How information is used to provide your service, protect your account and maintain the records connected with your order.
On this page — choose a section
Who is responsible
Baboor Studio is a trading name of Aris Kazan, a sole trader established in the United Kingdom.
Baboor Studio is the data controller for its business and customer information. This notice covers the website, account, orders, project materials, communications and associated service records.
Information connected with your service
- Account and contact information used for secure sign-in and correspondence.
- Your selected service, purchased scope, project details, product information and files you supply.
- Order progress, messages, requests, feedback, revisions, approvals and delivery records.
- Payment, invoice, cancellation and refund records associated with your order.
- Technical and security records needed to protect the service, and optional analytics only when permitted by your separate choice.
Bank details are not part of the normal order or refund workflow. If the original refund method fails or cannot be used, an authorised exception may require separate, secure collection.
Why information is processed
We use personal information for the purposes below. The lawful basis depends on the specific activity and our relationship with you.
| Purpose | Information used | Lawful basis |
|---|---|---|
| Respond to your service enquiries and take steps you request before an order | Contact details, enquiry correspondence and information needed to understand your requested service. | Contract — Article 6(1)(b) where you are the prospective customer. Legitimate interests — Article 6(1)(f) where you act on behalf of a business customer: communicating with that business and arranging the requested service. |
| Manage and deliver your order | Account and contact details, purchased scope, project materials, messages, feedback, approvals and delivery records. | Contract — Article 6(1)(b) where the contract is with you personally. For business representatives and other individuals involved in the project, legitimate interests — Article 6(1)(f): coordinating and delivering the business customer’s order. |
| Process payments, cancellations and refunds | Order references, transaction details, payment status and relevant cancellation or refund correspondence. | Contract — Article 6(1)(b) where necessary to fulfil our contract with you. Legitimate interests — Article 6(1)(f) where you represent a business customer: administering its payments and resolving payment issues. |
| Meet tax, accounting and other applicable legal requirements | Necessary invoice, transaction, financial and compliance records. | Legal obligation — Article 6(1)(c) where the information is required to comply with applicable UK law. |
| Protect accounts, files and the service | Sign-in, access, technical, security and relevant audit records. | Legitimate interests — Article 6(1)(f): protecting customer information, preventing misuse and maintaining a secure service. |
| Resolve disputes and establish, exercise or defend legal claims | Relevant order, payment, communication, approval and delivery evidence. | Legitimate interests — Article 6(1)(f): resolving disputes fairly and protecting our legal rights. Legal obligation — Article 6(1)(c) applies where disclosure or retention is required by law or a binding court order. |
| Measure use of the public website through optional analytics | Limited website usage information collected through Vercel Web Analytics when you enable it. | Consent — Article 6(1)(a). Optional analytics remains off unless you allow it through the cookie controls. |
| Send optional marketing emails or use your project for publicity | Contact details and preferences for marketing; specifically agreed project materials for a portfolio, case study or advertising. | Consent — Article 6(1)(a), obtained separately for the specified purpose. Purchasing a service does not provide this consent. |
Where we rely on legitimate interests, we consider whether the processing is necessary and balance those interests against your rights and reasonable expectations. You may object to processing based on legitimate interests by contacting legal@baboorstudio.com.
You can withdraw consent for optional analytics through Cookie Settings, unsubscribe from marketing emails through the unsubscribe link, or contact legal@baboorstudio.com to withdraw an optional publicity permission. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
Refusing or withdrawing optional consent does not affect your access to the service. Information necessary for your order, security or applicable legal obligations is processed under the relevant lawful basis above.
We do not use advertising trackers or remarketing tools. We do not use customer files or project materials to train AI models without separate, explicit permission.
Payments and Stripe
Payments take place through Stripe Hosted Checkout. The order retains the relevant payment and transaction records. Payment confirmation comes from the verified payment process; a browser return page is not proof of payment.
Service providers and recipients
The approved architecture identifies Stripe for payments, Supabase for account and order data, Vercel for hosting, and Resend for transactional email. The execution record also selects Sentry for monitoring, Cloudflare R2 for independent backup and private ClamAV on Google Cloud Run for file scanning.
Only the processing necessary for each provider’s contractual and technical role is intended. These selections are not evidence that every service is already active.
International processing
Processing outside the United Kingdom requires appropriate legal safeguards and transparent disclosure.
How long information is kept
Retention depends on the type of record. An archive is not deletion. Only the information needed for an ongoing financial or legal obligation, dispute, incident or legal hold is retained beyond the ordinary period.
| Record | Period and treatment |
|---|---|
| Source files and working files | Until 90 days after Closed, then deletion. |
| Final delivery files | Until 90 days after Closed, then deletion; recovery is not guaranteed. |
| Download availability | At least 30 days after delivery. A fresh link may be issued while the file remains available within its retention period. |
| Project details, messages, revisions and approvals | 24 months after Closed or Cancelled; delete or anonymise, except necessary financial or legal evidence. |
| Core order and financial records | At least five years after the relevant tax year’s 31 January filing deadline; secure retention while the applicable obligation continues. |
| Exceptional refund bank details | No more than 30 days after the refund is completed and confirmed; retain only the receipt and last four digits. |
| Order and sensitive-action audit logs | 24 months, unless needed for an incident, dispute, legal obligation or legal hold. |
| Ordinary login and security logs | 12 months. |
| Analytics data | At most 14 months; anonymised or aggregated where possible. |
| Inactive account without an open order | After 24 months of inactivity, with a deletion warning; required records remain separately protected. |
| One-time codes, reset tokens and signed links | Only until their technical expiry. |
| Backups | A rolling cycle of at most 35 days; expired copies are removed. |
| Unsuccessful checkout without an order | At most 12 months, unless subject to legal hold. |
| Cookie-choice evidence | For its validity period and 24 months after replacement or withdrawal, subject to legal hold. |
Security and access
Access to client and order information is restricted according to the authorised role and ownership of the order. Knowing an order reference does not grant access. Project files are private and subject to the approved access and file-security controls.
We use security and access controls to protect the service. No system can guarantee absolute security.
Your information requests
You can ask for access, correction, a copy of your information or deletion of information that can be deleted. Some financial or legal records and information under legal hold must be retained. Deleting an account does not immediately delete every record.
To make a request, contact Baboor at legal@baboorstudio.com.
Publicity, portfolio and AI training
Refusing that optional permission does not affect the price, quality or provision of the service. Acceptance of the contract does not provide that permission.
Cookies and optional marketing
Privacy is explained by this notice; it is not a blanket permission request. Cookie choices are separate and purpose-specific. Email marketing is optional and separate from both cookie choices and acceptance of the service contract.
Read the Cookie Policy for essential technologies, optional analytics and how choices can be changed.
Changes and related documents
Published versions will remain available as part of the relevant order record. A later document does not silently replace the version accepted for an existing order.
For the service contract, read the Terms of Service. For cancellation and refund handling, read the Cancellation & Refund Policy.
Contact
Questions about information handling can be directed to legal@baboorstudio.com.