and over. We do not knowingly create accounts for, or collect personal data from, anyone under the age of 18. If we become aware that we have collected personal data from a person under 18, we will delete it promptly. If you believe a minor has provided us with personal data, please contact us at hello@findmystudio.co.uk.

2. Personal Data We Collect

Information you provide to us

• Name and contact details — email address and, optionally, phone number
• Account credentials — email and password, or details from a Google sign-in if you choose that option
• Studio profile information (for studio partners) — studio name, location, photos, room details, equipment, pricing and availability
• Artist profile information — name, project details and booking preferences
• Identity verification data — if you choose to verify your identity, we receive a verification status, the date of verification and a reference ID from our verification provider (Didit). We do not receive or store copies of your identity documents — these are handled by Didit directly
• Payment information — processed securely by Stripe, our payment provider. We do not receive or store full card details
• Booking information — requests submitted, sessions booked, notes and correspondence
• Messages — the content of messages you send to other users through the Platform's in-platform messaging, and any messages you send to our team

Information collected automatically

• Usage data — pages visited, features used, search terms and time spent on the Platform
• Device and browser information — browser type, operating system and device type
• IP address and approximate location
• Analytics data — we use Vercel Analytics, which is privacy-friendly and does not use cookies or collect personally identifiable information. See Section 8 below

Information from third parties

• Payment and account information from Stripe in connection with processing transactions and studio payouts
• Verification status from Didit, where you choose to verify your identity
• Basic profile information from Google, if you choose to sign in using your Google account

3. How We Use Your Personal Data

We use your personal data for the following purposes:

• To create and manage your account on the Platform
• To facilitate bookings between artists and studios
• To enable messaging between artists and studios through the Platform
• To process payments, manage studio payouts and handle financial transactions
• To send booking confirmations, receipts, invoices and monthly revenue statements
• To send service-related notifications — including booking requests, updates and reminders
• To enable optional identity verification and display verification status
• To respond to your enquiries and provide customer support
• To improve, develop and personalise the Platform
• To send marketing communications about findmystudio, where you have given consent (you can withdraw consent at any time)
• To detect, prevent and investigate fraud, abuse or other harmful activity
• To comply with our legal obligations

4. Legal Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Contract performance — where processing is necessary to provide the service you have requested, such as facilitating a booking or processing a payment
• Legitimate interests — where we have a legitimate business interest that is not overridden by your rights, such as improving the Platform, securing it, and preventing fraud
• Legal obligation — where we are required to process your data to comply with a legal requirement, such as financial record-keeping
• Consent — where you have given us explicit consent, such as for marketing communications. You can withdraw consent at any time

5. Who We Share Your Data With

We share your personal data only in the following circumstances:

• Studio partners — when you submit a Booking Request, relevant details (name, project notes, preferred dates) are shared with the studio. Messages you send are shared with the recipient
• Artists — studio profile information, including photos, equipment details and pricing, is displayed publicly on the Platform
• Stripe — our payment provider, which processes payments and studio payouts. Stripe receives payment and identity details directly and acts as an independent controller for some of this processing under its own terms
• Didit — our identity verification provider, where you choose to verify your identity
• Service providers — companies that help us operate the Platform, including Vercel (hosting), Supabase (database) and Resend (transactional email), under appropriate data processing agreements
• Legal and regulatory authorities — where required by law, court order or regulatory obligation
• Business transfers — in the event of a merger, acquisition or sale of all or part of our business, your data may be transferred to the new owner, subject to equivalent privacy protections

We do not sell your personal data to third parties.

6. How Long We Keep Your Data

We retain your personal data for as long as necessary to provide the Platform and comply with our legal obligations:

• Account data — retained for the duration of your account and for up to 2 years after account closure
• Booking and payment records — retained for 7 years to comply with financial and tax regulations
• Messages — retained for the duration of your account and for up to 2 years after closure, or longer where needed to investigate abuse or resolve disputes
• Verification records — retained for the duration of your account
• Marketing preferences — retained until you withdraw consent or request deletion
• Support correspondence — retained for 2 years after the matter is resolved

7. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — to request a copy of the personal data we hold about you
• Right to rectification — to request correction of inaccurate or incomplete data
• Right to erasure — to request deletion of your data in certain circumstances (sometimes called the “right to be forgotten”)
• Right to restriction — to request that we limit our processing of your data in certain circumstances
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests or for direct marketing purposes
• Rights related to automated decision-making — to not be subject to decisions made solely by automated processing that significantly affect you. We do not currently make such decisions

To exercise any of these rights, please contact us at hello@findmystudio.co.uk. We will respond within one calendar month. We may ask you to verify your identity before processing your request.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have handled your data unlawfully.

8. Cookies and Analytics

We aim to keep tracking on the Platform to a minimum.

• Essential cookies — necessary for the Platform to function, such as keeping you logged in during a session and securing the service. These cannot be disabled
• Analytics — we use Vercel Analytics to understand how the Platform is used. It is designed to be privacy-friendly and does not use cookies or track you across other websites

Because we do not currently use advertising or non-essential tracking cookies, we do not operate an advertising-style consent banner. If we introduce non-essential cookies in future, we will update this policy and ask for your consent first, as required by the Privacy and Electronic Communications Regulations (PECR). You can control cookies through your browser settings; disabling essential cookies may affect your ability to use some features.

9. International Data Transfers

We primarily store and process your data within the European Economic Area (EEA), using infrastructure located in the Republic of Ireland. The EEA benefits from UK adequacy, meaning data can flow between the UK and EEA freely.

Some of our service providers — including Stripe, Vercel and Resend — may process data in or transfer data to countries outside the UK and EEA, including the United States. Where this happens, we rely on appropriate safeguards under UK GDPR, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.

10. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These include:

• Encryption of data in transit using SSL/TLS protocols
• Secure cloud hosting and database infrastructure provided by reputable suppliers
• Access controls limiting who can access personal data
• Regular security reviews and updates

No method of data transmission or storage is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security. In the event of a data breach that is likely to result in a risk to your rights and freedoms, we will notify you and the ICO as required by law.

11. Third Party Links

The Platform may contain links to third party websites. This Privacy Policy applies only to findmystudio. We are not responsible for the privacy practices of any third party websites and encourage you to read their privacy policies before providing any personal information.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by email or through the Platform. The updated policy will take effect from the date it is published. We encourage you to review this policy periodically.

13. Contact Us

If you have any questions, requests or complaints about this Privacy Policy or how we handle your personal data, please contact us:

FindMyStudio Ltd
hello@findmystudio.co.uk
findmystudio.co.uk
[Registered address — to be inserted]
[Company number — to be inserted]
[ICO registration number — to be inserted]