Privacy Policy

Last updated: 11 October 2026

This policy explains how Flayr FX Limited collects, uses and protects personal data when you visit www.flayrfx.com, enquire about our production, post-production, strategy or podcast services, buy a digital product from our shop, pay an invoice, review or download work we have made for you, use our free video tools, join the Flayr Community, or subscribe to our updates.

1. Who we are

Flayr FX Limited is the data controller for the personal data described in this policy.

Flayr FX Limited
Registered in Scotland, company number SC682689
Registered office: 15 Glenorchy Terrace, Newington, Edinburgh, EH9 2DQ, Scotland
VAT registration number: 366694252
Registered with the Information Commissioner’s Office: ZB403112
Email: studio@flayrfx.com

We are not required to appoint a Data Protection Officer. Data protection questions should be sent to the email address above.

2. The personal data we collect

2.1 When you contact us or enquire about services

Through our contact forms and brand questionnaire, or by email or phone: your name, email address, telephone number, company or organisation, and whatever you choose to tell us about your project, budget and timescales. Each enquiry is saved with the page it came from, your IP address and browser type (to protect the form from spam), and is added to our client records so we can follow it up.

2.2 When you buy a digital product

Your name, billing address, email address, order details, purchase history, download activity, and the currency and amount paid. Card and payment details are entered directly into our payment providers’ systems — we never see or store your full card number. We receive only a confirmation of payment, the card type and the last four digits.

2.3 When you create an account

Your name, email address, password, order history and any details you add to your profile. Passwords you choose are stored only as a one-way hash, which nobody (including us) can turn back into the password.

When we set up a review account for a client, we choose the first password and keep an encrypted copy of it so that we can send it to you again if you lose it. That copy is deleted as soon as you change your password.

2.4 When you pay an invoice, or review and download your work

To pay an invoice online: your name, company, email address, the invoice number and amount, and your IP address. When you use a review or delivery link we send you, we record when files are viewed or downloaded and from which IP address, for security.

2.5 When we work with you on a project

Contract and correspondence records, contributor and crew details, call sheets, invoicing and payment records, and any personal data contained in material you supply to us or that we capture on your behalf, such as footage, stills, audio recordings and contributor release forms.

2.6 When you subscribe to marketing, or download our free resources

Your name and email address, plus records of which emails you opened or clicked, so we can tell what is useful and what is not. When you sign up through our newsletter form or tick the newsletter box on our contact form, we email you a link to confirm first, and our email provider keeps a record of when you agreed.

Some of our free resources (the unbranded production templates and broadcast clocks) are offered in exchange for joining our mailing list, and the form says so before you sign up. The branded versions are free with no sign-up, and you can unsubscribe at any time after downloading.

2.7 When you join the Flayr Community

Your display name, @name, any profile picture, banner and bio you add, and the Top Ten lists you publish. These are public: anyone can see them at your profile address. If you report a list, we keep the report and your IP address to deal with abuse. Community emails are optional and only sent if you tick the box for them.

2.8 When you use our free video tools

Our subtitle checker (SRT QC) can check subtitle text for spelling, grammar and timing. When you ask for those checks, the text of the subtitles is sent to Anthropic’s AI service to do the check. Transcription in the subtitle editor runs in your own browser: the speech model is downloaded from Hugging Face and jsDelivr, and your audio is not uploaded to us or to them.

2.9 Automatically, when you use the site

Your IP address, browser type and version, device and operating system, referring page, the pages you view and how long you spend on them, and similar technical data collected through cookies, server logs and analytics. See section 6.

We do not deliberately collect special category data (such as health, ethnicity or political opinions). If such data appears in production material you supply, we handle it only as needed to deliver the project and under the terms of our contract with you.

3. Why we use it, and our legal basis

What we do	Why	Legal basis
Respond to your enquiry and prepare a quote or proposal	To answer you and scope the work	Steps taken at your request before entering a contract; our legitimate interest in responding to business enquiries
Deliver production, post-production, strategy and podcast services	To perform the work you engaged us for	Performance of a contract
Process orders, deliver downloads and provide support	To supply what you bought	Performance of a contract
Manage your account	To let you access your orders and downloads	Performance of a contract
Take payment and prevent fraud	To get paid securely	Performance of a contract; our legitimate interest in preventing fraud
Keep accounting, tax and VAT records	Because we must	Legal obligation
Send marketing emails and updates	To tell you about our work and products	Your consent; or our legitimate interest in marketing similar products to existing customers, always with an opt-out
Run the Flayr Community and show members’ public lists	To provide the service you joined	Performance of a contract (our terms of use)
Check subtitles with AI when you ask for it	To provide the tool you are using	Performance of a contract; our legitimate interest in providing the tool
Measure how the site is used and improve it	To make the site work better	Your consent, given through the cookie banner
Protect the site from spam and abuse	To keep it secure and available	Our legitimate interest in site security
Show completed work in our portfolio and showreel	To demonstrate what we do	Our legitimate interest in promoting our business, subject to any confidentiality or embargo agreed with you
Establish, exercise or defend legal claims	To protect our position	Our legitimate interest in protecting our legal rights

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and concluded they are not. You may object at any time — see section 8.

4. Marketing

We send marketing emails only where you have opted in, or where you have bought from us and we are telling you about similar products, and you did not tick “Don’t email me” at checkout. We never send marketing to customers who ticked that box. Every marketing email carries an unsubscribe link, and you can also email studio@flayrfx.com at any time to be removed. Unsubscribing from marketing does not stop service messages such as order confirmations, download links and invoices.

