Privacy notice.

1. Who is responsible for your information

Mira Content Studio is a trading name of Michael James, a sole trader established in the United Kingdom. We are the data controller for the personal information described here, which means we decide why and how it is processed.

Correspondence address: 245 Old St, London EC1V 9EY, United Kingdom
Email: hello@miracontent.studio

We are a creative studio. We produce product photography and finished social and ad imagery for direct-to-consumer brands, and deliver digital image files. Customers pay through Stripe and submit briefs through Tally. This notice covers our website at miracontent.studio, our services, and the emails we exchange with you.

2. The short version

• This website sets no cookies. No analytics, no advertising trackers, no third-party requests. That is why you see no cookie banner.
• We never see your card details. Those go to Stripe. We receive limited transaction information.
• Your reference photographs go to a generation provider. Google (Gemini / Google AI) processes them to produce your shoot. Section 6 sets out what that means.
• We do not ask for special category information, but photographs of people can contain it. Section 3 explains how we handle that.
• Project files are deleted 90 days after a shoot is complete.
• We do not sell your personal information, and we do not share it for advertising.

3. What we collect

What you give us.

• Your name and email address
• The brand, product, and project details in your brief, including deadlines and any approved wording or claims
• Reference files you upload, or a link to a folder you share with us
• Anything else you put in an email to us

What Stripe gives us. Payment confirmation, the checkout session reference, the amount and currency, your name and email, the card brand and last four digits, and the country of the card. We do not collect, see, or store your full card number, expiry date, or security code. Those are entered on Stripe’s own checkout page and handled entirely by Stripe. See stripe.com/privacy.

Special category information. We do not ask for information about health, ethnicity, religion, sexual orientation, or the other categories that data protection law treats as special, and you should not send it. But we should be straight with you about one thing: the photographs you upload may show people — you, a colleague, a model — and an image of a person can reveal characteristics that fall into those categories. Where that happens, we rely on your explicit consent, given when you choose to upload the photograph. Please send only what the shoot needs, and only photographs you have permission to share. These files are deleted with the rest of your project files under section 7.

We do not knowingly collect information from anyone under 18, and our services are not marketed to children.

4. Why we process it, and our lawful basis

Under the UK GDPR we have to have a lawful basis for each purpose. Ours are:

• Taking your booking, producing your shoot, sending first frames, handling your refinement round, and delivering the files. Lawful basis: performance of a contract with you.
• Emailing you about your booking — brief reminders, missing information, approval requests, delivery. Lawful basis: performance of a contract.
• Answering enquiries from people who have not booked. Lawful basis: legitimate interests — replying to someone who has contacted us.
• Processing photographs that contain special category information. Lawful basis: explicit consent, which you can withdraw at any time by emailing us.
• Keeping transaction and tax records. Lawful basis: legal obligation (UK tax and accounting requirements).
• Preventing fraud and keeping our systems and files secure. Lawful basis: legitimate interests — running the business safely.
• Showing finished work in our portfolio where your brand is named or a person is identifiable. Lawful basis: consent. We ask first, in writing, and you can say no or change your mind.

We do not use your information for automated decision-making or profiling, and we do not use it for advertising.

5. Who we share it with

We use a small number of providers to run the studio. Each one processes information on our instructions, under a contract.

• Stripe — payments and receipts. Established in Ireland and the United States. See stripe.com/privacy.
• Tally — the brief form and the files you upload with it. Established in Belgium, with data hosted in the EU. See tally.so/help/gdpr.
• Airtable — production tracking. Established in the United States. We keep creative notes and dates there; we do not copy your uploaded files into it. See airtable.com/company/privacy.
• Google Workspace — our email, private working-file storage, and final delivery. Established in the United States and Ireland. See policies.google.com/privacy.
• Google (Gemini / Google AI) — image generation. Section 6 covers this in detail.
• Cloudflare — hosting and domain for this website. See cloudflare.com/privacypolicy.

We may also share information where the law requires it, or in connection with a sale or transfer of the business. We do not sell your personal information, and we do not share it for cross-context behavioural advertising.

