Legal

Your data

The question every owner asks before moving their jobs across, answered without the hedging. The careful version is the privacy policy; this is the honest summary of it.

Last updated 23 August 2026 HSH Design

The short version

Your artwork, customers and job history belong to you. We hold them to run the service, nothing else.
Never used to train a model. Never sold. Never mined for our commercial benefit.
Your shop is separated from every other shop in the database query itself, not in the page.
Your customers get a link, never an account, and never a marketing email from us.
Export or delete on request — no exit fee, no retention call, no questions.

It is your data, and that is a legal position, not a slogan

Everything you put into the platform stays yours. You own it, you decide what happens to it, and you can take it out or have it destroyed whenever you like. We hold it in order to run the service you are paying for, and we act on your instructions.

In data protection language you are the controller and we are the processor. That is not a technicality — it is the thing that makes every promise below enforceable rather than merely nice. It is written down as a contract in the data processing addendum, which we will sign.

You are the controller · we are the processor

The four things we will never do

Never train on it

Your artwork, proofs, customer names and job history are never used as training material for machine-learning models — ours or anyone else’s — and are never sent to a third-party model provider. There is no clause anywhere that lets us change our mind quietly.

Never sell or share it

Not to advertisers, not to data brokers, not to anyone else’s marketing. We have no advertising business to feed, which is the most reliable kind of assurance: there is nothing here that would profit from breaking the promise.

Never mine it for ourselves

We do not read your customer list for prospects, study your pricing to set ours, or aggregate your job data into something we sell to shops you compete with. Your commercial information is not our market research.

Never browse it out of curiosity

Staff open your content to do work you asked for, to fix a fault you reported, or where the law compels it. Access runs through a named login and lands in an activity log. There is no general-purpose “look at any tenant” view.

Your shop is kept apart from every other shop

Separation is enforced in the database query itself, scoped to the company asking, rather than by fetching everything and hiding the rows you should not see. The rows never leave the database in the first place, which is the difference between a design that is secure and one that is one template bug away from a leak.

Staff scoped to particular clients see those clients and nothing else, and an account with no assignment recorded gets no access rather than — as the easier implementation would have it — access to everything.

The mechanisms, with figures, are on the security page.

Enforced in the query · fails closed

Your customers never become our users

The person approving your proof gets a link, not an account. No sign-up, no password, no profile, no marketing list. We do not email them about anything except the proof in front of them, and we never contact them on our own behalf.

That is deliberate on two counts: an account we never create is a password that cannot leak, and your customer relationship stays yours rather than becoming a relationship with your supplier’s software.

No account · no marketing list

Leaving is a supported operation, not a negotiation

Ask for an export and you get your jobs, proofs, customer records and approval history in a format you can load somewhere else. Ask for deletion and live systems are cleared within 30 days; a deleted record can persist in a rolling backup until that backup expires within 90 days, which we state because a deletion promise with a silent backup exception is not one.

No exit fee, no retention call, no support agent asking why. We will not hold your data hostage to a renewal conversation, and we will not degrade the export to make leaving harder.

Export on request · 30 days to delete

The free tools cannot take your files even if we wanted them to

The five prepress tools run entirely in your browser. There is no upload endpoint in the code for those pages to post to — not a disabled one, not one behind a flag. The artwork cannot reach us because no route exists.

Open one with your browser’s network tab showing and watch nothing leave. That is the standard we would like to be judged by: claims you can check rather than adjectives you have to accept.

No endpoint exists

What to hold us to

A promise nobody can check is worth nothing, so here is how to test each of these:

Ask us to sign the data processing addendum. A supplier who will not put the no-training, no-selling commitment in a contract does not really have one.
Ask for an export before you need one, and see how long it takes.
Open the free tools with the network tab visible.
Read the security page and ask us about any figure on it. If we cannot point at the mechanism behind a claim, the claim should not be there.
Ask what happens when a government agency asks for your data. The answer is in the privacy policy, clause 8, and it is: tell you unless prohibited, give only what is compelled, challenge what is overbroad.

If any of this turns out not to be true, that is a serious problem and we would want to hear about it directly: hello@hshdesign.com.

Want this in writing before you commit?

We will sign the data processing addendum, and the standard contractual clauses with it if you are in the UK or the EEA.

Ask a question