1. Who we are
Imagiax (“Imagiax”, “we”, “us”) designs and builds websites, business automations, search (SEO) work and video for businesses. This policy explains how we handle personal information when you visit imagiax.com, contact us, become a client, use our client portal or pay us.
For that information we are the “controller” (in UK and EU terms) or the “business” (in US state privacy laws): we decide how and why it is used. When we build or run systems that handle our clients’ customers’ information, we act for the client instead; section 12 explains how that works.
Questions about this policy or your information: privacy@imagiax.com.
2. What we collect
Information you give us
- Project briefs and enquiries. Your name and email address, and if you choose to add them, your phone or WhatsApp number, business name, current website, the services you’re interested in, your goals, budget range, timing and anything you write about your project.
- Conversations. Emails, WhatsApp messages, calls and video meetings with us, including your contact details and what we discuss.
- Client portal account. We create your account with your name, email address and, if you give them, your phone number and business name. You set a password, which our sign-in provider stores in scrambled (hashed) form: we can’t read it.
- Project content. Messages, requests and answers, approvals, links and files you share with us in the portal or elsewhere. Please don’t send sensitive information (for example health or financial account details) unless we have agreed a safe way to handle it.
- Billing. Invoice details (what we’re billing, amounts, currency, due dates) and whether an invoice is paid.
Information collected automatically
- Server logs. Like any website, our hosting provider records technical details of each request (IP address, browser and device type, the page asked for, the referring page and the time) to keep the site secure and working.
- Privacy-friendly analytics. We count visits with Vercel Web Analytics, which does not use cookies and does not follow you across other websites or from day to day. It tells us things like which pages are viewed, which site sent the visit, and the country, device and browser type, in aggregate.
- Portal sign-in. When you sign in, our sign-in provider records the sign-in for security and keeps you signed in on that browser (see section 6).
Information from others
- Our payment processor tells us when a payment succeeds or fails. We never receive your full card number.
- People who refer you to us, and public sources such as your business website, when we prepare for a conversation with you.
Things we don’t collect
The example websites in our showcase are demonstrations. Anything you type into them (for example a newsletter box or a checkout) stays in your browser and is not sent to us or anyone else. We don’t buy personal data, and we don’t use advertising trackers.
3. How we use it, and our legal bases
We only use personal information for the purposes below. UK and EU law asks us to name a “legal basis” for each one, so we have.
| Purpose | Legal basis (UK/EU) |
|---|---|
| Replying to your enquiry and preparing a proposal or quote | Steps you asked for before a contract; our legitimate interest in answering people who contact us |
| Delivering your project, running the client portal and keeping in touch about the work | Performing our contract with you (or with your business) |
| Invoicing, taking payment, accounting and tax | Performing the contract; complying with legal obligations |
| Keeping the site, portal and files secure, and preventing spam, fraud and abuse | Our legitimate interest in protecting our clients, our systems and ourselves |
| Understanding how the site is used, in aggregate, so we can improve it | Our legitimate interest in running a useful website |
| Showing finished work in our portfolio (never your customers’ personal information) | Our legitimate interest in showing what we do; you can opt out (see our Terms) |
| Handling disputes, legal claims and requests from authorities | Legitimate interests; complying with legal obligations |
Where we rely on legitimate interests, we have weighed them against your rights, and you can object (section 9). We don’t send marketing newsletters. If that changes, we will ask for your consent where the law requires it, and every message will include a one-click way to stop.
Automated decisions and AI
We don’t make decisions about you that have legal or similarly significant effects by automated means alone. A person reads every brief. We don’t use your personal information or files to train AI models. If we use AI tools to help deliver a project (for example to draft copy), we use business services whose terms prevent them from training on your content, and we will tell you in your scope if a tool will process your project data.
5. Where your information is processed
We and our providers may process personal information in the United States and in other countries where we or they operate, including where members of our team work. When information about people in the UK, the European Economic Area or Switzerland is transferred to a country without an “adequacy” decision, we rely on recognised safeguards: the provider’s certification under the EU–U.S. Data Privacy Framework (and its UK and Swiss extensions), or the European Commission’s Standard Contractual Clauses with the UK International Data Transfer Addendum. Ask us at privacy@imagiax.com for more detail.
