Privacy policy.

1. Who is responsible

Thyme Flow Studio is run by Sean, based in Warrington, United Kingdom. Thyme Flow Studio is responsible for deciding how personal information is used for its own enquiries, customer relationships and business administration (the “data controller”).

This policy covers the website, contact form, email enquiries, Facebook and Instagram messages, including enquiries started through adverts, and information needed to arrange and provide spreadsheet or website services.

2. Information collected

The information depends on how you get in touch. It may include:

• Your name, email address, business name and any other contact details you choose to provide.
• Your message, service requirements, timescale and answers to enquiry questions.
• Your social-media profile name and information made available with your message by Facebook, Instagram or Etsy.
• Correspondence, agreed project details, files you provide, invoices and transaction references needed to manage an order.
• Technical information handled by hosting and security providers, such as IP addresses, browser details, access times and requested pages.

Most information comes directly from you, including through the platforms you use to contact the studio. Providing an enquiry is voluntary, but sufficient contact and project information is needed to reply or prepare a quote. The website form marks required fields.

Please use sample or anonymised data for initial spreadsheet enquiries. Before sending files containing other people’s personal information, contact me to agree the necessary project and data-handling arrangements.

3. How information is used

Answering enquiries and preparing a quote

To understand your request and reply. The lawful basis is taking steps at your request before entering a contract, or legitimate interests in answering a business enquiry where you act on behalf of an organisation.

Providing an agreed service

To deliver work, communicate about it and provide agreed support. The lawful basis is performance of a contract with you, or legitimate interests in managing the customer relationship when the customer is an organisation.

Records, security and disputes

To meet applicable accounting or legal duties (legal obligation), and to protect the website, prevent misuse and handle complaints or claims (legitimate interests in running and protecting the business).

Sending an enquiry does not subscribe you to a marketing mailing list. Where a separate use requires your consent, that consent must be requested separately and can be withdrawn.

Messenger may use an automated greeting and questions to collect your enquiry. Sean reviews project enquiries personally; the chat does not make a solely automated decision with a legal or similarly significant effect on you.

4. Services involved

Information is handled through the services needed for the channel you choose:

• FormSubmit: sends the website contact form to the studio’s email inbox. Its documentation says form submissions are retained for 30 days. See FormSubmit’s privacy information (PDF) and documentation.
• Google Workspace: provides business email. FormSubmit’s 30-day archive period does not delete the copy delivered to the email inbox. See Google’s privacy information.
• Meta: provides Facebook, Instagram and Messenger, and processes adverts and messages on its platforms. See Meta’s privacy policy.
• OpenAI Sites and hosting infrastructure providers, including Cloudflare: deliver and protect this website. See OpenAI’s privacy information and Cloudflare’s privacy policy.
• Etsy: handles purchases and messages made through the Etsy shop under its own privacy policy.

Relevant information may also be disclosed where required by law or necessary for professional advice or a legal claim. Enquiry details are not sold to other businesses.

Some service providers operate outside the UK or use international infrastructure, so information may be processed in other countries. Their linked privacy information provides details of their processing and, where described, international transfer safeguards. Contact the studio to ask which providers handle your enquiry and for further information about the relevant transfer arrangements.

5. How long information is kept

Retention is based on the purpose of the record:

• Enquiries that do not become an order: whether the request is still active, an answer or follow-up is outstanding, or a complaint needs to be resolved.
• Customer correspondence and project files: the duration of the project, agreed support, and any genuine need to resolve a dispute or establish what was agreed.
• Invoices and business records: the applicable accounting and tax retention requirements and any outstanding legal matter.

The studio’s retention policy is to review records and delete or anonymise information when these purposes no longer apply. Platform-held copies, security logs and backups are also subject to the relevant provider’s retention arrangements. You can ask about the retention of a particular record using the contact email above.

6. Website and cookies

The studio’s website pages do not currently include Google Analytics or a Meta tracking pixel. Hosting and security services may process technical information needed to deliver and protect the site.

Submitting the contact form takes your request through FormSubmit, which may use cookies and a Google reCAPTCHA spam check. Using an external platform such as Etsy or Facebook is also subject to that platform’s own cookie and privacy settings. You can email the studio directly if you prefer not to use the web form.

7. Your rights

Depending on the circumstances and lawful basis, UK data protection law gives you rights to:

• Ask for access to your personal information and a copy of it.
• Have inaccurate information corrected.
• Request deletion or restriction of its use.
• Receive certain information in a portable format.
• Withdraw consent where processing relies on consent, without affecting earlier lawful processing.

Your right to object: you can object to processing based on legitimate interests because of your particular situation. You can always object to the use of your information for direct marketing.

To make a request, email sales@thymeflowstudio.com. Appropriate identity checks may be needed before information is disclosed. Your request will be considered under the applicable law; some rights have exceptions.

8. Questions and complaints

Please contact Sean at sales@thymeflowstudio.com with any concern about how the studio handles your information.

You also have the right to complain to the UK Information Commissioner’s Office. Visit ico.org.uk/make-a-complaint for its current guidance and contact options.

This page may be updated when services or data-handling arrangements change. The date at the top shows the latest update.