Storm Studios.

Privacy Policy

Last updated: 9 October 2026

This policy explains what personal data Storm Studios handles, why, and what choices you have. We have tried to write it in plain English. It covers this website, the proposals we share with clients, and our social media posting platform.

1. Who we are

Storm Studios is a trading name of INTELIGENCIA ARTIFICIAL LTD, registered in England and Wales, company number 15667932, with its registered office at Highdown House, 11 Highdown Road, Leamington Spa, Warwickshire, CV31 1XT. INTELIGENCIA ARTIFICIAL LTD is registered with the Information Commissioner's Office (registration number ZC160001) and is the controller of the personal data described in this policy. You can contact us at contact@storm-studios.co.uk.

2. This website and our client proposals

a. The contact form

If you use the contact form on our homepage, we collect your name, your email address and, if you write one, your message. These are stored on our server together with the time you sent them, and a notification email containing them is sent to us through our email provider (Resend). We use them only to reply to you and to keep a record of the enquiry.

b. Client proposals

We share proposals with clients as private web pages that need a password or an emailed link to open. When a proposal is opened we record the time, the IP address, which sections were viewed and roughly how long was spent on them, so that we know whether a proposal has been seen. If a proposal asks for details, for example a name or company details to accept it, or a choice between options, we store what the viewer enters. This information is visible only to us.

c. Proposal access emails

When we send someone access to a proposal we email them a private link. The recipient's email address and the email are handled by our email provider, Resend.

d. The assistant on some proposals

A small number of proposal pages include an optional assistant. If you use it, the questions you type are sent to Anthropic, which generates the answer. We also store the question, the answer, the time and your IP address.

e. Cookies

If you sign in to a proposal or to our admin area we set one strictly necessary session cookie to keep you signed in. It is HttpOnly, is sent only over HTTPS, and expires after 8 hours. Visiting the public pages of this website without signing in does not set any cookies. We do not use advertising cookies, third-party analytics or tracking pixels, and the public pages of this website (home, services, privacy and terms) load no third-party fonts or scripts. Our login page and some proposal pages load typefaces from Google Fonts, which means your browser sends a request, including your IP address, to Google when they load.

f. Server logs

Our web server records the IP address, browser details, the pages requested and the time of each request. We use these for security and abuse prevention and keep them for about two weeks.

3. Our social media posting platform

Our social media posting platform is a publishing tool for businesses and agencies that manage several brands, and it is currently in early access. This section describes the data it handles.

a. Authorization data from connected platforms

When an account owner connects a social account through a platform's official authorization screen, we receive and store:

  • the platform account identifier (the account's unique ID on that platform);
  • the display name or username and the avatar URL;
  • the scopes (permissions) that were granted;
  • OAuth access and refresh tokens, which are stored encrypted at rest.

We use this data only to publish content that the user has prepared. We never see or store the account owner's password for the platform.

b. Content you write or upload

Post text, images, videos, alt text, cover images and schedule times. We use this to prepare, check, store, schedule and publish your posts.

c. Team login

For team members who sign in to the posting platform: a username and a salted password hash (we do not store the password itself). We set one strictly necessary session cookie to keep you signed in. We do not use advertising cookies or analytics cookies.

d. Basic server logs

The posting platform's servers record IP address, user agent and timestamps of requests. We keep these for security and abuse prevention.

4. How we use data, and what we do not do

  • We do not sell personal data.
  • We do not use personal data for advertising, and we do not use data from connected social accounts to train AI models.
  • We do not post anything to a connected social account unless the user has prepared and approved it.
  • When AI-assisted text adaptation is enabled in the posting platform, the post text that the user wrote is sent to the AI provider solely to produce the adapted wording. Tokens, credentials and other account data are not sent.

5. Social platform access

We use each social platform's official login and publishing interfaces only to let the account owner publish content they have approved. Data received from a platform is used only for that purpose.

Each platform's own handling of your data is described in that platform's privacy policy. You can revoke our access at any time in the platform's own security or connected apps settings.

6. Other platforms

For every platform we support, the same principles apply: we use the access you grant only to publish content you have prepared and approved. Each platform lets you review and remove connected apps in its own account or security settings, and doing so revokes our access. Please see the platform's own privacy policy for how it handles your data.

7. Retention

  • Contact form enquiries and proposal records are kept for as long as we need them to respond to you, to run the proposal or project, and for our records. We delete them on request.
  • Web server logs for this website are kept for about two weeks.
  • Posting platform: platform tokens are deleted when an account is disconnected, or within 30 days of a deletion request; content is deleted when a client workspace is removed, or on request; server logs are kept for up to 90 days.

8. Sharing

We share data only with:

  • our hosting provider, DigitalOcean, which stores and processes data on our behalf in a data centre in London;
  • Resend, which sends and delivers the emails described in section 2;
  • Anthropic, only when someone uses the assistant on a proposal page, and only for the questions typed into it;
  • the social platforms themselves, at the user's direction, when a post is published or scheduled through the posting platform;
  • an AI text provider, only when AI-assisted adaptation is enabled in the posting platform and only for the post text, as described above.

We do not share personal data with any other third parties.

9. Security

This website is served over HTTPS. Proposals are private pages that need a password or an emailed link to open, and access to the data we hold is limited to authorized members of our team. In the posting platform, platform tokens are encrypted at rest. No system is perfectly secure, but we take reasonable steps to protect the data we hold.

10. International transfers

Our hosting provider stores data in the United Kingdom. Resend, Anthropic and the social platforms may process data in other countries, including the United States. Where personal data is transferred across borders, we rely on the safeguards available under applicable law, such as an adequacy decision or standard contractual clauses, where they apply. Contact us if you would like more information.

11. Your rights

Under the UK GDPR (and the GDPR, where it applies to you), you may have the right to access your personal data, have it corrected or deleted, restrict or object to its processing, and withdraw consent at any time. You also have the right to complain to the Information Commissioner's Office (ico.org.uk) or to your local data protection supervisory authority. To exercise any of these rights, email contact@storm-studios.co.uk.

12. Children

Our website and services are not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with data, please contact us and we will delete it.

13. Changes to this policy

We may update this policy from time to time. The "Last updated" date at the top shows when it last changed. If we make a material change, we will take reasonable steps to let connected account owners know.

14. Disconnecting and deleting your data

You can disconnect and ask us to delete your data at any time:

  1. Revoke our access in the platform itself (in the platform's security or connected apps settings).
  2. And/or email contact@storm-studios.co.uk from the email address associated with the account, with the subject "Data deletion request".

We will confirm your request and complete it within 30 days.