Privacy policy

1. Who we are

Mintsnimz Design Labs Ltd ("Mintsnimz", "we", "us") is the data controller for personal data processed through this website. We are registered in England and Wales under company number 14827365, with a registered office at Unit 7, Caldwell Works, 118 Rye Lane, London SE15 4ST, United Kingdom. Our data protection contact is reachable at [email protected].

2. What data we collect

• Data you give us. When you submit the brief form, we receive the name, email address, organisation (if provided), mood, seed colour and message content you enter. If you email us directly, we receive whatever the message contains.
• Account data. DesignDNA is free but sign-in is required, so we hold the email address the account is registered to, the date it was created, single-use sign-in link tokens with their timestamps, and the briefs and generated systems saved against it. We never collect payment card or billing data, because there is nothing to pay for.
• Data collected automatically. Our hosting provider records standard server logs: IP address, request time, requested URL, HTTP status, referrer and user agent. These are generated by the act of serving a page and cannot be switched off without disabling logging entirely.
• Data from cookies. Only the essential items — the consent record, the form token and, once you sign in, the session cookie — are set without consent. Analytics and functional storage are set only after you opt in. See the cookie policy for the full table.

We do not collect special category data, we do not knowingly collect data from children under 16, and we do not use automated decision-making that produces legal or similarly significant effects.

3. Why we process it, and on what legal basis

• Responding to enquiries — legal basis: legitimate interests (Article 6(1)(f) UK GDPR) in answering people who contact us.
• Creating your free account, sending sign-in links and returning generated systems to you — legal basis: performance of the agreement for the free service you asked for (Article 6(1)(b)).
• Site security, abuse prevention, rate limiting and diagnostics — legal basis: legitimate interests in keeping a free service available and secure for everyone.
• Analytics and functional storage — legal basis: your consent (Article 6(1)(a)), withdrawable at any time.
• Keeping records of consent and of acceptance of the terms — legal basis: legal obligation and legitimate interests in being able to show what was agreed.

We do not sell personal data, we run no advertising, and there is no payment processor in the chain because the tool is free.

4. Third-party processors

We keep the processor list deliberately short. At the time of writing it consists of: a website hosting and content delivery provider, which processes server logs and delivers page assets; and a transactional email provider, which sends sign-in links and handles messages sent from and replies to the brief form. Each processor is engaged under a written data processing agreement that limits them to acting on our documented instructions. There is no payment or billing provider, no advertising network and no data broker in the chain.

Where a processor stores data outside the UK or the European Economic Area, transfers are covered by an adequacy decision or by Standard Contractual Clauses together with the UK International Data Transfer Addendum. A current list of processors and their locations is available on request from [email protected].

5. Retention

6. Your rights

If you are in the UK or the EEA, you have the right to access your personal data; to have inaccurate data corrected; to have data erased where there is no overriding basis for keeping it; to restrict or object to processing; to data portability where processing relies on consent or contract and is automated; and to withdraw consent at any time without affecting the lawfulness of prior processing. You also have the right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office.

If you are a California resident, you have the right to know what personal information is collected, disclosed or sold; the right to request deletion; the right to correct inaccurate information; and the right not to be discriminated against for exercising those rights. We do not sell or share personal information as those terms are defined under the CCPA as amended, and because the service is free there is no pricing or service level that could differ as a result of a privacy request.

To exercise any right, including deleting your account, email [email protected]. We respond within one month and may ask for information sufficient to verify your identity before acting on a request.

7. Security and changes

The site is served over HTTPS. Sign-in links are single-use and short-lived. Access to form submissions and account records is restricted to named staff using individual accounts with multi-factor authentication. We review access rights periodically and remove them when they are no longer needed. No system is perfectly secure, and we do not claim otherwise; if a breach occurs that is likely to result in a risk to your rights, we will notify the relevant supervisory authority and, where required, you.

If this policy changes materially, we will update the date at the top of this page and, where the change affects how we use data you have already given us, contact you directly. Questions about anything on this page can go to [email protected].