Privacy Policy

01Who this policy covers

This Privacy Policy explains how Zanderbrook Workshop handles personal information in connection with our website, project inquiries and remote creative production services. We are an AI ads creative studio established on September 30, 2026. Our services include AI UGC-style ads, video advertising, product visuals, static creatives and creative strategy. This policy applies to visitors, prospective clients, clients and people whose information is provided in a project with appropriate authorization.

The website operates on Shopify, and the information involved in a visit may depend on the store configuration, enabled features and services used for a particular project. This policy explains the relevant categories and purposes without requiring you to purchase a service. A separate written confidentiality or data-processing agreement may govern project material where one has been agreed.

02Information you provide

When discussing a project, you may provide your name, email address, brand or business name, selected service, project description and other information relevant to the work. Communications may include feedback, approval records, scheduling information and questions about a service. Please provide only information that is needed for the project.

If an engagement proceeds, business and billing records may include a billing address, invoice information, transaction reference, payment status and tax-related details when needed. Payment information handled directly by a payment provider is governed by that provider’s practices; please do not include full payment card numbers or bank passwords in a creative brief or ordinary correspondence.

03Project files and information about other people

A project may involve product photographs, footage, scripts, recordings, brand assets and other source material. Some material may contain names, images, voices or other personal information. Only provide such material when you have the necessary rights and permissions. Tell us before sharing sensitive or confidential information that requires special handling.

We do not need government identification numbers, medical records or similarly sensitive personal information to produce ordinary advertising creatives. If your project requires the use of a real person’s face or voice, clearly identify the person’s permission and the authorized use. Do not request an unauthorized impersonation or provide material obtained unlawfully.

04Technical information from a website visit

Website infrastructure may process technical information such as IP address, browser type, device characteristics, approximate location inferred from an IP address, page requests, referring pages, timestamps and error or security logs. This information can support page delivery, site reliability, fraud prevention and troubleshooting. Its availability depends on the hosting infrastructure and the features enabled for the visit.

Cookies and similar technologies may be used for essential site functions and, where enabled and permitted, preferences, analytics or advertising. The Cookie Policy describes these categories and the controls available to you. Optional tracking is subject to the applicable configuration and consent requirements; a general description of a category does not mean every technology in that category is installed.

05Why information is used

We use relevant information to discuss your requirements, prepare quotes, agree on scope, carry out creative production, review feedback, deliver files and maintain the business records associated with an engagement. It may also be used to answer questions, resolve service problems, manage approved payments and communicate material project or policy updates.

Technical information can be used to operate and protect the website, diagnose failures and understand its use where the relevant analytics are enabled lawfully. We may retain information needed to comply with legal obligations, prevent misuse, establish or defend a claim and document consent or permission. We do not use a project inquiry as blanket permission for unrelated promotional messages.

06Legal grounds where required

Where applicable law requires a legal basis, processing may be necessary to take steps you request before a contract, perform an engagement, comply with a legal obligation or pursue a legitimate business interest such as secure operations and handling service inquiries. We consider the nature of the information and your interests when relying on a legitimate interest.

Consent is used where required for optional cookies, certain marketing communications or other specified activities. You may withdraw consent for future processing without affecting processing that was lawful before the withdrawal. The applicable basis depends on the purpose, information and jurisdiction; these descriptions do not assert that every jurisdiction uses the same legal framework.

07Service providers and professional advisers

Information may be processed by providers needed for website hosting, communications, file storage, payment administration, accounting and creative production. Shopify supplies the commerce website infrastructure. Authorized contractors may access relevant project material when involved in the approved work. Access should be limited to what is needed for the particular task.

We may share information with professional advisers where needed for accounting, legal advice, insurance or a business dispute. We may also disclose information where required by law, a valid legal request or a necessary response to a serious security or rights concern. We do not publish your contact details merely because you request a quote.

08AI production tools

AI-assisted production may require processing selected images, scripts, recordings or other project inputs with third-party creative tools. The appropriate workflow depends on the deliverable and the confidentiality requirements agreed for the project. Do not include unnecessary personal or sensitive information in source files, and identify restrictions before the material is used in production.

