How Moodboard Lab uses personal data

1. Controller and contact details

The controller is Jonathan Bassindale trading as Moodboard Lab, Bristol, United Kingdom.

For privacy questions or to exercise a data-protection right, email jonathan@moodboard-lab.com. Moodboard Lab has not appointed a data protection officer.

2. Information we collect

• Account data, including name, email address, user ID and authentication information.
• Billing data, including transaction, subscription, invoice and credit-ledger information.
• Content and project data, including prompts, uploads, selected materials, project details, generated images, renders, exports, favourites and shared-board information.
• Technical and usage data, including IP address, browser and device information, security identifiers, cookie choices, page and feature activity, timestamps, diagnostic events and logs.
• Communications, support enquiries, complaints, feedback and manufacturer submissions.
• Product-interaction data, recording which manufacturer products were viewed, added to a board, or had a datasheet or EPD opened, together with the time and a session identifier.
• Information received from providers such as Clerk and Stripe, including authentication status, payment status and subscription events. We do not receive or store your complete card number.

We collect information directly from you, automatically from your device and service use, and from providers involved in authentication, payments and service delivery.

3. Purposes and lawful bases

Our legitimate interests include keeping Moodboard Lab secure and reliable, preventing unpaid or abusive use, understanding faults and improving the product. We consider the necessity and impact of this processing and do not rely on legitimate interests where your rights override them.

4. AI processing and uploaded content

Depending on the feature, prompts, uploads and related instructions may be sent to Google's Gemini services to generate or analyse content. Do not upload sensitive personal data, confidential client information or identifiable people unless you have a valid legal basis and authority to do so.

AI features create design content; they are not used by Moodboard Lab to make solely automated decisions about you that produce legal or similarly significant effects.

5. Recipients and service providers

We disclose only the information reasonably needed to providers and recipients including:

• Microsoft Azure for application hosting, databases, file storage, monitoring and security;
• Clerk for identity, sign-in and account authentication;
• Stripe for checkout, payment processing, invoices, subscriptions and fraud prevention;
• Google for Gemini AI features and Google Analytics;
• manufacturers whose products appear in the catalogue, who receive product-interaction reporting in aggregate only — counts of how often their products were viewed, added to a board, or had a datasheet or EPD opened. This reporting never identifies you: it contains no name, email, account identifier or individual browsing history;
• a manufacturer you contact directly, which does receive the details you provide. If you submit a sample request or enquiry, the name, email address and any company, role, project or message you enter are sent to that manufacturer so it can reply. Only what you type in that form is shared;
• professional advisers, insurers, regulators, courts and law-enforcement bodies where necessary; and
• a buyer or successor if the business is reorganised or transferred, subject to appropriate safeguards.

We do not sell personal information. We do not authorise processors acting solely for Moodboard Lab to use it for their own marketing. A provider may act as a separate controller for a particular activity, such as payment fraud prevention, in which case its own privacy notice also applies.

6. International transfers

Some providers operate in the United States and other countries outside the United Kingdom, so personal data may be processed there. Where UK law requires a transfer safeguard, we use an applicable UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful safeguard, together with supplementary protections where appropriate.

Contact us if you would like information about the relevant safeguard for a particular provider. Some details may be redacted where necessary to protect confidential or security information.

7. Retention

• Account, project and stored-generation data is normally kept while your account is active and deleted or anonymised after account closure, subject to backups, legal obligations and unresolved disputes.
• Payment, credit-ledger, invoice and tax records are normally kept for up to six years after the relevant transaction or end of the relationship.
• Support and complaint records are normally kept for up to two years after the matter closes.
• Security, access and diagnostic logs are normally kept for up to 12 months.
• Product-interaction data is kept for 24 months and then deleted automatically. Aggregate reporting already provided to a manufacturer does not identify you and may be retained by them.
• Consent records are kept for as long as needed to demonstrate and respect your choice. Browser-stored preferences remain until they expire or you clear them.

We may retain information for longer where reasonably required by law, fraud prevention, a legal claim or a regulator. Backup copies are protected and removed through the normal backup-rotation process.

8. Cookies and analytics

Essential browser storage supports authentication, security, saved choices and core features. With your consent, Google Analytics helps us understand service use. We do not use advertising cookies or serve advertising. Non-essential analytics are off until consent is given.

Use the Cookie Settings link in the footer at any time to change or withdraw consent. Withdrawal does not affect processing that was lawful before withdrawal. You can also clear browser storage or use browser controls, although blocking essential storage may stop parts of the service working.

9. Your rights

Depending on the circumstances and lawful basis, you may have the right to:

• receive a copy of your personal data and information about its use;
• correct inaccurate or incomplete information;
• ask us to erase information or restrict its use;
• object to processing based on legitimate interests or for direct marketing;
• receive certain information in a portable format;
• withdraw consent at any time; and
• complain to the Information Commissioner's Office.

Email jonathan@moodboard-lab.com to exercise a right. We may ask for information needed to verify your identity. We normally respond within one month, subject to the extensions and exceptions permitted by law.

You can complain to the ICO through ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would appreciate the opportunity to address your concern first.

10. Security and children

We use proportionate technical and organisational measures, including encrypted connections, access controls, provider security features, monitoring and restricted administrative access. No online service is completely secure, so keep your account credentials confidential and contact us if you suspect misuse.

Moodboard Lab purchasing accounts are intended for people aged 18 or over. If you believe a child has provided personal data without appropriate authority, contact us so we can investigate.

11. Changes to this notice

We may update this notice when our providers, features or legal obligations change. We will post the new version and effective date here and give an additional notice where a change is material.