Privacy Policy

Version 1.3 · last updated 21 October 2026

This policy explains how Removals Brain Studio ("we", "us") collects and uses personal data. Removals Brain Studio is operated by Adeel Riaz Mirza, who is the data controller. Contact: armirza01@gmail.com. We follow the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

What we collect

Quote form. Your company details, services, requirements and contact details (name, role, email, phone), your logo if you upload one, how you found us and, if you came from our demo, which demo link you used. While you fill the form in, we save your progress so you can come back; this includes a random code kept in your browser and a scrambled (hashed) version of your IP address.

Proposals. When you sign or decline a proposal online: your typed full name, job title and company, the date and time, your IP address, your browser's user agent and the version of the Terms of Service you agreed to. This is your electronic signature record.

Invoices and payments. The invoice details and the payments we receive (date, amount, method and payer name as shown by our payment provider).

Onboarding portal. Your company and contact details, notification email addresses, logo and brand colour, photo survey settings, website and hosting details, the temporary hosting access details you create for us (for example an FTP/SFTP user and a database user) and your Anthropic API key.

Review and support. Your approval (typed name, date and time, IP address, user agent), change requests, screenshots you upload and support messages.

Emails. A copy of each email we send you through our system and whether it was delivered.

Technical data. Your IP address and essential cookies: a session cookie and a security (CSRF) cookie. We do not use advertising or analytics cookies.

Why we use it, and our legal basis

To answer your quote request and prepare your proposal (steps before entering a contract).
To deliver your project: set-up, review, handover and support (performance of a contract).
To keep accounting records, signed proposals and invoices (legal obligation).
To keep our systems secure, prevent abuse and keep a record of what was agreed (legitimate interests).

We never use your data for automated decisions about you, and we do not sell it.

How we protect credentials and API keys

Hosting access details and your Anthropic API key are encrypted in our database. They are never included in emails, PDFs or logs. They are shown only to our administrator after re-entering the admin password, and every view is recorded. They are deleted automatically 7 days after your project goes live, or after a project is cancelled. We ask you to create temporary access for us and never to send your main hosting password.

Who we share it with

We use these processors, under contract, only to provide our service:

Hostinger for website hosting, our database and email.
Anthropic for AI processing in our public demo. In your own installation, the photo survey uses your own Anthropic account, and you are the controller of your customers' data.
Payoneer for receiving payments.

Some processors may handle data outside the UK, for example Anthropic in the United States. Where that happens, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or an adequacy decision.

Your customers' photos (the photo survey)

When we set up the photo survey for you, it runs on your own hosting with your own Anthropic account. You are the controller of your customers' data; we only process it while setting up and supporting your photo survey, on your instructions.

Where photos are stored. Only on your hosting. We do not copy them to our systems.
What is sent for analysis. Photos are sent to Anthropic's API using your own key, with the room name and item names. Your customer's name, contact details and address are not sent to Anthropic.
Other services the photo survey uses. Postcodes are checked with postcodes.io (UK mode). Emails with customer details are sent through your own email server. The dashboard font is loaded from fonts.bunny.net, which sees staff IP addresses.
Deleting. You can delete a survey and its photos permanently, one at a time or several at once, and you can switch on automatic deletion after a number of days. Copies in your hosting provider's backups are outside the photo survey's control.
Access. Everyone with a login to your photo survey dashboard can see all surveys.
Anthropic. How Anthropic handles data sent to its API is set by Anthropic's own commercial terms and privacy policy, which you accept when you create your account.

Our demo

Our demo runs on our own hosting with our own Anthropic account. Please use test photos, not a real customer's home. Public demo surveys and their photos are deleted after 24 hours. Personal demo photos are deleted 7 days after the demo expires.

How long we keep it

Quote requests that do not become a project: 24 months after your last contact with us.
Unfinished quote form progress: deleted automatically 60 days after you last used it.
Signed proposals, invoices and payment records: 6 years, for tax and accounting.
Hosting access details and API keys: deleted automatically 7 days after go-live or cancellation.
Onboarding answers, uploads, review and support messages: 12 months after your support period ends.
Email copies: 24 months.

Your rights

You can ask for a copy of your data, and ask us to correct it, delete it, restrict or object to how we use it, or move it to another service. Email armirza01@gmail.com. We reply within one month.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Changes to this policy

Each version of this policy has a number. We will update it when how we use data changes.