Draft: the highlighted details need filling in before this page goes live.

Privacy policy

Last updated: 7 November 2026

This explains what personal information we collect when you use this site or order from us, and what we do with it.

Who's responsible for your data

[your full legal name], trading as Quillay Studio, is the data controller. Contact us at hello@[your-domain] or at [a real postal address where you can receive post].

What we collect

• Your request: name, email, which part of Great Britain you're in, quantity, colour, date needed, notes, and any files, photos, sketches or measurements you send.
• If you order: delivery address, any phone number you give for the courier, and your order and message history. Payments are handled by Stripe. We receive confirmation of payment, not your card details.
• Security data: a scrambled (hashed) version of your IP address, used to limit abuse of our forms.

On the upload page, your 3D file is read on your own device to work out the estimate, and to make the "View in your room" file if you use it. It's only sent to us if you press Send request.

Why we use it, and our legal basis

• To answer your request, send a quote and fulfil your order: this is needed to take steps towards, and carry out, our contract with you.
• To keep tax and accounting records: this is a legal obligation.
• To protect our site and handle problems or disputes: this is our legitimate interest in running the business safely.
• To email you once when our AI design tool launches: only if you ask, by ticking the box on a request form or joining the launch list on our homepage. This is based on your consent, and you can withdraw it at any time by emailing us. For the launch list we keep only your email address, the date and a scrambled (hashed) version of your IP address.

We don't sell your data or use it for advertising. Our instant estimate is calculated automatically, but a person checks every request and confirms the price.

Who we share it with

We share only what each provider needs:

• Cloudflare: website hosting and security
• Supabase: database and file storage
• Resend: sending emails
• Stripe: taking payments
• Couriers and postal services: delivering your order
• Our email provider, and any accountant or professional adviser we use

Some of these providers may process data outside the UK, including in the United States. Where they do, we rely on the safeguards UK law requires, such as UK adequacy regulations or the provider's approved data transfer terms. If we're required to by law, we may also share information with authorities.

How long we keep it

• Unfinished uploads: removed after about a day.
• Your files and photos: deleted 30 days after your request date, once the job is completed or cancelled. Download links in our internal emails stop working after 7 days.
• Order details and messages: kept for up to 6 years after the job ends, for tax records and possible claims. Signed design transfer letters are kept for as long as the design's rights last.
• Requests that don't become orders: deleted within 12 months.
• AI launch list: kept until we've sent that one email or you ask us to remove you.

Cookies and similar technology

We don't use advertising or analytics cookies, and our own pages don't set cookies. Cloudflare may set a strictly necessary security cookie. To show fonts and 3D graphics, some pages load files from Google Fonts and from jsDelivr, a public code library. When that happens your browser's IP address is sent to them so the files can load. They don't receive anything you type.

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it or send it to another organisation. You can also object to us using it for our legitimate interests. These rights have some limits. For example, we may need to keep tax records. Email hello@[your-domain], and we'll normally reply within one month.

Complaints

Please tell us first if you're unhappy with how we've handled your data. We'll acknowledge your complaint and look into it. You can also complain to the UK regulator, the Information Commissioner's Office.