Privacy Policy

Last updated 19 August 2026

This Privacy Policy explains what personal data WOM STUDIO LTD ("we", "us") collects when you use the WOM Studio website, store and client portal, how we use it, and the rights you have. We are the "controller" of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018).

1. The information we collect

• Account details — your name, email address and (if given) company name. Your password is stored only as a secure one-way hash; we never see it.
• Orders & payments — what you bought, amounts, receipts and payment status. Card and bank details are handled by Revolut Business; we receive only a reference and limited details (such as the card brand and last four digits) to show and take payment.
• Automatic payments — if you set up automatic collection, we store a reference to the mandate held by Revolut Business, never your full card or bank details.
• Documents & signatures — agreements we share with you, and if you sign one, your electronic signature and details recorded at signing (such as the date, time and IP address).
• Usage & security data — log and activity records, including IP address, needed to run the Service and keep it secure.
• Analytics — if you accept analytics cookies, we record which pages you visited, how long for, how far you scrolled, the site you arrived from, and your browser, device and operating system. This is measured by our own software on our own servers; we do not use Google Analytics or any advertising network.
• Approximate location — if you accept analytics cookies, your IP address is sent to ip-api.com to derive a country and city. We store only that country and city, never the result against your identity. If you choose “Essential only” your IP is never sent anywhere.
• Cookies — a strictly necessary session cookie (see our Cookie Policy).

2. How and why we use it

We use your data to:

• provide the Service, your account, purchases and downloads — to perform our contract with you;
• take payment and manage payment plans — to perform our contract with you;
• deliver and manage custom work and the documents you sign — to perform our contract with you;
• keep the Service secure, prevent abuse and fix problems — our legitimate interest in running a safe service;
• understand how the site is used so we can improve it — your consent, which you can withdraw at any time;
• keep records we are legally required to keep, such as for tax and accounting — to meet a legal obligation;
• contact you about your orders, account or a change to these policies — contract / legitimate interest.

We do not use your data for advertising and we do not sell it.

3. Payment information

Payments are processed by Revolut Bank UK Ltd ("Revolut Business"), authorised by the Prudential Regulation Authority and regulated by the Financial Conduct Authority and the Prudential Regulation Authority. When you pay, your card or bank details are collected directly by Revolut Business on their secure systems — they do not pass through and are not stored on our servers. Revolut Business processes this data as an independent controller/processor under its own privacy notice.

4. Who we share it with

• Revolut Business — to take payments and manage saved payment methods.
• Our hosting and infrastructure providers — who store the data on our behalf under confidentiality obligations.
• ip-api.com — to turn an IP address into an approximate country and city, for visitors who accepted analytics cookies.
• Professional advisers (such as accountants) and authorities where we are required to by law.

5. International transfers

Some providers may process data outside the UK or EEA. Where they do, appropriate safeguards — such as the UK’s International Data Transfer Agreement or equivalent — are in place to protect your data.

6. How long we keep it

We keep account data while your account is active and for as long as we need it for the purposes above. Records we must keep for tax and accounting (such as invoices and receipts) are generally kept for at least six years. Signed agreements are kept for the life of the agreement and a reasonable period afterwards. When data is no longer needed, we delete or anonymise it.

7. Your rights

You have the right to access your data; to have it corrected or erased; to restrict or object to how we use it; to data portability; and to withdraw consent where we rely on it. To exercise a right, contact us using the details below. We will respond within the time limits set by law. You also have the right to complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk, though we’d appreciate the chance to help first.

8. Security

We protect your data with measures including encrypted (HTTPS) connections, hashed passwords, access controls and keeping card and bank data with Revolut Business rather than on our systems. No service can be completely secure, so we cannot guarantee absolute security.

9. Children

The Service is not directed at children under 16 and we do not knowingly collect their data. If you believe a child has given us personal data, contact us and we will remove it.

10. Changes

We may update this policy; the current version is always shown here with its "Last updated" date.

Contact us

Questions about this document? Get in touch with WOM STUDIO LTD:

• Email: billing@wom.studio
• Post: WOM STUDIO LTD
  Unit 20, Port Talbot Business Units
  Addison Road
  Port Talbot
  SA12 6HZ
• Company number: 17365933