Privacy policy

HSH Design is a design and print-production studio, operating from Pakistan. We run this website, a design and print-production studio, and the proofing platform at https://hshdesign.com/proof/.

Data protection law splits responsibility in two, and almost every question you have about your data depends on which half you are asking about. We are careful to keep them apart:

The second row is the one companies signing up actually want an answer on, so it has its own page — Your data — and its own contractual annex in the data processing addendum. This policy covers both, and where a clause only applies to one of them it says so.

These are commitments, not descriptions of current convenience. They apply to everything in the platform and to every file you send us for a job.

• We do not train anything on your data. Your artwork, your proofs, your customer names and your job history are never used as training material for machine-learning models, ours or anybody else’s, and they are never sent to a third-party model provider.
• We do not sell it, rent it or share it for anyone else’s marketing. There is no advertising business here to feed and no data broker relationship to disclose, because none exists.
• We do not mine it for our own commercial benefit. We do not read your customer lists to find prospects, we do not analyse your pricing to inform ours, and we do not aggregate your job data into a product we sell to your competitors.
• We do not look at your files because we felt like it. Studio staff access your content to do work you have asked for, to fix a fault you have reported, or where the law leaves us no choice. Access is tied to a named login and written to an activity log.
• We do not use the free prepress tools to collect anything. They have no upload endpoint in the code at all — see clause 4.
• We do not hold your card details, because the platform issues invoices and never takes a payment.

If we ever want to do something with your data that is not covered by this policy, the answer is to ask you first and to accept no as an answer — not to widen the policy and rely on you not re-reading it.

Very little, and less than most. There is no advertising pixel, no session recorder and no third-party tag of any kind. Loading a page here contacts no server but ours — the typefaces are served from this domain rather than from Google, which is the sort of thing that is easy to claim and easy to check with a browser’s network tab.

We do count page views, on our own server, without a cookie and without any JavaScript. The entire record is a date, a page address, an approximate place and a number, so it holds nothing that identifies you and nothing that could be joined back to you — see Cookies for exactly what is written, how the place is worked out without keeping your IP address, and what that rules out.

The full detail on cookies and storage is on the cookie notice. The summary is that this site sets no cookie at all for an ordinary visitor.

The five prepress tools — dimension marking, artwork resizing, print-file checking, cut-contour generation and logo vectorising — run entirely inside your own browser. Your file is read by your machine, processed by your machine, and gone when you close the tab.

This is not a promise about our conduct. There is no upload endpoint in the code for those pages to post to, so there is nothing to trust us about: the artwork cannot reach us because no path exists for it to travel down. You can confirm it by opening the tools with your browser’s network tab visible and watching nothing leave.

When your shop uses the platform, it holds what the work requires and what you put in:

• Account details for your logins — name, email address, role and scope. Passwords are stored as bcrypt hashes and are never recoverable, by us or anyone else.
• Two-factor codes sent to the email on the account, stored hashed, valid for ten minutes and dead after use.
• Trusted-device tokens, so a browser you have confirmed stops asking for a code. Random, held server-side against one user, http-only, expiring on their own after 45 days.
• Your jobs and artwork, your customer records, your proofs and their approval history, and your invoice records.
• An activity log of who did what, with owner-only and internal-only entries kept apart so a client login cannot read your staff’s trail or your commercial notes.
• Access tokens for any social account you choose to connect, encrypted at rest with a per-record initialisation vector.

Your customer approving a proof never gets an account. The approval link carries a token of sixteen random bytes and returns only the one proof it names — never a list, never another customer’s job. That means the person signing off your artwork has no password with us to lose.

The mechanisms behind all of this, with the actual figures, are set out on the security page.

Where you are in a place that requires us to name a lawful basis, these are ours:

We do not rely on consent for anything on this website, because we do not do anything here that requires it. There is no tracking to consent to.

A short list, and we would rather it stayed short. The current sub-processors are named in the data processing addendum, which is the document your procurement team will want.

