Summary
- We collect only what you choose to send us: the details in our commission and contact form, your email address if you join our newsletter, and the information needed to invoice you if you become a client.
- We use that information to reply to you, carry out the work you ask for, send occasional studio updates you signed up for, and meet our tax and accounting obligations. Nothing else.
- We do not sell your data, we do not run analytics or advertising trackers, and we do not load third-party embeds. Our fonts and scripts are hosted on our own site.
- A few small items are kept in your own browser to remember your cookie-banner choice, the artworks you have liked, and your first name on the thank-you page. See our Cookie & Local Storage Policy.
- You can ask to see, correct, export or delete your data at any time by writing to [email protected].
This Privacy Policy explains what personal information Rizoron collects when you visit rizoron.com, contact us, sign up for our newsletter, or work with us on a commission or drawing lessons. It also explains why we collect it, how long we keep it, who (if anyone) we share it with, and the rights you have over it. We have tried to write it in plain language. If anything is unclear, please email us and we will happily explain.
This policy should be read together with our Terms of Service, our Cookie & Local Storage Policy and our Refund, Cancellation & Revision Policy.
1. Who we are
Rizoron (“we”, “us”, “our”) is an independent illustration studio. We create commissioned illustrations — including portraits, character design, book covers, badge design and concept art — and teach paid online drawing lessons. We also publish an art blog and keep an archive of earlier artwork on this website.
For the purposes of data protection law, including the EU and UK General Data Protection Regulation (GDPR), Rizoron is the controller of the personal information described in this policy. That means we decide why and how your information is used, and we are responsible for looking after it.
We work remotely with clients around the world and do not publish a physical address. The best and quickest way to reach us about anything in this policy is by email:
- Email: [email protected]
- Website: rizoron.com
We are a small studio, so we have not appointed a formal Data Protection Officer. Privacy questions are handled directly by the studio.
2. Information we collect
We keep data collection deliberately small. Most of what we hold is information you give us directly.
2.1 Commission and contact requests
When you use the request form on our Ask page, we collect:
- your name;
- your email address;
- the service you are interested in (for example a portrait, a book cover or drawing lessons);
- your budget range;
- your deadline, if you choose to give one (this field is optional);
- your project description, including any references or details you decide to include; and
- a record that you ticked the consent checkbox confirming you are happy for us to use your details to respond.
Please do not include sensitive information (such as health details or government ID numbers) in your project description. We do not need it to quote for artwork, and we would rather not hold it.
2.2 Newsletter sign-up
If you join our newsletter using the form in the website footer, we collect your email address. We may also keep a record of when you signed up, so that we can show you agreed to receive updates.
2.3 Client and lesson information
If you go on to commission artwork or book lessons, we will also hold the information needed to deliver the work and get paid. This typically includes:
- our email correspondence with you, including briefs, reference images, feedback and approvals;
- quotes, invoices and payment records (for example the amount, date and method of payment, and the name or email associated with the payment);
- a billing name and, where you provide one or tax rules require it, a billing address or business details; and
- for lessons, scheduling details such as preferred times and your time zone.
Payments are made against an invoice using methods such as PayPal or bank transfer. We never see or store your full card details. If you pay through a payment provider, that provider handles your financial information under its own privacy policy.
2.4 Information stored in your browser
Our website stores three small items in your own browser. They are not sent to us as part of normal browsing and are not used to track you:
- rz_cookie_consent (localStorage) — remembers the choice you made on our cookie banner;
- rz_likes (localStorage) — remembers which artworks you have “liked”, so the hearts stay filled in when you come back;
- rz_form_name (sessionStorage) — holds your first name briefly so the thank-you page can greet you after you send the form; it is cleared when you close the tab.
Full details are in our Cookie & Local Storage Policy.
2.5 Technical information
Like almost every website, the servers that deliver our pages may automatically record basic technical information in server logs when your browser requests a page — such as your IP address, the date and time, the page requested, and your browser type. This is a normal part of how the web works and helps keep the site secure and running. We do not use these logs to build profiles of visitors, and we do not combine them with the information you send us through our forms.
2.6 What we do not collect
- We do not use analytics tools, tracking pixels or advertising trackers.
- We do not load third-party embeds such as video players, social media widgets or comment systems.
- Our fonts and scripts are self-hosted, so viewing our pages does not send requests to font libraries or script networks run by other companies.
- We do not knowingly collect special-category data (for example information about health, religion or ethnicity).
