Privacy notice

Last updated: 25 October 2026

Who we are

Mr Rhinehart trading as Rhinehart Studio (a sole trader based in Scotland, UK) is the controller of the personal data described here. Contact: [email protected].

This notice covers our services: the AI Ad Studio (rhinehartstudio.com/ads), Clip Studio (rhinehartstudio.com/clips), the UK Website Compliance Check (rhinehartstudio.com/sitecheck) the Compliance Monitor (rhinehartstudio.com/monitor), the Weekly Brief newsletter (rhinehartstudio.com/newsletter) and the Shop (rhinehartstudio.com/shop).

This website

This website sets no cookies and uses no analytics or tracking. Our hosting provider (Cloudflare) processes basic technical data such as IP addresses to deliver and protect the site.

What we hold: your email address; a record of your consent (the wording you agreed to, its version, the date and time, and the page you signed up on); a random confirmation/unsubscribe token; your subscription status and its history; and a one-way scrambled (salted hash) version of your IP address, used only to limit repeated sign-up attempts. We never store your raw IP address.

Why (lawful basis): your consent (UK GDPR Article 6(1)(a) and PECR regulation 22). We only send the Brief after you confirm by clicking the link in our confirmation email. You can withdraw consent at any time with the one-click unsubscribe link in every email, or by emailing us.

Where it's stored: Cloudflare Workers KV (Cloudflare is our website host). When we start sending through an email-sending service we'll name it here before the first send.

How long: while you're subscribed. If you never confirm, we delete the request after 30 days. After you unsubscribe we keep your email address marked "unsubscribed", with the consent and unsubscribe dates, for up to 2 years. This is so we never email you again by mistake and can show what you agreed to. Email us if you'd like it deleted sooner.

Shop orders

What we hold: your name, email, delivery address, the size and design you ordered, and payment status (card details are handled by Stripe; we never see full card numbers).

Why: to make and deliver your order and handle returns (contract, Article 6(1)(b)), and to keep tax records (legal obligation, Article 6(1)(c)), kept for 6 years.

Who prints and posts it: our print-on-demand partner (Printful) receives your name, delivery address and email to print and ship your tee, as our processor. Printful may print outside the UK (for example in the EU or US) and uses its own couriers; transfers rely on UK adequacy regulations or the UK International Data Transfer Addendum.

Business outreach

What we hold: company name, website, and the generic business email address published on your website (for example hello@ or info@), plus a record of our messages and any reply.

Where we got it: your company's own public website, and public information such as Companies House records and advertising libraries (for example the Meta Ad Library).

Why we hold it (lawful basis): legitimate interests (UK GDPR Article 6(1)(f)): offering a relevant business service to a company. We only email corporate addresses, we send no more than three messages, and every message lets you opt out.

How long we keep it: if you don't reply, we delete your details 90 days after our last message. If you opt out, we keep only your domain on a suppression list so that we never contact you again.

Customers

What we hold: your name, email, billing details (processed by Stripe; we never see full card numbers), and what you send us: for the AI Ad Studio, your brief and files; for the Compliance Check and Monitor, your website address and company number; for Clip Studio, the videos you send us and the transcripts we make from them.

Clip Studio videos: we transcribe your videos on our own computer (no third-party transcription service). We delete source videos and working files 30 days after delivery, or sooner if you ask. If your videos show other people, you are responsible for having their permission.

Why we hold it: to perform our contract with you (Article 6(1)(b)) and to meet our legal and tax obligations (Article 6(1)(c)). We keep these records for 6 years, as tax law requires.

Compliance Check and Monitor scans: we only scan pages that are publicly visible on your website. We don't log in or access any non-public systems.

Who we share data with

Stripe (payments), our email provider, Cloudflare (website hosting and newsletter sign-up storage), Printful (printing and posting shop orders), and the AI video providers used to render ads. We send AI video providers product images and prompts only, never personal data. Some of these providers process data outside the UK; where they do, they rely on UK adequacy regulations or the UK International Data Transfer Addendum.

Your rights

You have the right to access, correct, erase, restrict or object to our use of your data, including objecting to direct marketing at any time.

To use these rights, email [email protected] or reply "STOP" to any of our messages. You can also complain to the Information Commissioner's Office (ico.org.uk) or to your local data protection authority.