Privacy Policy

This Privacy Policy explains how Maxwell Sullivan trading as Typeof Studio ("we", "us", "our") collects, uses, and protects personal data when you visit our website, get in touch with us, or engage us for services.

We are the data controller for the personal data described in this policy. Our contact email is [email protected]. We operate as a sole trader registered in England and Wales.

This policy should be read alongside our Cookie Policy, which covers cookies and similar tracking technologies in more detail, and our Terms & Conditions, which govern our services more broadly.

When you visit our website

We use PostHog to collect analytics about how visitors use our site, such as pages viewed, general location (derived from IP address), device and browser type, and interactions like button clicks. This helps us understand what’s working and improve the site.

When you get in touch

If you use our contact form, we collect the email address and message you provide. This is sent to a private Discord channel we use to receive and respond to enquiries. If you email us directly or use a mailto link, we receive whatever information you choose to include in that email.

When you engage us for a project

If you become a client, we collect the information necessary to deliver the work and manage the relationship: your name, email address, business details, project requirements, and any content, assets, or access credentials you provide. Where payment is involved, payment processing is handled by Stripe; we do not store your card details ourselves.

We use the personal data we collect for the following purposes:

• To respond to enquiries and correspond with you (legal basis: our legitimate interest in running our business, or steps taken at your request prior to entering a contract);
• To deliver services under an agreed engagement, including invoicing (legal basis: performance of a contract);
• To understand how our website is used and improve it (legal basis: legitimate interest, or consent where required for non-essential cookies — see our Cookie Policy);
• To comply with our legal and accounting obligations, such as tax record-keeping (legal basis: legal obligation).

We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects.

We share personal data with the following categories of third-party service providers, each acting as a data processor on our behalf, only to the extent necessary for the purposes above:

• PostHog — website analytics;
• Discord — receiving contact form submissions via a private webhook;
• Stripe — payment processing for invoiced work;
• Sanity — content management for our website (blog posts, case studies);
• Hosting providers (for example Railway or similar infrastructure) — running our website and, where agreed, client projects.

We do not sell your personal data. We will only disclose personal data to other third parties where required by law, to protect our legal rights, or with your consent.

Some of the third-party providers we use may store or process data outside the UK, including in the United States. Where this happens, we rely on the provider’s compliance with recognised transfer mechanisms, such as the UK’s international data transfer addendum to the EU Standard Contractual Clauses, or an equivalent adequacy arrangement, to ensure your data continues to receive an appropriate level of protection.

We keep personal data only for as long as necessary for the purposes it was collected for:

• Contact form and general enquiry data is kept for as long as needed to respond, and typically deleted or archived within 12 months if no engagement follows;
• Client and project data is kept for the duration of the engagement and for a reasonable period afterwards to handle any follow-up work, support, or disputes;
• Financial records, including invoices, are kept for at least 6 years to meet UK tax and accounting obligations;
• Website analytics data is retained according to PostHog’s standard retention settings for our account.

Under UK GDPR, you have the right to:

• Ask us what personal data we hold about you, and request a copy of it;
• Ask us to correct inaccurate or incomplete data;
• Ask us to delete your data, where there’s no good reason for us to keep it;
• Ask us to restrict or object to certain processing;
• Ask for your data to be provided to you or another provider in a portable format, where applicable;
• Withdraw consent at any time, where we rely on consent (for example, non-essential cookies).

To exercise any of these rights, email us at [email protected]. We’ll respond within one month, as required by law.

If you’re unhappy with how we’ve handled your data, you also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.

Our website uses cookies and similar technologies, including for analytics via PostHog. For full details on what cookies we use, why, and how to control them, see our Cookie Policy.

We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or misuse, including relying on reputable third-party providers who maintain their own security standards. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Our services are intended for businesses and adults. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. Any changes will be published on this page with an updated revision date.