Privacy Policy
Effective 19 August 2026 This policy explains how personal information is collected and used when you visit Studio Founded, make an enquiry or purchase, join the newsletter, submit work for consideration, or work with the studio.
1. Who is responsible for your information?
Hannah Rose Shaw trading as Studio Founded is the data controller responsible for the personal information described in this policy.
Address: Hannah Rose Shaw, 4th Floor, Silverstream House, 45 Fitzroy Street, London, W1T 6EB, United Kingdom
Email: hello@studiofounded.com
Website: www.studiofounded.com
2. Information collected and how it is used
The information collected depends on how you interact with Studio Founded. The table below sets out the main activities, the information involved, why it is used and the lawful basis relied upon.
| Activity | Information | Purpose | Lawful basis |
|---|---|---|---|
| Enquiries and contact | Name, email address, business or website details, project information and anything included in your message. | To respond to an enquiry, discuss a possible project and keep an appropriate record of correspondence. | Steps taken at your request before entering a contract; legitimate interests in managing enquiries. |
| Purchases and product delivery | Name, email address, billing details, business details, purchase history and limited payment-status information. | To process an order, deliver products, send transactional and product follow-up emails, prevent fraud and maintain business records. | Contract; legal obligation; legitimate interests in preventing fraud and supporting purchases. |
| Client projects | Contact details, contracts, invoices, project requirements, correspondence, feedback, submitted content and project files. | To plan, manage and deliver the commissioned services, provide support and maintain project records. | Contract; legal obligation; legitimate interests in administering and protecting the business. |
| Newsletter | Name, email address, subscription preferences, consent record and engagement information supplied by the email platform. | To send the Studio Founded newsletter and manage subscription preferences. | Consent. Consent can be withdrawn at any time using the unsubscribe link. |
| Directory and Design Anthology submissions | Name, business name, email address, website, descriptive text, images and other submitted material. | To assess a submission, contact the submitter and, if selected, publish and promote the agreed information. | Steps taken at your request; consent where appropriate; legitimate interests in administering editorial features. |
| Website and template demos | IP address, device and browser information, security logs, page requests and strictly necessary cookie or storage information. | To display, secure, maintain and troubleshoot the website and password-protected template demonstrations. | Legitimate interests in operating and protecting the websites; consent where required for non-essential storage technologies. |
| Complaints, legal matters and compliance | Contact information, correspondence, order or service history and information relevant to the issue. | To handle complaints or claims, establish or defend legal rights and meet legal or regulatory obligations. | Contract; legal obligation; legitimate interests in resolving disputes and protecting legal rights. |
Payment information
Payments are handled by payment providers such as Stripe and PayPal, including where they are made through ThriveCart. Complete card or bank details are normally entered directly into the payment provider's systems. Studio Founded generally receives order details, billing information and confirmation of whether a payment succeeded, rather than complete card details.
Transactional and product emails
When a purchase is made through ThriveCart, the customer's order information is added to Flodesk so that Studio Founded can send order, delivery and relevant product follow-up emails. These are transactional or purchase-related communications and do not automatically subscribe the customer to the Studio Founded newsletter. Where an order is accepted by direct invoice instead, transaction information is handled through Studio Founded's email, invoicing and payment providers.
Contact forms
Information submitted through a contact, enquiry or submission form is used for the purpose stated on that form. Forms may be provided through Tally or Squarespace. Please avoid including sensitive personal information unless it is genuinely necessary for your request.
3. Where personal information comes from
Most information is provided directly by you, including when you complete a form, subscribe, place an order, send an email, make a submission or participate in a client project. Some technical information is collected automatically by the website and its service providers. Payment providers may also return transaction status, billing and fraud-prevention information connected with an order.
4. Service providers and other recipients
Studio Founded uses reputable services to operate the website and business. Depending on the service and processing activity, a provider may act as a processor on behalf of Studio Founded or as an independent controller under its own privacy terms.
| Provider | Purpose |
|---|---|
| Squarespace | Website hosting, template demonstrations, forms, security and platform operation. |
| Tally | Enquiry, project and editorial-submission forms. |
| ThriveCart | Checkout, order management, digital-product workflows and transactional information. |
| Stripe and PayPal | Payment processing, payment confirmation and fraud prevention. These providers may also act as independent controllers for regulatory and payment-network purposes. |
| Flodesk | Newsletter subscriptions, preferences, consent records and email delivery. ThriveCart customer details are also passed to Flodesk for order, delivery and relevant product follow-up emails, without automatically enrolling the customer in the newsletter. |
| Notion | Client workspaces, project management, feedback, support resources and related records. |
| Google Drive | Sharing and storing website content, images and other project or delivery files. Studio Founded does not use Google Drive as a marketing database. |
| Adobe Creative Cloud and Adobe Express | Creating, storing and sharing design files, templates, images and project materials. |
| Adobe Fonts | Delivering certain fonts used on Studio Founded websites and template demonstrations. Adobe receives an IP address to deliver a font but states that it does not store that IP and does not set cookies when serving web fonts. |
| IONOS | Domain registration and business email services. |
| Provider | Locations | Safeguard |
|---|---|---|
| Squarespace | Ireland, United States and other subprocessor locations | UK adequacy regulations, including the UK-US data bridge where applicable; UK Addendum as a contractual fallback. |
| Tally | Belgium and European data centres | UK adequacy regulations for the EEA. |
| IONOS | United Kingdom and Germany/EEA | No restricted transfer for UK processing; UK adequacy regulations for the EEA. |
| Flodesk | United States and other subprocessor locations | UK Addendum to the EU Standard Contractual Clauses; other approved mechanisms where applicable. |
| Notion | United States and other subprocessor locations | UK Addendum to the EU Standard Contractual Clauses and adequacy mechanisms where applicable. |
| Stripe | United Kingdom, EEA, United States and other provider locations | UK-US data bridge where applicable; UK Addendum for other restricted transfers. |
| PayPal | United Kingdom, EEA, United States and other provider locations | Adequacy decisions and contractual safeguards described in PayPal's privacy documentation. |
| Google Drive | United States and other Google processing locations | UK Addendum to the EU Standard Contractual Clauses and adequacy mechanisms where applicable. |
| Adobe | Ireland, United States, India and other provider locations | UK-US data bridge for covered certified US entities; UK Addendum for other restricted transfers. |
| ThriveCart | United States and countries used by its subprocessors | Contractual safeguards and other transfer mechanisms stated by the provider. ThriveCart's public documentation does not clearly identify a current UK-specific mechanism. |
Studio Founded may also disclose information where reasonably necessary to professional advisers, insurers, accountants, payment and fraud-prevention services, regulators, courts, law-enforcement bodies or another party involved in establishing, exercising or defending legal rights.
