Privacy notice

Who we are

Spitfire Creative Ltd is the controller of the personal information in this portal.We're registered in England and Wales (company no. 09069069), registered office Wiston House, 1 Wiston Avenue, Worthing, West Sussex BN14 7QL. Contact: scott@spitfirecreative.co.uk.

What we hold

• Your name, work email, job title, phone number and profile photo, if you add them.
• The organisation you work for and your role in the portal.
• What you send us through the portal: briefs, files, comments on proofs, messages, approvals and feedback.
• Sign-in records: when you last signed in, and whether two-step sign-in is set up.

Please don't upload personal data we don't need for the project, and particularly health or other special category data.

Why we use it

To run the projects we're doing for your organisation: quoting, producing and proofing artwork, recording approvals, delivering files and invoicing. Our lawful basis is our contract with your organisation and our legitimate interest in running those projects well. If you tick the box allowing us to quote your feedback as a testimonial, we use it on that basis only, credited the way you chose, and you can withdraw that permission at any time.

Who else sees it

Colleagues from your own organisation who use the portal see the jobs, comments and files for your organisation. We use a small number of service providers to run the portal, including Supabase for secure hosting, storage and sign-in, and Resend to send emails. They only process your information on our instructions. We share project material with suppliers such as printers only where the work needs it.

The greeting on your dashboard fetches a joke or quote from ZenQuotes or icanhazdadjoke. That request comes from our server and includes none of your information.

Cookies and storage

We use only what the portal needs to work: a sign-in cookie to keep you signed in, and your light or dark mode choice saved in your browser. There are no advertising or tracking cookies.

Keeping it safe

Every account uses two-step sign-in, access is limited to your own organisation's work, files are stored privately and shared through links that expire, and all traffic is encrypted.

How long we keep it

While your organisation works with us, and afterwards for as long as we need project and approval records for our legal, accounting and insurance obligations. If you leave your organisation, ask us and we'll remove your account.

Proofs, final artwork and the files you upload for a job are kept in the portal for six months after the job is completed. We email you a week before they're archived so you can download anything you need. After that they're removed from the portal; the job, its history and the approval record stay.

Your rights

Under UK data protection law you can ask for a copy of your information, ask us to correct or delete it, object to how we use it, or ask us to restrict it. Email us and we'll respond within a month. If you're unhappy with how we've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.