A provider’s treatment of inputs and outputs depends on its service terms and the account or feature used. We do not make a blanket promise that every possible AI provider has identical retention or training practices. If a project requires specific restrictions, discuss them before providing the material so the workflow and provider choices can be agreed. We will not knowingly authorize unrelated public use of your confidential material.

09Marketing, sales and advertising disclosures

Service-related communications may be necessary to respond to a request or manage an engagement. Promotional email, if offered, is handled separately and subject to applicable consent and opt-out requirements. You may ask us to stop promotional communications while still receiving information necessary for an active project.

We do not sell project inquiry details as a business service. If optional advertising technology is enabled, certain transfers of technical identifiers may be classified as a sale, sharing or targeted advertising under some privacy laws. The applicable website configuration, notices and controls determine whether that activity occurs. You may exercise the rights available in your jurisdiction by contacting us or using the relevant privacy controls.

10Retention and deletion

We keep personal information for a period appropriate to its purpose, the status of an inquiry or engagement, applicable recordkeeping duties and any legitimate need to resolve a dispute. Accounting and transaction records may need to be kept longer than ordinary project correspondence. Project file retention may also be addressed in the written scope; digital delivery is not an indefinite archive service.

When information is no longer required, it should be deleted, anonymized or securely disposed of, subject to backups, legal holds and technical constraints. A deletion request may not remove records that must lawfully be retained, but retained information should be limited to the relevant purpose. Contact us if you need to discuss a project-specific retention restriction before production begins.

11Security and confidentiality

We use reasonable organizational and technical measures appropriate to the information and services involved. These may include restricted access, secure service accounts, appropriate transfer methods and controls over authorized project access. The measures required can differ between ordinary product assets and information requiring special handling.

No internet transmission or storage system is completely secure. Please avoid sending unnecessary sensitive information and tell us promptly if you believe information connected with a project has been exposed or used without authorization. Where an incident creates a legal notification obligation, we will address that obligation under the applicable requirements.

12International processing

Clients and service providers may be located in different countries, and website or production services may process information outside the country where you live. Privacy rules in those locations may differ. The service provider, tool and agreed project workflow determine the relevant processing locations.

Where applicable law requires a safeguard for an international transfer, the appropriate contractual or other lawful measure should be used. If location restrictions are important for your project, identify them before sharing source material so we can determine whether the required workflow is available.

13Your choices and privacy rights

Depending on your location and the applicable law, you may have rights to request access to personal information, correct inaccuracies, request deletion, obtain a portable copy, object to certain processing, restrict processing or withdraw consent. Some jurisdictions also provide rights concerning targeted advertising, certain disclosures and appeals of a privacy request decision.

To make a request, contact us using the details at the end of this policy and describe what you need. We may request proportionate information to verify your identity and authority before disclosing or changing records. We will respond within the period required by applicable law, explain any relevant limitation and provide an available appeal process where required. We do not discriminate against you for exercising a lawful privacy right.

If a legally recognized browser preference signal applies to the website activity and your jurisdiction, it should be handled according to applicable requirements. You may also control cookies through the relevant website preferences and browser settings. If you are dissatisfied with our handling of a request, you may contact the competent privacy authority where that option is available.

14Children and external services

Our services are intended for adults and business clients, and we do not knowingly solicit personal information from children for creative project inquiries. If you believe a child has provided information without appropriate authorization, contact us so the matter can be assessed and addressed.

Independent services used for payments, communications, file access or platform advertising may have their own privacy notices. This policy does not control their independent activities. Review the relevant notice when you choose to interact with such a service. We do not add a social account to a project or publish a personal profile simply because it is mentioned in a brief.

15Changes to this policy

We may update this policy when our services, providers, website configuration or legal obligations change. The last-updated date identifies the current version. Where required, we will provide additional notice or obtain consent for a material change rather than assuming that continued website use replaces a required choice.

Questions about information handling, project confidentiality or privacy requests can be sent to the contact below. Please identify the relevant inquiry or project, but do not include sensitive identification documents unless a secure and necessary verification method has been agreed.