Privacy notice

Information we use

We use the account and contact details you provide to manage access, respond to inquiries and deliver agreed services. These may include your name, email address, organization, account membership and project contact details.

We use project briefs, brand materials, uploaded assets, creative files, comments, messages and version approvals to prepare and deliver your work. We record accepted proposals, orders, payment references and release decisions to manage billing, document instructions and resolve questions about the work.

Stripe handles payment details entered in its checkout. Direct to Desk keeps the transaction references and payment status needed to reconcile your order. Please avoid including unnecessary sensitive information in briefs, messages or uploaded files.

Our service also processes session and technical information needed for sign-in, fraud/bot prevention, security and reliable operation. A verification link expiring or account access ending does not itself erase the associated account or business records.

If you separately instruct us to process campaign recipient lists or survey responses, we will agree the purpose, necessary fields, permitted access, providers and retention arrangements before that work starts. Information about other people should be supplied only for the agreed purpose and with the appropriate authority. The current no-rewards creative-delivery scope does not require a recipient list or activate a recipient-facing campaign.

How information is shared

Information is available to authorized people working on your account or project and to service providers needed to operate the service. Current infrastructure uses Vercel for hosting, Supabase for accounts/database/private storage, Microsoft for account and project email, Cloudflare Turnstile for bot protection, and Stripe for checkout. Encrypted recovery copies may be retained locally and in our private GitHub recovery/backup storage.

Additional campaign providers are used only for separately agreed services. This notice does not authorize us to send a campaign, issue rewards, transfer print files or enable campaign automation. Access to project information is controlled by account and project permissions.

Retention and deletion requests

We retain information for the purposes needed to provide agreed services, maintain business records, protect accounts, resolve disputes and meet applicable obligations. We distinguish working files from the limited contract, approval and financial evidence that may need to be kept longer. Existing agreed delivery, access and retention terms take precedence over a general schedule.

You may contact directtodesk@artfullygraphic.com to ask about access, correction or deletion. We will verify the request and review what can be removed, what must be retained, and any provider or backup limitations. We do not currently offer a single action that erases an account and all related files, financial records, messages and backups. No automatic deletion schedule or fixed deletion-completion deadline is promised in this notice.

Backup copies can contain earlier versions of information. Some operational artifacts have an expiry, while separately retained recovery archives require additional review. A request to remove live data does not by itself remove every backup copy or rewrite immutable transaction and approval history.

Session and security technologies

We use technologies needed for account sessions, security, bot protection and payment processing. This notice does not grant permission for unrelated marketing or the unrestricted use of client or recipient information. Campaign-specific notices and permissions must match the actual campaign and providers.

Contact and changes

Contact Artfully Graphic at directtodesk@artfullygraphic.com with questions or requests. We will publish material changes on this page with an updated effective date.