6. How AI generation works, and what it means for your files

Our deliverables are produced with AI image-generation models that we direct from your brief. That has a real consequence for your material, and you should know what it is.

What we send. To produce your shoot we send your reference photographs, product images, and the prompts we write from your brief to Google (Gemini / Google AI). If those photographs contain people, the images of those people are sent too.

What the provider does with it. Google processes the material to return generated images. Google may retain prompts and submitted material for a limited period for service operation and abuse monitoring, in line with its published terms. Whether submitted material may also be used to improve Google’s models depends on the plan and API configuration the material is processed under. We use the settings that exclude client material from model improvement where the provider offers that option. Google’s current terms are at policies.google.com/privacy.

What we will not claim. We do not train any model of our own on your material, and we do not sell or license it. We are not going to tell you that no provider anywhere could ever use submitted material for training, because that depends on terms we do not write. If you want the exact provider, plan, and setting that will apply to your shoot before you book, email us and we will tell you.

If this is not acceptable for a confidential or unreleased product, tell us before you upload anything and we will discuss what we can do.

7. How long we keep it

Reference files, working files, and delivered assets are deleted 90 days after a shoot is complete. Download and store your finished files before then.

Transaction records are kept for six years, because UK tax law requires it. Project records and email correspondence are kept only as long as we need them to run the business, handle a dispute, or meet a legal obligation, and are then deleted or anonymised.

Where information sits in a backup we cannot selectively edit, we isolate it from further processing until the backup expires.

8. Where your information goes

Some of our providers are established outside the United Kingdom, or process information on servers outside it. Tally hosts in the EU, which the UK recognises as providing an adequate level of protection. Stripe, Airtable, Google, and Cloudflare are United States companies.

Where information is transferred outside the UK to a country without a UK adequacy decision, we rely on the safeguards in that provider’s data processing terms — in practice the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU–US Data Privacy Framework where the provider is certified under it. Ask us and we will tell you which applies to a given provider.

9. Keeping it safe

Working files live in a private folder that is not shared. Only the delivery folder is shared, and for confidential or unreleased launches we restrict it to named email addresses rather than a link. Accounts are protected with strong, unique credentials and two-factor authentication where the provider supports it.

No transmission over the internet or storage system is completely secure, so we cannot guarantee absolute security. If a breach affects your information and is likely to be a risk to you, we will tell you, and we will report it to the ICO where the law requires.

10. Your rights

If you are in the UK or the EEA, you have the right to ask us for a copy of your personal information, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time; that does not affect anything we did before you withdrew it.

Email hello@miracontent.studio and we will respond within one month.

If you think we have handled your information unlawfully you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, or to your own supervisory authority if you are in the EEA. We would rather you told us first, so we can put it right.

11. If you are in the United States

Depending on your state, you may have the right to know what personal information we process, to get a copy of it, to correct inaccuracies, to have it deleted, and not to be discriminated against for exercising those rights.

We do not sell personal information, we do not share it for cross-context behavioural advertising, and we do not use it for targeted advertising or profiling. Use the same email address above to make a request. If we decline a request, you can appeal by replying to our response, and we will tell you in writing what we decide and why.

12. Cookies and tracking

This website sets no cookies, stores nothing in your browser, and makes no third-party requests. There is no analytics and no advertising technology on it.

One exception: the brief form on /start/thanks is a Tally form embedded in a frame. Tally may set cookies that are necessary to run the form. Stripe sends customers there after checkout, and we verify the checkout reference in Stripe before production begins.

Because we do not track you, there is nothing for a Do Not Track signal to switch off. If we ever add analytics, we will update this notice first.

13. Changes to this notice

We update this notice when our practices change. The current version is always at this URL, with the date at the top. If a change materially affects you, we will say so by email rather than quietly editing the page.

14. Contact

Questions, requests, or complaints about this notice go to hello@miracontent.studio, or by post to 245 Old St, London EC1V 9EY, United Kingdom.