Sentry is not separately appointed by Studio Founded. If Squarespace or another platform uses Sentry for internal error monitoring, it is treated as that platform's subprocessor and is covered by the relevant provider entry above.
5. International transfers
Some providers process information outside the United Kingdom or use subprocessors located in other countries. This can include the European Economic Area, the United States, India and other locations in which the providers operate.
Where UK data protection law restricts a transfer, the provider and Studio Founded rely on an approved safeguard appropriate to the destination and recipient. These may include UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses. Providers may also apply contractual and technical protections to onward transfers made by their subprocessors.
6. How long information is kept
Information is retained only for as long as reasonably needed for the purpose for which it was collected, including applicable tax, accounting, contractual and legal requirements. The usual periods are:
| Record | Usual retention |
|---|---|
| Unsuccessful or preliminary enquiries | Normally up to two years after the last substantive contact, unless there is a reason to keep the record longer. |
| Orders, invoices, contracts and accounting records | Normally six years after the end of the relevant financial or tax period. |
| Client project records and correspondence | Normally six years after project completion, with selected non-sensitive portfolio or creative records retained longer where there is a legitimate business or archival reason. |
| Newsletter records | Until you unsubscribe or the newsletter service is discontinued. A minimal suppression record may be retained so that an unsubscribe request continues to be respected. |
| Directory and Design Anthology submissions | For as long as needed to review and manage the submission and, if published, while the feature remains live. Contact details and identifiable material will be removed or anonymised where appropriate following an accepted removal request. |
| Form submissions and technical records | For the period needed to respond, deliver the relevant service, maintain security or move the information into the appropriate business record, subject to the provider's backup and deletion cycles. |
7. Cookies and similar technologies
Studio Founded restricts the main website and template demonstrations to cookies and similar technologies needed to provide, secure or remember choices relating to the service, unless a visitor has made another choice through an available consent control. Google reCAPTCHA is not enabled by Studio Founded.
Squarespace may place strictly necessary cookies for functions such as security, fraud prevention, session management, password-protected pages and remembering privacy choices. The current cookie notice provides further information about technologies detected on the relevant site.
Some template demonstrations use Adobe Fonts. Adobe states that it does not set or use cookies to serve web fonts. When a font loads, the visitor's browser connects to Adobe's content-delivery network and sends technical request information, including the IP address needed to return the font file. Adobe states that it does not store that IP address.
8. Template demos
Studio Founded operates password-protected Squarespace template demos to show the design and functionality of its products. They are demonstration websites controlled by Studio Founded, not separate businesses. This policy applies to those demos as well as the main Studio Founded website.
Each demo should provide a clear link to this policy from its lock screen or another location visible before entry. A separate privacy policy is not required for every demo where the same controller, practices and policy apply. A demo that later adds a materially different form, integration, analytics tool or other processing activity may require an additional notice or an update to this policy.
9. Affiliate links and external websites
The website may contain affiliate links. If you follow one, the destination website or affiliate network may receive the information ordinarily sent when a link is opened, such as the referring page, device information and IP address, and may use its own tracking technologies to attribute a later purchase. Those organisations process information under their own privacy and cookie policies. Studio Founded may receive commission if an eligible purchase is made, but does not receive complete payment-card details from the destination website.
Links to other websites are provided for reference or convenience. This policy does not govern how another website collects or uses information, and you should review that website's privacy information before providing personal data.
10. Your data-protection rights
Depending on the circumstances and lawful basis, UK data protection law may give you the right to:
ask for access to your personal information and certain information about its use;
ask for inaccurate or incomplete information to be corrected;
ask for personal information to be deleted in circumstances where the right applies;
ask for the use of your information to be restricted;
object to processing based on legitimate interests or to processing for direct marketing;
receive information you provided in a portable format, where the right applies; and
withdraw consent at any time where processing is based on consent.
These rights are not absolute and exemptions may apply. To make a request, email hello@studiofounded.com. Studio Founded may ask for information reasonably needed to verify your identity or clarify the request. Requests will be handled without undue delay and normally within one month, subject to any lawful extension.
11. Complaints
If you are concerned about how your information has been used, please contact Studio Founded first at hello@studiofounded.com or use the contact page at www.studiofounded.com/contact. A data-protection complaint will be acknowledged within 30 days and considered without undue delay.
If you remain dissatisfied, you may complain to the Information Commissioner's Office:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: ico.org.uk/make-a-complaint
12. Changes to this policy
This policy may be updated when Studio Founded changes a service, provider or processing practice, or when legal requirements change. The effective date at the beginning of the policy shows when it was last materially updated.