3. How we use your information
We use personal information only for the purposes below:
- Replying to enquiries. We read your request, ask follow-up questions, and send you a quote or an answer.
- Delivering commissions and lessons. We use your brief, references and feedback to create your artwork, manage revision rounds, deliver files, and schedule and run lessons.
- Invoicing and bookkeeping. We issue invoices, record payments and keep accounting records as the law requires.
- Sending studio updates. If you have signed up, we send occasional emails about new work, open commission slots and studio news. We do not send these to people who have only made an enquiry unless they have also signed up.
- Keeping the website working and secure. We use basic technical information to diagnose problems and protect the site against abuse.
- Handling legal matters. Where necessary, we may use relevant records to establish, exercise or defend legal claims, or to respond to lawful requests from authorities.
We do not use your information for automated decision-making or profiling that has legal or similarly significant effects on you.
4. Legal bases for processing
If you are in the European Economic Area (EEA) or the United Kingdom, data protection law requires us to have a legal basis for each use of your personal information. The table below sets out the bases we rely on.
| Purpose | Information used | Legal basis |
|---|---|---|
| Responding to your commission or contact request | Form details, correspondence | Taking steps at your request before entering into a contract; and your consent given via the form checkbox |
| Creating artwork and running lessons | Brief, references, feedback, scheduling details | Performance of a contract with you |
| Invoicing and keeping accounts | Name, billing details, payment records | Compliance with legal obligations (tax and accounting); performance of a contract |
| Newsletter and studio updates | Email address, sign-up date | Your consent, which you can withdraw at any time |
| Website security and troubleshooting | Server log data | Our legitimate interests in running a secure, working website |
| Remembering your cookie choice and liked artworks | Browser storage items | Strictly necessary for features you request; see our Cookie & Local Storage Policy |
| Legal claims and requests from authorities | Relevant records | Our legitimate interests; compliance with legal obligations |
Where we rely on consent, you can withdraw it at any time by emailing us or, for the newsletter, by using the unsubscribe link in any email. Withdrawing consent does not affect anything we did lawfully before you withdrew it.
5. How we share information
We do not sell your personal information, and we do not share it for advertising. We only share it in the limited situations below:
- Service providers who help us operate. These include our website hosting provider, our email provider (which stores our correspondence and delivers form submissions and newsletters), and the payment services you choose to pay with, such as PayPal or your bank. They process data on our behalf or as independent services you use, and only as needed to provide their service.
- Professional advisers. Where needed, an accountant or legal adviser may see records relevant to their work, under a duty of confidentiality.
- Legal requirements. We may disclose information if required by law, regulation or a valid legal process, or to protect our rights, our clients or others from fraud or harm.
- With your permission. For example, if you ask us to send files directly to your publisher or printer.
Share buttons. Some pages have buttons for sharing artwork on X (Twitter), Facebook and Pinterest. These are plain links: no code from those platforms runs on our pages, and they receive nothing from us when you simply view a page. Only if you click a share button will your browser open that platform, which will then receive information under its own privacy policy.
Portfolio use. As explained in our Terms of Service, we may display finished commissions in our portfolio unless we have agreed a non-disclosure arrangement. We do not publish your name or contact details alongside your artwork without your permission.
6. International transfers
We work with clients worldwide, and the providers we use to host our website, store email and process payments may store or access data in countries other than your own, including countries outside the EEA and UK that may not offer the same level of legal protection.
Where personal information from the EEA or UK is transferred to such a country, we rely on appropriate safeguards recognised by law. Depending on the provider, this may be an adequacy decision covering the destination country, standard contractual clauses approved by the European Commission (or the UK equivalent), or another lawful transfer mechanism offered by that provider. You can contact us to ask for more information about the safeguards that apply.
7. How long we keep information
We keep personal information only for as long as we need it for the purposes in this policy, and then delete it or anonymise it.
| Type of information | How long we keep it |
|---|---|
| Enquiries that do not go ahead | Up to 24 months from our last contact, so we can pick up the conversation if you come back |
| Commission and lesson correspondence, briefs and files | For the duration of the project and up to 24 months afterwards, to handle follow-up questions, re-delivery of files and licence queries |
| Invoices and payment records | For as long as tax and accounting laws require — commonly between 5 and 10 years, depending on the rules that apply to us |
| Newsletter subscription | Until you unsubscribe. We then keep only your email address on a suppression list, so we do not email you again by mistake |
| Server logs | For a short period set by our hosting provider, typically a few weeks |
| Browser storage (rz_cookie_consent, rz_likes) | On your device until you clear your browser storage |
| Browser storage (rz_form_name) | On your device until you close the browser tab |
If you ask us to delete your data sooner, we will do so unless we are legally required to keep it (for example, invoices).
