Privacy
policy.
How Vibe Shift Studio collects, uses and protects your personal data, written in plain English. This policy applies to anyone who visits this website, fills in the contact form, books a discovery call, or works with the studio as a client.
1. Who we are
Vibe Shift Studio Ltd ("we", "us", "the studio") is a social-first creative studio based in London, United Kingdom. For the purposes of the UK GDPR and the EU GDPR, we are the data controller for personal data we collect through this site.
Contact for data requests: hello@vibeshiftstudio.com
2. What personal data we collect
We collect only what we need to reply to enquiries, deliver work and run the business:
- Contact form data: name, email address, brand/company name, role, the message you send, and the budget/services chips you select.
- Email correspondence: anything you choose to share when you email us directly.
- Client account data: for active engagements, the brief, deliverables, approvals and any account history stored in the client dashboard.
- Technical data: IP address, browser type, device, pages visited and approximate location, collected through standard server logs and any analytics we choose to enable (see Cookies below).
We do not knowingly collect sensitive personal data (health, religion, political views, etc.) and we do not collect data from children under 16.
3. Why we collect it (legal basis)
Under GDPR, every use of personal data must have a legal basis. Ours are:
- Contract (Art. 6(1)(b)): processing data so we can respond to your enquiry, propose a scope of work and deliver an engagement.
- Legitimate interest (Art. 6(1)(f)): keeping basic records of who has contacted the studio, replying to email correspondence, and protecting the site against abuse.
- Consent (Art. 6(1)(a)): for any optional cookies or for marketing emails you opt into.
- Legal obligation (Art. 6(1)(c)): keeping invoicing/accounting records for the period required by UK law.
4. How long we keep it
- Contact form submissions: kept for up to 24 months from your last contact, then deleted unless you become a client.
- Client account data: kept for the duration of the engagement plus 7 years for accounting and contractual records.
- Newsletter list (if opted in): until you unsubscribe.
- Server logs: 30 days.
5. Who we share it with
We don't sell your data. We share it only with carefully chosen processors that help us run the studio:
- Vercel (website hosting, US/EU regions)
- Resend (transactional email for the contact form)
- Google Workspace (email, scheduling)
- Payment processors (Stripe or bank, for invoiced work only)
- Our accountant, under standard professional confidentiality
Where data leaves the UK/EEA, we rely on Standard Contractual Clauses or equivalent transfer mechanisms approved under GDPR.
6. Cookies and analytics
This site uses only the cookies it needs to function (e.g. preserving your hamburger-menu open/closed state in the current session). It does not run third-party advertising or tracking cookies. If we add analytics in future, we will update this policy and ask for consent before any non-essential cookies load.
7. Your rights
Under UK and EU GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten") where there's no legal reason to keep it
- Restrict processing in specific circumstances
- Object to processing based on legitimate interest
- Portability: receive your data in a structured, machine-readable format
- Withdraw consent at any time, where consent is the legal basis
- Lodge a complaint with the UK Information Commissioner's Office or your local EU supervisory authority
To exercise any of these rights, email hello@vibeshiftstudio.com. We respond within 30 days as required by GDPR.
8. How we protect your data
The site runs over HTTPS. Form submissions are sent over TLS. Access to the client dashboard is gated by individual logins. We use strong passwords, two-factor authentication and reputable processors. No system is perfect: in the unlikely event of a personal data breach affecting your rights, we will notify the ICO within 72 hours and contact affected individuals where required.
9. Changes to this policy
We may update this policy as the studio grows or as the law changes. The "last updated" date at the top reflects the current version. Substantive changes will be flagged on the homepage for at least 14 days.
10. Contact
Questions, complaints or data requests:
Vibe Shift Studio Ltd
London, United Kingdom
hello@vibeshiftstudio.com