Legal

What we do with your information.

Most of this site never asks you for anything. Where it does — an enquiry, an account, a visit counted — here is exactly what happens to it, for how long, and who else is involved.

Last updated 25 September 2026

Who we are

This site is run by MBSD Studio Limited, a company registered in England and Wales under number 17474371. Our registered office is Unit 29 Highcroft Industrial Estate, Enterprise Road, Horndean, Waterlooville, PO8 0BT, United Kingdom.

For anything in this notice — a question, a request, or a complaint — write to hello@mbsd.studio. A person reads it.

In data protection terms we are the controller for the information described here. That means the decisions about what is collected and why are ours, and so is the responsibility for them.

The short version

If you send us an enquiry, we keep it so we can reply and so we remember the conversation. That is the main thing we hold.
The Toolbox and the prompt library run in your browser. What you type into them never reaches our servers — not the business details, not the Wi-Fi password, not the photo.
On the AI Toolbox we count how often each tool is visited and used. The count is anonymous: no cookie, nothing that identifies you, and nothing you type.
We keep our own record of which pages are visited, and of a few things people do — sending an enquiry, copying a prompt. It never includes what you type, and saying no to the cookie question stops it.
We count visits with Google Analytics, but only if you agree to it first. Saying no costs you nothing.
We do not sell anything to anybody, we do not run advertising, and there are no third-party trackers embedded in these pages.

What we collect, and why

Each row below is a separate purpose with its own justification and its own clock. Nothing is kept simply because it was easier not to delete it.

What	Why	Lawful basis	Kept for
Enquiries	Your name, email address, business name, what you are interested in and your message — so we can reply and pick the conversation up later.	Legitimate interests: answering someone who has asked us a question, and running a business that remembers its own conversations.	2 years
Enquiry metadata	The IP address and browser identification string the message arrived with, used to spot spam and abuse of the form.	Legitimate interests: keeping the form usable and the inbox clear.	90 days, then erased from the record while the enquiry itself stays
Accounts	Your name, email address, an encrypted form of your password, and — if you turn them on — two-factor and passkey credentials.	Performance of a contract: we cannot give you an account without them.	Until you close the account, or 2 years after you last signed in
Signing in with Google or GitHub	The provider's identifier for you, plus the name and email address they pass us. We never receive your password for that account.	Performance of a contract: it is the method of signing in you chose.	For as long as the connection is in place — you can disconnect it at any time
Server logs	IP address, the page requested and when. Used to diagnose faults and to spot attacks.	Legitimate interests: keeping the site up and secure.	30 days
Site usage logs	Which page was requested, when, how long it took, the page you came from, your browser identification string, a random visit id and a scrambled form of your IP address that cannot be turned back into it. Never the address itself, and never a search or anything else in the web address after the page.	Legitimate interests: understanding how the site is used so it can be improved. Covered by the statistics exception in the cookie rules, so no consent is asked for — but saying no to the cookie question stops it.	3 months
Usage events	A handful of deliberate actions: that an enquiry was sent (what it was about and which form, not who sent it), that the site sent an email (what kind, not to whom), and that a prompt was copied or opened in an AI tool (which prompt and which tool, never what it said).	Legitimate interests: knowing which parts of the site people actually use. Saying no to the cookie question stops the ones your browser reports.	2 years
AI Toolbox usage counts	How many times each AI Toolbox tool was visited and used, per day. Only totals are kept — no IP address, no browser details, nothing that identifies a visitor and nothing typed into a tool.	Not personal data. It is how the experiment finds out whether anyone uses what gets built.	Indefinitely — the totals are part of the published experiment
Analytics	Which pages are read, roughly where in the world from, and on what sort of device. Through Google Analytics.	Consent. Nothing is collected until you agree, and you can change your mind at any time.	14 months

Enquiries

Why: Your name, email address, business name, what you are interested in and your message — so we can reply and pick the conversation up later.
Lawful basis: Legitimate interests: answering someone who has asked us a question, and running a business that remembers its own conversations.
Kept for: 2 years

