Privacy Policy

1. Who We Are

TD Studio is an independent web engineering consultancy operated by Toby Daeche in the United Kingdom.

Data Controller: TD Studio (Toby Daeche)
Direct Enquiries: toby@tobydaeche.com
Production Studio: studio.tobydaeche.com

2. What Information We Collect

We collect only the minimum personal and business details needed to prepare and deliver a customised website demonstration:

• Preview Requests: Your business or trading name, trade category, operating town/city, and mobile phone or WhatsApp number (so we can text you the preview link).
• Commercial & Billing Data: If you approve your preview and choose to launch, our PCI-DSS Level 1 payment processor (Stripe) securely collects billing and invoice details. We never store or handle raw debit/credit card numbers.
• Technical Log Data: Basic server access logs (IP address, user agent) recorded temporarily by Cloudflare edge networks for security and DDoS defense.

3. Lawful Basis for Processing (UK GDPR)

• Contract Preparation (Article 6(1)(b)): Processing your business details and contact number to prepare and deliver the free working preview you requested.
• Legitimate Interests (Article 6(1)(f)): Demonstrating digital modernization to UK sole traders and SMEs with clear, instantaneous opt-out capabilities.
• Legal Obligation (Article 6(1)(c)): Retaining transaction and invoice records for statutory HMRC tax accounting purposes.

4. Third-Party Service Providers & Processors

We use trusted, GDPR-compliant infrastructure partners to deliver our services:

• Stripe: Payment processing, customer portal, and invoice generation.
• Supabase: Encrypted European cloud database (hosted in AWS London, eu-west-2) for pipeline state.
• Cloudflare: Global DNS management, SSL certification, and edge static CDN hosting.
• Vercel: Edge serverless hosting for backend API logic.

5. Cookies & Tracking

TD Studio does not use advertising cookies, third-party marketing pixels, or invasive behavioral trackers. We use only strictly necessary session tokens for authenticated client portal sessions.

6. Your Rights Under UK GDPR

Under UK data protection law, you have full control over your personal data, including:

• Right of Access: Request a copy of the personal data we hold about you.
• Right to Erasure: Request that we permanently delete your contact information and preview deployment.
• Right to Object: Opt out of future outreach with 1 click using our automated unsubscribe mechanism.

To exercise any of these rights, contact us at toby@tobydaeche.com. We respond to all requests within 48 hours.

7. Contact & Regulatory Authority

If you have any concerns regarding how your data is handled, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.