Privacy Policy

Who we are

PSA Studio is the product studio of Paul Smith Agentics, run by Paul Smith, a sole trader based in Kilbirnie, Ayrshire, Scotland. In this policy, “we” and “us” mean Paul Smith Agentics, trading as PSA Studio, and we are the data controller for everything described here. If you have any question about your data, email privacy@psastudio.org.

What we collect

Your name, email and message when you use a contact or enquiry form, and whatever you type if you use the “Report a problem” button.

We also keep basic technical logs — the pages requested and rough timing — so we can keep the service working and spot abuse. We do not sell anything to anyone, ever, and we do not use your data to train AI models. This site has no user accounts and no login.

Why we use it, and our lawful bases

To reply to you and, if you ask us to, to talk about a project. Our UK GDPR Article 6 lawful bases are:

• Legitimate interests — to respond to you, and to keep the service working and secure. We have weighed this against your interests and rights, and you can ask us for that assessment.
• Contract — where we are providing a service you or your organisation asked for, including the steps leading up to it.
• Consent — only where you have separately opted in, such as an occasional update email. You can withdraw consent at any time and every such email carries an unsubscribe link.
• Legal obligation — where we have to keep or disclose something by law.

We do not ask for, and do not want, special category data through this site. Please do not send health, ethnicity, political or similar information in an enquiry form.

Google user data

We operate an internal tool that connects to our own Google account — not yours, and not any visitor's. It is used only by us, to save re-typing our own paperwork. No visitor to this site is asked for, and no visitor can grant, access to a Google account.

Google requires us to set out exactly what that tool can see and what we do with it, so:

• What it can access: read-only access to our own Gmail messages (gmail.readonly), and permission to create and manage only the files it creates itself in our own Google Drive (drive.file) — it cannot see anything else in that Drive
• Why: to find receipts and invoices in our own business mailbox and turn them into draft bookkeeping entries, which a human then checks. Nothing is filed automatically.
• What we keep: the supplier, date, amount and a reference for each receipt. We do not copy the wider contents of the mailbox, and we do not store message bodies.
• Where it is held: in our own database in the United Kingdom or European Economic Area, with the connection credential held encrypted.
• Who else sees it: nobody. It is not shared, sold, or passed to any third party.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular we do not use this data for advertising, we do not sell it, we do not allow humans to read it except where we need to for a security or support reason, where the law requires it, or with explicit permission — and we do not use it to develop, improve or train generalised AI or machine-learning models.

You can see and withdraw this access at any time at myaccount.google.com/connections.

Who helps us run it

We use a small number of suppliers, each engaged under written data protection terms that meet Article 28 of the UK GDPR:

• Supabase — database and authentication, on a project hosted in the United Kingdom or the European Economic Area.
• Netlify — website and application hosting.
• Cloudflare — domain, DNS and protection against attacks. Cloudflare also provides two things that run in your browser on this site: Turnstile, which checks a form is being sent by a person and not a bot, and Web Analytics, which counts page visits without cookies and without identifying you.
• Brevo — email delivery, including the reply to your enquiry.
• Anthropic — the AI assistant that reads an enquiry to summarise it and draft a scope. Anthropic does not use the content of those requests to train its models.

They act on our instructions and are not permitted to use your data for their own purposes.

How we keep it safe

We take the technical and organisational measures required by Article 32 of the UK GDPR. In practice that means data encrypted in transit and at rest, access limited to named individuals on a least-privilege basis and protected by multi-factor authentication, row-level access rules so one organisation can never see another’s data, audit logging, regular backups held in the same regions as the live data, and dependency and patch monitoring.

If a breach happens that puts your rights at risk, we will report it to the ICO within 72 hours of becoming aware of it, and tell you directly where the law requires it.

How long we keep it

Enquiry correspondence is kept for 24 months from our last contact with you, then deleted. If the enquiry becomes a piece of work, the related records are kept for 6 years after it ends, because tax and contract law expect that. Technical logs are kept for 90 days. Mailing list entries are kept until you unsubscribe.

If you ask us to delete data we hold about you, we will do so within one month unless we are required to keep it by law.

Where your data is held

Your data is stored in the United Kingdom or the European Economic Area (our database, run by Supabase).

On its way there, some of it is processed outside the UK:

• Netlify runs the code that receives our website forms. It runs in the United States (Ohio). Netlify’s data processing terms include the EU Standard Contractual Clauses with the ICO’s UK International Data Transfer Addendum.
• Cloudflare carries all traffic to this website through its worldwide network, so a request may pass through servers outside the UK. Cloudflare relies on the UK Extension to the EU–US Data Privacy Framework, with the Standard Contractual Clauses and UK Addendum in its data processing terms as a fallback.
• Anthropic may process an enquiry in the United States. That is a restricted transfer, and we rely on the ICO’s International Data Transfer Addendum to the EU Standard Contractual Clauses as the safeguard, together with a transfer risk assessment.

If we change where any of this happens, we will update this page.

Your rights

You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, to receive it in a portable format, or to object to our use of it. Where we rely on consent, you can withdraw it at any time. We do not make any decision about you by automated means alone.

Email privacy@psastudio.org and we will reply within one month. If the request is complex we may extend that by up to two further months and will tell you why.

If you are not happy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to put things right first.

Cookies

We use only what is strictly necessary to keep the site working and secure. We do not use advertising, analytics or tracking cookies. Our visit counter, Cloudflare Web Analytics, works without cookies. Cloudflare Turnstile, the bot check on our forms, may store a small amount of data needed for that check. Because all of this is strictly necessary or cookie-free, we do not show a cookie banner and there is nothing here for you to opt out of.

Our fonts are served from this website, not from a third party.

Changes

If we change this policy we will update the date at the top. If the change is significant we will tell you directly.

Contact

Paul Smith Agentics, trading as PSA Studio — run by Paul Smith, sole trader, Kilbirnie, Ayrshire, Scotland
privacy@psastudio.org