Privacy Policy

1.0 Introduction

Red Stag Studio is operated by Robert Gloster, who is responsible for the personal information described here.

This policy explains how we collect, use, and protect personal information when you visit our site, enquire about a project, engage with our services, or when we review publicly available business information.

2.0 Data Collection

When you fill out a contact form or email us directly, we may collect your name, business contact details, message, and any project information you choose to provide.

When researching potential business customers, we may record a business name, publicly listed business contact details, the source page and date, brief observations about its website, and our contact history. We do not buy prospect lists.

In the website planning journey, selecting Let’s get started sends your email to Twenty and notifies the studio through Slack, even if you do not finish. We retain it as an incomplete enquiry so Rob can respond personally. This does not subscribe you to marketing. The full brief is sent only when you select Send my brief. Your answers are also saved in your current browser tab for up to 24 hours and are cleared after successful submission.

3.0 Usage Principles

We use enquiry and client information to assess requests, communicate about projects, and deliver our services. Optional logo uploads are stored privately in Vercel Blob when you choose a file. The submitted brief includes a private file reference so authorised studio staff and local Codex assistance can retrieve it to prepare your concepts. Uploading a logo does not submit your full brief; select Send my brief to do that. We retain uploaded logos only as long as needed for your enquiry or project and remove abandoned uploads during our storage review. We use limited public business information to assess whether our website service may be relevant and to avoid duplicate or unwanted contact. We do not sell personal information to third-party brokers.

Contact form submissions pass through a Vercel Function, which may process them in North America. Twenty is our enquiry and customer-context CRM. We retain earlier CRM and billing records in HubSpot during the migration. Slack notifies the studio and retains a recovery copy if CRM delivery fails. We use Gmail to send an acknowledgement of a completed website brief and manage replies. Historical prospect research and outreach evidence remain in a private local development CRM. Authorised Codex assistance may review CRM information to help us handle enquiries.

In the local development CRM, we remove uncontacted prospect records after 30 days and clear working notes about unanswered outreach 90 days after the last approach. We keep a limited do-not-contact record where needed to respect an objection or avoid repeat contact. We retain enquiry records in Twenty and earlier records in HubSpot and messages in Gmail and Slack only as long as needed to handle enquiries, deliver services, meet legal obligations, and maintain necessary business records, then delete or anonymise them where appropriate. Submitting an enquiry or saving an email does not create a marketing subscription.

4.0 Analytics & Cookies

If you allow analytics, we load Google Analytics and Vercel Web Analytics to understand how visitors use the website. Neither analytics service loads before you opt in.

With your analytics permission, Sentry also collects browser error types, code locations, page paths and a sample of page-load, navigation and web-performance timings to help us find faults and improve the site. Browser monitoring is off before consent and on private billing and CRM pages. It does not record sessions, form contents or screenshots, and does not set analytics cookies. We filter query strings, fragments, request bodies, cookies, headers and user identifiers before sending diagnostics.

Google Analytics may then collect page views, interaction events, approximate location, device and browser information, and referral details. It may use analytics cookies. Vercel Web Analytics processes page views without setting analytics cookies. We use their reports to improve the site, not to identify individual visitors.

With analytics permission, we keep the first and latest campaign labels, landing page, referring page and attribution times for your current browser tab. With advertising permission, we also preserve Google Ads click identifiers (gclid, gbraid and wbraid). We include the permitted information when you submit an enquiry to understand how you found us. We remove arbitrary URL query values and fragments. These session records end when the tab closes; withdrawing a category removes its information. You can submit an enquiry and optionally tell us how you heard about us without either permission.

If you allow both analytics and advertising, Google Analytics uses advertising click identifiers and completed-enquiry events to measure our campaigns in our linked Google Ads account. With both permissions, we may also send the advertising click identifier, qualification time and first collected payment amount to Google Ads to measure which campaigns lead to accepted customers. We do not send names, email addresses or brief answers with these events. Personalised advertising is disabled.

You can withdraw analytics permission using Cookie settings in the footer. The page reloads to stop previously loaded analytics and browser-monitoring scripts; browser-stored analytics cookies may remain until they expire or you clear them.

Our website-cost and managed-website guides show locally hosted video previews. A YouTube player loads only if you press play. At that point YouTube may receive information about your visit and use cookies under its own terms, independently of your analytics preference on this site. You can use the pages without playing a video.

5.0 Security Standards

For accepted projects, Stripe processes payment details, subscription billing and invoices. Card details and bank account information are entered on Stripe’s hosted checkout; we do not receive full card numbers or bank details. We retain proposal references, Stripe customer and subscription identifiers, invoice amounts and payment status to administer the contract and necessary financial records. Relevant billing information is linked to your customer record in Twenty so we can administer your service and follow up on payment issues. Processing may take place outside the EEA under the provider’s applicable data protection terms and transfer safeguards. Billing records are retained as needed to deliver the service and meet applicable record-keeping obligations. Contact Robert Gloster for information about the safeguards relevant to your data.

We use encrypted transport, principle-of-least-access internal workflows, and careful documentation handling to preserve the integrity of client and lead information.

We use Sentry to diagnose server failures and measure a sample of request timings, including failures in enquiry delivery and billing services. Server diagnostics operate independently of optional browser analytics on our legitimate interests in keeping the service reliable and secure. We retain error types, controlled failure codes, code locations, route names, response status and timings; we exclude enquiry answers, payment information, credentials, request and response bodies, and user identifiers. Sentry receives diagnostics as our processor in its European region. Its applicable data-processing terms cover any support access or transfers outside the EEA. Diagnostic records expire under Sentry’s retention settings; we remove records sooner if unnecessary or if personal data is identified. Contact us for the retention period or safeguards relevant to a particular record.

6.0 Your Rights

Under applicable data protection laws, including GDPR, you may request access to the information we hold about you, ask for corrections or erasure where applicable, and object to direct marketing at any time. If you object, we stop marketing contact and retain only the minimum information needed to respect that request.

You may also complain to the Irish Data Protection Commission if you believe your data protection rights have been infringed.