Enquiry metadata

Why: The IP address and browser identification string the message arrived with, used to spot spam and abuse of the form.
Lawful basis: Legitimate interests: keeping the form usable and the inbox clear.
Kept for: 90 days, then erased from the record while the enquiry itself stays

Accounts

Why: Your name, email address, an encrypted form of your password, and — if you turn them on — two-factor and passkey credentials.
Lawful basis: Performance of a contract: we cannot give you an account without them.
Kept for: Until you close the account, or 2 years after you last signed in

Signing in with Google or GitHub

Why: The provider's identifier for you, plus the name and email address they pass us. We never receive your password for that account.
Lawful basis: Performance of a contract: it is the method of signing in you chose.
Kept for: For as long as the connection is in place — you can disconnect it at any time

Server logs

Why: IP address, the page requested and when. Used to diagnose faults and to spot attacks.
Lawful basis: Legitimate interests: keeping the site up and secure.
Kept for: 30 days

Site usage logs

Why: Which page was requested, when, how long it took, the page you came from, your browser identification string, a random visit id and a scrambled form of your IP address that cannot be turned back into it. Never the address itself, and never a search or anything else in the web address after the page.
Lawful basis: Legitimate interests: understanding how the site is used so it can be improved. Covered by the statistics exception in the cookie rules, so no consent is asked for — but saying no to the cookie question stops it.
Kept for: 3 months

Usage events

Why: A handful of deliberate actions: that an enquiry was sent (what it was about and which form, not who sent it), that the site sent an email (what kind, not to whom), and that a prompt was copied or opened in an AI tool (which prompt and which tool, never what it said).
Lawful basis: Legitimate interests: knowing which parts of the site people actually use. Saying no to the cookie question stops the ones your browser reports.
Kept for: 2 years

AI Toolbox usage counts

Why: How many times each AI Toolbox tool was visited and used, per day. Only totals are kept — no IP address, no browser details, nothing that identifies a visitor and nothing typed into a tool.
Lawful basis: Not personal data. It is how the experiment finds out whether anyone uses what gets built.
Kept for: Indefinitely — the totals are part of the published experiment

Analytics

Why: Which pages are read, roughly where in the world from, and on what sort of device. Through Google Analytics.
Lawful basis: Consent. Nothing is collected until you agree, and you can change your mind at any time.
Kept for: 14 months

These periods are enforced, not aspirational

A scheduled job runs every night and applies them. It is the same configuration this page is written from, so what you read here is what the database actually does.

Where we rely on legitimate interests, you have the right to object — see your rights below.

What we don't collect

This section is longer than it needs to be because it is the part people reasonably assume is untrue.

The Toolbox. Every tool on this site runs entirely inside your browser. The Wi-Fi password you turn into a QR code, the photo you strip the location data out of, the dates you compare — none of it is uploaded, and none of it is stored by us. You could disconnect from the internet after the page loads and the tools would still work.

The prompt library. When you fill in a prompt, the server sends you the template with the gaps still in it and your browser fills them in. What you write about your business is assembled on your own machine and copied to your clipboard. It is never submitted to us, so there is no version of it for us to keep, lose or be asked to hand over. We do note that a prompt was copied, and which one — not a word of what it said.

We also cannot see what you do next

Once a prompt is on your clipboard and you paste it into ChatGPT, Claude, Gemini or anything else, you are in that company's hands and their privacy policy applies, not ours. We have no visibility of it — which also means we cannot help if something sensitive goes into a tool that trains on its input. Read their terms before you paste anything confidential.

We do not build profiles, make automated decisions about you, or do anything that would count as profiling under UK data protection law.

Cookies

Two kinds, and the difference matters: the ones the site cannot work without, and the ones we have to ask about.