5. Who we share your data with

We do not sell your personal data. We share it only with service providers who process it on our behalf under contract, and only as far as they need it:

Payment processing — Stripe, Inc., which handles card payments and fraud checks for the shop and for invoice payments.
Website hosting, email and backups — 123 Reg (part of the Host Europe group), which hosts the site, its database and our email on servers in France. Backups are kept, encrypted, on our own storage for up to 12 months.
Email delivery and marketing — Brevo (Sendinblue), which manages our mailing lists and sends our marketing email.
Analytics — Google, through Google Analytics, only where you have accepted analytics cookies.
Advertising — we advertise our shop products with Google Ads. If you have accepted analytics cookies and buy something, Google Analytics records the purchase (order number, products and amount, not your name or email address), and we link Analytics to Google Ads so we can see which adverts lead to sales. We do not use advertising cookies, remarketing or personalised adverts.
AI services — Anthropic, which provides the AI checks in our subtitle tool and helps us summarise project briefs. We use it under business terms that do not allow our data to be used to train its models. See our use of AI.
Accounting software — our online bookkeeping service, which holds invoice and payment records.
Embedded media and images — YouTube (Google) and Vimeo, only once you press play on a video; and The Movie Database (TMDB), whose servers supply the film posters on Community pages. See section 6.
Fortan software — sold through Paddle.com Market Limited as merchant of record; Paddle handles that purchase under its own privacy policy.
Accountants, bookkeepers and professional advisers — for tax, audit and legal purposes.
Production partners, crew and freelancers — where they are engaged on your project and need the information to do the work.

We may also disclose personal data where we are legally required to, or to establish or defend legal claims. If our business is sold or reorganised, data may transfer to the buyer under the same protections.

6. Cookies and similar technologies

Cookies are small files placed on your device. We use two kinds:

Functional — strictly necessary for the site to work, so they do not need consent:
- flayr_sid keeps your basket and protects our forms. For visitors who are not signed in it is deleted when you close your browser; after you sign in it lasts 30 days so you stay signed in.
- flayr_keep is set only when you sign in, and tells the site to keep you signed in (30 days).
- Your cookie choice and a few display preferences (such as closing the newsletter pop-up) are stored in your browser’s local storage, not sent to us.
Analytics — Google Analytics cookies, which help us understand which pages are visited and how people find and use the site, including whether a visit that came from one of our Google adverts ended in a purchase. Google Analytics does not store your full IP address, and we do not use it to show you personalised adverts.

Analytics cookies are set only if you choose Accept analytics on our cookie banner; if you reject them, or make no choice, Google Analytics does not load at all. You can change your mind at any time using Cookie settings at the foot of every page, and you can block or delete cookies through your browser settings — though blocking functional cookies will stop the shop and checkout working.

Videos from YouTube and Vimeo are shown as a still picture with a play button. Nothing is loaded from YouTube or Vimeo until you press play; we use YouTube’s privacy-enhanced mode and ask Vimeo not to track you. Once a video plays, those providers may set their own cookies and collect data about your viewing, under their own privacy policies. Film posters on Community pages are loaded from TMDB’s servers, which see your IP address in the same way as any website you visit.

7. Where your data is held, and for how long

Our website, database and email are hosted by 123 Reg on servers in France, in the European Economic Area, which the UK recognises as giving adequate protection. Some of our providers — including Stripe, Google, Anthropic and Brevo — process data outside the UK, including in the United States and the European Economic Area. Where data leaves the UK, we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate technical and organisational safeguards.

We keep personal data only as long as we need it:

Website enquiries — deleted automatically 2 years after the last update; enquiries that become projects are kept with the project records below.
Client and project records, contracts and correspondence — 6 years from the end of the engagement, to cover the limitation period for claims.
Orders, invoices and accounting records — 6 years from the end of the relevant accounting period, as required by HMRC and the Companies Act 2006.
Account details and Community profiles — for as long as your account is open, then deleted or anonymised within 12 months of closure, subject to the accounting retention above. To close your account, email us.
Marketing subscriptions — until you unsubscribe, then a minimal suppression record so we do not contact you again by mistake.
Production masters, rushes and project archives — for the period agreed in the relevant project contract; where nothing is agreed, we archive for 12 months after final delivery and then delete.
Website analytics — up to 14 months.
IP addresses and browser details stored with enquiries, orders and payments — removed automatically after 12 months. (The record of your agreement at checkout, including its time and IP address, is kept with the order.)
Activity, download and security logs — deleted automatically after 12 months.
Backups — up to 12 months, after which deleted data is gone from our backups too.

8. Your rights

Under UK data protection law you have the right to:

Be informed about how we use your data — this policy.
Access a copy of the personal data we hold about you.
Rectification of data that is inaccurate or incomplete.
Erasure of your data, where we no longer have grounds to keep it.
Restrict processing in certain circumstances.
Data portability — receive data you gave us in a structured, machine-readable format.
Object to processing based on legitimate interests, and to direct marketing at any time, with no exceptions.
Withdraw consent at any time, where we rely on it. This does not affect processing carried out before you withdrew.

To exercise any of these, email studio@flayrfx.com. We will respond within one month. We may ask you to confirm your identity first. There is normally no charge.

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.

9. Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can put it right. You also have the right to complain to the UK supervisory authority:

Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

10. Security

We use appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS), access controls, restricted administrative accounts and regular software updates. No system is completely secure, but we take these obligations seriously and will notify you and the ICO where we are legally required to do so following a personal data breach.

11. Children

Our website and products are intended for people aged 18 and over. We do not knowingly collect personal data from children. Where a project involves contributors under 18, we handle their data under the terms of the project contract and with appropriate parental or guardian consent.

12. Changes to this policy

We may update this policy as our business or the law changes. The date at the top shows when it was last revised. Where changes are significant, we will bring them to your attention.