Privacy notice.

Contact enquiries

When you use the enquiry form, the website stores the name, email address, service, budget range, timeframe and project description you submit. This is used to respond to your request and manage potential client work. The owner may receive a copy through an email delivery provider.

Private quotation reviews

When the studio issues a private quotation link, the website stores a hash of that one-use invitation and a temporary session record. The quotation page can be opened only with valid, unexpired access. If you submit a response, the website records your stated name, whether you accepted or declined, the time of submission and a snapshot of the quoted scope, terms and prices. These records help both parties understand what was reviewed and are not proof of identity or a verified digital signature.

Quote-review tokens are not stored in plain text by the application. Hosting and security infrastructure may still handle connection data. A submitted quotation decision is preserved with its quote until the operator applies an appropriate retention or lawful deletion process. A suitable retention schedule and the operator\u0027s legal identity must be finalised before collecting real customer responses.

Client project progress

For a client who has accepted a quotation, the studio can explicitly publish selected project milestones and progress updates in the private quotation portal. The portal displays those approved messages and their publication dates. Approved milestones may also display their current delivery status and target or completion date. Internal task descriptions, staff notes and unpublished milestones are not shared in the client portal. Access continues to use the quotation-specific, expiring session. Published information and stored client responses remain subject to the operator\u0027s data-retention policy.

Client project messages

Clients accessing an accepted quotation can send private project messages through their quotation-specific session. The site stores message contents, whether each message came from the client or Studio, the related quotation and project IDs, and the date and time. Authorized Studio staff can reply. Messages are not emailed automatically, are not used in public site analytics, and are not publicly accessible. The operator must establish a suitable message retention and deletion policy before real client conversations are collected.

Private project files

If private project file exchange is enabled, accepted clients and authorised Studio staff can upload documents connected to a quotation and client project. The application stores file contents, file names, format, size, uploading role and timestamps privately in PostgreSQL. Documents are not published to the public website. Only authorised sessions for the exact quotation or Studio admins can download them. Staff can remove a file, which clears its contents in the live application database while leaving limited audit metadata; backups may retain earlier copies under their separate retention schedules. Files are checked by a private antivirus service before new uploads are stored; previously uploaded files require a successful staff-initiated scan before release. Antivirus scanning reduces risk but cannot guarantee a file is safe. The operator must keep malware definitions current and set appropriate document retention and deletion procedures before accepting real files.

Verified client accounts

Clients can optionally create a private account for project quotations, documents and messages. Registration collects a name, email address and password. Passwords are stored as salted scrypt hashes rather than plaintext. Email verification and password-reset links use expiring, one-use token hashes. Client login sessions are revocable, and sign-in failures are rate-limited. Email verification alone does not grant project access: a private invitation matching the verified client email is also required before client records can be linked. Account and project access information is not used for public visitor analytics. JVServices must maintain an appropriate retention and deletion process for accounts, session records, messages and project documents.

Client onboarding invitations

When an authorised Studio operator sends a private client invitation, the website transmits the linked client email address and a single-use invitation link through its configured email delivery provider (Resend). The application records whether the email API accepted the request and whether the invitation was redeemed, replaced or expired. A successful send request does not confirm delivery to the recipient. During registration, an approved return destination may be retained with an expiring email-verification token so clients can reopen the invitation after signing in. A return destination does not grant project access: the verified account must still redeem the original single-use invitation for its exact linked client record.

Spam prevention

The contact form uses Cloudflare Turnstile to reduce automated abuse. It also stores a keyed fingerprint derived from the request IP address for submission rate limiting, rather than the plain IP address in the application database. Hosting and anti-spam providers may process connection data under their own policies.

Analytics

Page activity is aggregated by day and path in the website database. The application does not create analytics cookies or retain visitor identifiers for pageview counting. Analytics are approximate and respect browser Do Not Track and Global Privacy Control signals.

Data retention and your rights

Enquiries are currently retained until the website operator deletes them. The operator must implement a suitable retention and deletion schedule before launch. You may contact the site owner to request access, correction or deletion of enquiry data, subject to applicable law.

Operator contact

A public contact address will be listed when the site is configured. Do not submit personal information before then.

Return to contact →