Cookie	What it does	Consent needed?
mbsd_session	Keeps you signed in and remembers a form between pages. Expires when you leave or after a period of inactivity.	No — the site cannot function without it, which is the exemption in the regulations.
XSRF-TOKEN	Protects forms against being submitted from another site on your behalf.	No — it is a security measure, and part of delivering the page you asked for.
mbsd-consent	Your answer to the cookie question, so we stop asking — kept in your browser, and also as a cookie so our server can honour a "no". It holds one word.	No — it exists only to record a choice you made.
mbsd_visit	A random id, so our own logs can tell one person reading three pages from three people reading one. It says nothing about you and expires after 30 days.	No — first-party statistics, which the rules allow without asking. Say no to the cookie question and it is deleted and not set again.
mbsd-ai-toolbox	The last day you used each AI Toolbox tool, so a return visit can be counted. Stored in your browser and never sent to us — the count is all that arrives. Not set if you have said no to cookies.	No — anonymous statistics for improving the site, and saying no to the cookie question switches it off.
_ga, _ga_*	Google Analytics. Recognises a returning browser so a visit is counted once rather than twice.	Yes. Nothing is loaded until you say yes, and the script is not on the page before then.

mbsd_session

What it does: Keeps you signed in and remembers a form between pages. Expires when you leave or after a period of inactivity.
Consent needed?: No — the site cannot function without it, which is the exemption in the regulations.

XSRF-TOKEN

What it does: Protects forms against being submitted from another site on your behalf.
Consent needed?: No — it is a security measure, and part of delivering the page you asked for.

mbsd-consent

What it does: Your answer to the cookie question, so we stop asking — kept in your browser, and also as a cookie so our server can honour a "no". It holds one word.
Consent needed?: No — it exists only to record a choice you made.

mbsd_visit

What it does: A random id, so our own logs can tell one person reading three pages from three people reading one. It says nothing about you and expires after 30 days.
Consent needed?: No — first-party statistics, which the rules allow without asking. Say no to the cookie question and it is deleted and not set again.

mbsd-ai-toolbox

What it does: The last day you used each AI Toolbox tool, so a return visit can be counted. Stored in your browser and never sent to us — the count is all that arrives. Not set if you have said no to cookies.
Consent needed?: No — anonymous statistics for improving the site, and saying no to the cookie question switches it off.

_ga, _ga_*

What it does: Google Analytics. Recognises a returning browser so a visit is counted once rather than twice.
Consent needed?: Yes. Nothing is loaded until you say yes, and the script is not on the page before then.

The analytics script is not merely disabled before you consent — it is not downloaded at all. If you say no, or close the banner without answering, your browser never contacts Google.

at any time. Withdrawing consent deletes the analytics cookies already in your browser and reloads the page without them.

Where it is held

The site, the database and the backups are in Amazon's London region. Enquiries and accounts do not leave the United Kingdom.

Google Analytics is the exception: data goes to Google in the United States. That transfer relies on the UK Extension to the EU–US Data Privacy Framework, under which Google is certified. It is also the one thing on this page that only happens if you have agreed to it — which is a reasonable thing to weigh when you answer the banner.

Your rights

Under UK data protection law you can ask us to do any of the following, and we will respond within one month:

See what we hold about you, and get a copy of it.
Correct it if it is wrong or incomplete.
Delete it. Where we hold it on the basis of legitimate interests or consent, we will, unless there is a legal reason we must keep it.
Restrict what we do with it while a question about it is being worked out.
Object to our relying on legitimate interests.
Take it elsewhere — receive it in a portable format, or have it sent to another provider.
Withdraw consent where consent is what we relied on. For cookies that is the button in the footer; it takes effect immediately and does not affect anything done beforehand.

Email hello@mbsd.studio and say what you would like. There is no form and no charge.

If we get it wrong

You can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk, or on 0303 123 1113. We would rather you came to us first so we can put it right, but you are not required to.

Changes to this notice

When this changes, the date at the top changes with it. If a change is significant — a new purpose, a new recipient, a longer retention period — we will say so plainly rather than quietly revising the page, and where consent was the basis we will ask again.

See also our terms of use, which cover what the tools and prompts are and are not promised to do.