This policy covers oryzendesign.com and the project space we open for clients. The data controller is Onmotio Design Limited, a company registered in England and Wales and based in London, trading as Oryzen Design. You can reach us at hello@oryzendesign.com.
This website sets no cookies
No session cookies, no advertising trackers, no third-party analytics. That is why there is no consent banner on this site — there is nothing to consent to. Our public pages are static files served from a cache; they cannot tell one visitor from another.
The client area is a separate application on a different part of this domain. It does use a session cookie, for the single purpose of keeping you signed in. Nothing about it is used for tracking or advertising.
What we collect, and when
When you send us a brief
The contact form asks for:
- your name and email address — required, because we cannot reply without them;
- your company name — optional;
- a description of what you want rendered, and optionally a rough image count, timeline and budget range;
- anything else you choose to add in the notes field.
We also record the country your request came from, which our hosting provider adds automatically. We do not log your IP address when you submit the form.
When you buy a package
Checkout is handled by Stripe. Your card details go to Stripe and never reach our servers. We receive your name, email, billing country and the contents of your order, so we can invoice you and open the project.
When you become a client
We hold the material you send us for the project — product photographs, brand guidelines, reference images, written feedback — plus the images we produce for you. That is the work itself; it is kept for as long as the project is live and archived afterwards.
Server logs
Our hosting provider keeps short-lived technical logs of requests, including IP addresses, to defend the site against abuse. We do not use those logs for anything else and we do not build profiles from them.
Why we are allowed to hold it
- To answer you and to run the project — performance of a contract, or steps taken at your request before entering one.
- To keep accounting records — a legal obligation under UK company and tax law.
- To keep the site working and secure — our legitimate interest in not being knocked offline.
How long we keep it
- Briefs that do not become projects — up to 24 months, then deleted. Ask sooner and we delete sooner.
- Client project files and delivered images — for the life of the project and up to 24 months after hand-off, so we can re-supply a file you have lost.
- Invoices and payment records — six years, because UK law requires it.
Who else sees it
We do not sell personal data, and we do not share it for anyone else's marketing. These are the providers that process data on our behalf:
- Cloudflare, Inc. — Hosting, CDN and network security. Processing region: Global edge network.
- Supabase — Database and file storage for project data. Processing region: European Union (eu-west-1).
- Stripe — Payment processing and invoicing. Processing region: European Union / United States.
- Resend — Transactional email delivery. Processing region: European Union / United States.
- Anthropic — AI assistance on production prompts and drafts. Processing region: United States.
Where a provider processes data outside the United Kingdom, the transfer is covered by the safeguards in that provider's data processing terms — in practice the UK Addendum to the EU Standard Contractual Clauses.
On the AI provider specifically: we send prompts and project direction to Anthropic's API to prepare and refine production prompts. We do not send client contact details there, and the provider does not train its models on data sent through its business API.
Your rights
Under UK data protection law you can ask us to:
- give you a copy of what we hold about you;
- correct anything that is wrong;
- delete it, where we have no legal reason to keep it;
- stop or restrict a particular use;
- send it to you, or to someone else, in a portable format;
- object to processing we do on the basis of legitimate interest.
Write to hello@oryzendesign.com. We answer within one month. There is no charge, and we will not ask you why.
If you are not satisfied with our answer you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.
Changes
When this policy changes, the date at the top of the page changes with it. If a change affects how we handle data you have already sent us, we will email you rather than let you find out here.
Questions about this document? Write to the studio and we'll answer in plain English.