Privacy policy

Your privacy is important to us

It is LBD Studio’s policy to respect your privacy and comply with any applicable law and regulation regarding any personal information we may collect about you, including across our website, https://lbd.studio, and other sites, applications or subdomains we own and operate. This policy is effective as of 29 June 2021 and was last updated on 03 June 2026.

About this policy

LBD Studio (“we”, “us”, “our”) is committed to protecting your privacy.

This policy explains what personal information we collect, why, how we use and protect it, and your rights — across both our website (lbd.studio) and our client platform (the “app”, served at various subdomains of lbd.studio). This policy is written to meet our obligations under the UK GDPR and the Data Protection Act 2018.

1. Who we are

LBD Studio is a design studio registered in Scotland.

Company: LBD Studio, company no. SC628267
Registered address: 3 Hill Street, Edinburgh, EH2 3JP, United Kingdom
VAT no.: 333158615
Email: hello@lbd.studio
Phone: +44 (0)131 235 1055
ICO registration: 00011023624

We are the data controller for the personal information described in this policy. Where you upload other people’s personal information into the app (for example, a colleague’s email, or material relating to your own customers), you are responsible for having a lawful basis to share it with us, and we act on your instructions in respect of that material — see section 9.

2. The information we collect

On the website (lbd.studio)

Technical data your browser sends automatically: IP address, browser type and version, the pages you visit, timestamps, referring pages, and technical error details (server logs).
Information you give us when you contact us — for example, your name, email address, organisation and message via an enquiry form or by email.
Cookie data — see section 7.

In the app (client platform)

Identity and contact data: your name and email address, as added by a client or by us when setting up access.
Authentication and security data: we use passwordless “magic link” sign-in — we do not store passwords. We record your IP address and sign-in/session timestamps to keep accounts secure and detect misuse.
Content you provide: files you upload, responses you submit to forms, and names, descriptions and notes you add to projects.
Activity data: a log of key actions taken in the platform (for example, a file uploaded, an item submitted for review) used to keep you and us informed about the status of a project.

We do not use the app to build marketing profiles, and the app contains no advertising or third-party tracking cookies (section 7).

3. Why we use your information, and our lawful basis

We use your information for the purposes below. For each, the lawful basis under Article 6 of the UK GDPR is shown.

Providing the app and delivering services to you or the client you work with — sign-in, file requests, deliveries, trackers, forms and guidelines.

Lawful basis: contract, and our legitimate interests in running the service.

Keeping accounts and files secure, and preventing and investigating misuse — for example, recording IP and session data, and rate-limiting sign-ins.

Lawful basis: our legitimate interests in the security of our service.

Sending you service emails — sign-in links, and notifications about your projects.

Lawful basis: contract, and our legitimate interests.

Responding to enquiries you send us.

Lawful basis: our legitimate interests in responding to you.

Sending occasional studio updates or marketing, where you’ve asked for them.

Lawful basis: consent (which you can withdraw at any time).

Meeting our legal and accounting obligations.

Lawful basis: legal obligation.

Where we rely on legitimate interests, we’ve balanced those interests against your rights and freedoms.

4. Who we share it with (our processors)

We don’t sell your personal information. We use a small number of trusted service providers (“processors”) who handle data on our behalf, under contract, only as instructed:

Google — see section 7
Resend
Our website hosts

We may also disclose information to professional advisers or to law enforcement and regulators where we’re legally required to do so or to protect our rights.

5. International transfers

The app’s core data is stored in the UK (Google’s London region). However, some of our processors (for example, Resend and certain Google sub-processors) may process data outside the UK, including in the United States.

Where they do, we rely on appropriate safeguards recognised under UK data protection law — such as the UK International Data Transfer Agreement (IDTA) / the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision. You can ask us for details of the safeguards in place.

6. Data retention

We keep personal information only for as long as we need it:

Website enquiries: Up to 12 months after our last contact, unless they become a project.
App account data (names, emails): for as long as you have access to a project or client workspace, and for a reasonable period afterwards.
Files and project content: kept for the life of the project. Delivery (transfer) links default to expiring 30 days after they’re sent; files may remain in our managed Drive until we remove them as part of normal housekeeping.
Form responses: 3 months.
Sign-in / session data: session tokens are short-lived (they expire weekly), and expired records are automatically cleared; security logs are retained for 3 months.

We may keep some information longer where the law requires it (for example
for tax and accounting).

7. Cookies

In the app, we use a single strictly necessary cookie to keep you signed in (a secure, `httpOnly` session cookie). It’s essential to the service and isn’t used for tracking or advertising. The app does not run third-party analytics or advertising cookies.

On the website, we use strictly necessary cookies to make the site work and analytics cookies to understand how the site is used. Non-essential cookies are only set with your consent, via the cookie banner. You can control cookies through your browser settings and via the consent banner at the bottom of the page.

8. Your rights

Under UK data protection law, you have the right to:

access the personal information we hold about you;
ask us to correct information that’s inaccurate or incomplete;
ask us to erase your information (“right to be forgotten”);
restrict or object to how we use it;
portability — receive certain information in a usable format;
withdraw consent at any time, where we rely on consent (e.g. marketing);
complain to the Information Commissioner’s Office (ICO), the UK regulator — ico.org.uk, or 0303 123 1113.

To exercise any of these, email hello@lbd.studio. We’ll respond within one month. We’d appreciate the chance to put things right before you contact the ICO, but you’re entitled to do so at any time.

9. When you upload other people’s information

The app lets clients add colleagues and upload material. If you add someone else’s personal information (for example, inviting a colleague, or uploading files that contain personal data about your own customers), you confirm you have a lawful basis to share it with us. You’re responsible for telling those people how their information will be used. In respect of that material, we act as a processor on your instructions; you remain the controller.

10. How we protect your information

We take security seriously. Measures include passwordless sign-in with single-use links, encrypted connections (HTTPS), and access controls that limit each person to the projects they’re authorised for, rate-limiting and monitoring of sign-in attempts, and storing data with reputable providers.

No system is perfectly secure, but we work to protect your information and to respond quickly if anything goes wrong.

11. Children

Our website and app aren’t directed at children, and we don’t knowingly collect information about anyone under 16.

12. Changes to this policy

We may update this policy from time to time. We’ll update the “last updated” date above, and for significant changes, we’ll take reasonable steps to notify you.