8. How we keep information secure
We take reasonable technical and organisational measures to protect your information. These include serving our website over an encrypted connection (HTTPS), using reputable providers for hosting, email and payments, protecting our accounts with strong passwords and two-factor authentication where available, keeping devices and software up to date, and limiting access to client information to the studio.
Because we do not store card details, the most sensitive financial information never reaches us. Even so, no method of transmission or storage is completely secure. If we become aware of a personal data breach that is likely to put your rights at risk, we will notify you and the relevant authorities where the law requires us to.
You can help too: please avoid sending passwords, ID documents or other sensitive information by email or through our forms.
9. Your rights (EU and UK)
If you are in the EEA or the UK, you have the following rights over your personal information:
- Access — ask for a copy of the information we hold about you.
- Rectification — ask us to correct information that is wrong or incomplete.
- Erasure — ask us to delete your information, where there is no good reason for us to keep it.
- Restriction — ask us to pause using your information, for example while we check its accuracy.
- Portability — ask for information you gave us in a commonly used, machine-readable format.
- Objection — object to processing based on our legitimate interests, and object at any time to direct marketing.
- Withdraw consent — where we rely on consent, withdraw it at any time.
You also have the right to complain to a data protection authority, such as the supervisory authority in the EU country where you live or work, or the Information Commissioner’s Office (ICO) in the UK. We would appreciate the chance to address your concerns first, so please get in touch. For a general overview of these rights, see gdpr.eu.
10. Your rights (California and other US states)
Privacy laws in California (the CCPA, as amended by the CPRA) and several other US states give residents rights over their personal information. Whether or not these laws formally apply to a studio of our size, we aim to honour the same principles for everyone.
- Categories we collect: identifiers (such as name and email address), commercial information (such as records of services purchased), the content of messages you send us, and limited internet activity information in server logs. The sources, purposes and recipients are described in sections 2, 3 and 5 above.
- No sale or sharing: we do not sell personal information and do not “share” it for cross-context behavioural advertising, as those terms are defined in California law. We have not done so in the past 12 months.
- Sensitive personal information: we do not intentionally collect it and do not use it to infer characteristics about you.
- Your rights: you can ask to know what personal information we have collected about you, to have it deleted, and to have it corrected. You also have the right not to be treated differently for exercising these rights.
To make a request, email [email protected]. You may use an authorised agent; we may ask for proof of their authority.
11. How to exercise your rights
Send your request to [email protected], ideally from the email address you used with us and with a short description of what you would like us to do. To protect you, we may ask for information to confirm your identity before acting, but we will only ask for what is reasonably necessary.
We aim to respond within one month (or within 45 days where US state law applies). If a request is particularly complex, we may need longer, and we will tell you why. Exercising your rights is free, unless a request is clearly unfounded or excessive.
Some information you can manage yourself: unsubscribe links are included in every newsletter, and you can clear the items stored in your browser at any time through your browser settings, as explained in our Cookie & Local Storage Policy.
12. Children’s privacy
Our website and services are not directed at children under 16, and we do not knowingly collect personal information from anyone under 16. If you are under 16, please do not send us your details through our forms or newsletter sign-up — ask a parent or guardian to contact us on your behalf.
If a parent or guardian wishes to arrange drawing lessons or a commission for a young person, the parent or guardian should make the enquiry, agree the terms and handle payment. If you believe a child has given us personal information without appropriate consent, please contact us and we will delete it.
13. Links to other websites
Our pages may link to other websites, such as the social platforms behind our share buttons or reference resources mentioned in our blog. We are not responsible for how those websites handle personal information. Please read their privacy policies before giving them your details.
14. Changes to this policy
We may update this Privacy Policy from time to time — for example, if we change how our forms work or begin using a new service provider. When we do, we will change the “last updated” date at the top of this page. If a change significantly affects how we use information you have already given us, we will take reasonable steps to let you know, such as emailing clients and newsletter subscribers.
15. Contact us
If you have questions about this policy or about your personal information, or if you would like to exercise any of your rights, please email [email protected]. For general questions about commissions, our commissions FAQ may already have the answer, and you can always reach us through the Ask page.