• Our hosting provider, which necessarily stores the files and database on its servers. It has no permission to use the content for anything and does not do so.
• Email delivery, for the transactional messages the platform sends — a two-factor code, a proof notification, a password reset.
• Nobody else. There is no analytics vendor, no advertising network, no CRM sync, no data enrichment service and no model provider in this list, because we do not use any. The approximate location on our page counts is worked out against a table of address ranges sitting on our own server, downloaded once — not by asking anybody about you, so there is no recipient to name here.

We will not add a sub-processor that has access to customer content without saying so on the addendum page, and we will not add one at all where the same job can be done inside the platform.

If we receive a binding legal demand for customer content, our position is: tell you first unless we are legally prohibited from telling you, give only what the demand actually compels, and challenge one that is overbroad or improperly served rather than treating it as a mailing list request.

For data where you are the controller and we are the processor, we will redirect the requester to you wherever the law allows us to, because it is your data and the decision is yours to make.

The servers are in the United States (shared hosting, cPanel-managed, with the studio operating from Pakistan). The studio that operates the platform is in Pakistan, so staff there can access the systems in order to run and support them.

For a customer in the UK or the EEA, that means your data is processed outside your home jurisdiction on both legs, and we would rather you learned that here than worked it out later. Where a transfer mechanism is required we will enter into the standard contractual clauses — the UK International Data Transfer Addendum for UK customers, the European Commission’s SCCs for EEA customers — as part of the data processing addendum. Ask and we will sign them.

We are not going to claim an adequacy decision we do not have, or an audit we have not been through. If your procurement rules require data residency in a specific country, tell us at the start and we will tell you straight away whether we can meet it.

Some of these rights are legal entitlements in the UK, the EEA, California and a growing list of other places. Rather than working out which apply to you and offering the local minimum, we give the same set to everybody who deals with us:

• Ask what we hold about you, and get a copy.
• Get it in a portable form — your platform data exported in a format you can actually load somewhere else, not a screenshot.
• Correct it if it is wrong.
• Have it deleted, subject only to records the law requires us to keep.
• Object to a use you did not ask for, or withdraw a permission you gave.
• Get a human answer — no automated decision-making happens here, and there is no profiling to opt out of.

Write to hello@hshdesign.com and we will answer within 30 days. There is no charge. We will not ask you to justify the request or route you through a retention conversation.

If your data sits in the platform under your shop’s account and you are that shop’s customer or staff member, ask your shop first — they control it and we act on their instruction. We will help them answer you.

These sit on top of clause 11 rather than replacing it, and every visitor can read all of them. We publish one policy rather than switching text by IP address: a document that changes with the reader is one neither side can later prove the contents of.

The specific mechanisms, with real figures, are on the security page: two-factor sign-in on every account, per-tenant separation enforced in the SQL rather than in the page, upload folders that cannot execute anything, throttled sign-in attempts, and approval links that are unguessable rather than merely obscure.

What we do not claim: we have not been through a formal external audit, and we hold no certification. If that is a requirement for you, say so early and we will tell you plainly whether we can meet it rather than letting a procurement process run for three weeks first.

If you find a security problem, write to hello@hshdesign.com. We will not threaten you for reporting it.

If customer data is exposed, we will tell affected customers without undue delay and in any case within 72 hours of becoming aware, whether or not the law requires notification in your jurisdiction. The notice will say what happened, what data was involved, what we have done and what you should do.

We would rather send an awkward notice than a late one, and we will not wait for a complete picture before telling you something is wrong.

The date at the top of this page moves when the substance changes, not on every deploy.

If a change reduces your rights or widens what we do with your data, we will email account holders at least 30 days before it takes effect, and you can close your account and take your data with you before then. Corrections, clarifications and new detail take effect when published.

Privacy and data-protection questions go to hello@hshdesign.com and reach a person, not a ticket queue.

You can also call +1 (405) 346-9156, Mon–Fri, 09:00–17:30 PKT (UTC+5) — the studio works Pakistan time, so that is the window even though the number is a US one.

This policy is governed by the laws of the Islamic Republic of Pakistan. That does not take away a right your own country’s law gives you as a consumer.