7. How long we keep it
We keep personal information only as long as we need it for the purposes above:
| Information | How long |
|---|---|
| Enquiries that don’t turn into a project | Up to 2 years after our last contact, then deleted |
| Client accounts, project records, portal messages and shared files | For the project, then up to 2 years after it ends (so you can come back to us), unless you ask us to delete them sooner |
| Invoices, payment and tax records | 7 years, because tax and accounting laws require it |
| Emails and WhatsApp conversations | As long as the related enquiry or project records above |
| Server logs | A short period set by our hosting provider, normally days or weeks |
| Analytics | Kept only as aggregate statistics, not profiles of individuals |
We may keep information longer where the law requires it, or where it is needed to establish, exercise or defend a legal claim, and only for as long as that lasts.
8. How we protect it
We use reasonable technical and organisational measures appropriate to the risk. Among them:
- Encryption in transit (HTTPS) everywhere on the site and portal.
- Access to client data limited to team members who need it, behind individual admin accounts.
- Portal files kept in private storage and only downloadable through links that expire after a minute.
- Checks on uploads (type and size) and limits that stop abuse.
- Established providers with their own security programmes.
No system is perfectly secure. If a breach affects your information, we will tell you and the relevant authorities when the law requires it.
9. Your rights and choices
Wherever you live, you can ask us to access the personal information we hold about you, correct it, delete it, or give you a copy to take elsewhere. We will help, subject only to the limits the law allows (for example, we must keep tax records).
UK, EEA and Switzerland
You also have the right to restrict how we use your information, to object to uses based on legitimate interests, to data portability, and to withdraw consent at any time where we rely on it. You can complain to your data protection authority (in the UK, the Information Commissioner’s Office at ico.org.uk), though we’d be grateful for the chance to put things right first.
United States
Residents of California, Colorado, Connecticut, Virginia, Texas, Oregon and other states with consumer privacy laws may have the right to know what personal information we collect, use and disclose; to access, correct and delete it; to receive a portable copy; and to opt out of its sale, “sharing”, targeted advertising or significant profiling. We don’t do any of those last four. We will never discriminate against you for using your rights.
Appeals. If we decline your request, you can appeal by replying to our decision or emailing privacy@imagiax.com with “Appeal” in the subject line. We will answer within the time your state’s law allows. If you’re still unhappy, you can contact your state Attorney General.
Authorised agents. Someone you authorise can make a request for you, with your signed permission, and we may still need to confirm your identity with you directly.
How to make a request
Email privacy@imagiax.com. To protect you, we will confirm your identity first, usually by asking you to reply from the email address we have on file. We answer within one month (UK/EU) or 45 days (US), and tell you if a complex request needs the extra time the law allows. Requests are free unless they are clearly unfounded or excessive.
10. More for California residents
In the last 12 months we have collected the following categories of personal information, from the sources and for the purposes described in sections 2 and 3, and disclosed each of them for business purposes only to the kinds of service providers listed in section 4. We have not sold or shared any of it.
| Category | Examples |
|---|---|
| Identifiers | Name, email address, phone number, IP address |
| Customer records | Name, contact details and billing information |
| Commercial information | Services you asked about or bought, invoices and payment status |
| Internet or network activity | Pages viewed and technical details of visits |
| Approximate location | Country or region worked out from an IP address (never precise location) |
| Professional information | Business name and your role |
| Audio, electronic and visual information | Messages, files and recordings of meetings, only if you share them or agree to a recording |
| Sensitive personal information | Portal sign-in details (email and password), used only to give you secure access |
We don’t use sensitive personal information to infer characteristics about you, so the right to limit its use doesn’t apply. Retention periods are in section 7. Under California’s “Shine the Light” law, you may ask whether we disclose personal information to third parties for their direct marketing: we don’t.
11. Children
Our services are for businesses, and this site is not directed to children. We don’t knowingly collect personal information from anyone under 16. If you think a child has sent us information, contact privacy@imagiax.com and we will delete it.
12. If we process data for a business you deal with
Many of the websites and automations we build handle the personal information of our clients’ customers: for example, an enquiry form, a booking reminder or an AI assistant on a client’s website. In those cases the client is in charge of that information (the “controller” or “business”), and we act only on their instructions as their “processor” or “service provider”, under our Data Processing Addendum.
That business’s own privacy policy explains how they use your information, and requests about it should go to them. If you contact us instead, we will pass your request on and help them answer it.
13. Other websites
Our site links to other services, such as WhatsApp, Instagram and Stripe’s payment pages. They have their own privacy policies, and we are not responsible for how they handle your information.
14. Changes to this policy
We will update this policy when our practices change, and change the effective date at the top. If a change is significant, we will tell active clients by email before it takes effect. Previous versions are available on request.
15. Contact us
Email privacy@imagiax.com. You can also reach us through the project form on our homepage or on WhatsApp. We read every message and reply as soon as we can, and always within the time limits the law sets.