Legal
Privacy Notice
Last updated: 4 November 2026
Who is responsible for your data
MSD is provided at mastermindsecuritydesign.com and is operated by Mastermind Security Solutions Ltd, a company registered in England and Wales under company number 13344765, whose registered office is at 10 Indus Road, Shaftesbury, SP7 8FU, United Kingdom (“we”, “us”, “our”). Contact: support@mastermindsecuritydesign.com (support and privacy), billing@mastermindsecuritydesign.com (billing).
We are the controller of the personal data described here. Questions or requests: support@mastermindsecuritydesign.com. [Data protection fee / ICO registration number to be confirmed before launch.]
What we collect and why
| Data | Purpose | Lawful basis |
|---|---|---|
| Name, email, password hash, Google or Microsoft account identifier if you use Google or Microsoft sign-in | Create and secure your account | Contract |
| Workspace, membership and role details | Provide workspaces and teams | Contract |
| Project files and versions | Store and sync your designs | Contract (we act as processor for personal data inside projects — see the DPA) |
| Billing details: plan, invoices, payment status, billing name/address. Card details are held by Stripe, not us | Take payment, keep accounts | Contract; legal obligation (tax records) |
| Security data: sign-in times, IP address, device/browser, two-factor status, audit log entries | Keep the Service and your account secure, prevent fraud and abuse | Legitimate interests |
| Contact form messages | Reply to you | Legitimate interests |
| Transactional emails (verification, password reset, receipts, alerts) | Run your account | Contract |
| Anonymous page-view counts (only if you opt in) | Understand which pages are useful | Consent |
We do not sell personal data, use it for advertising, or make automated decisions with legal or similar effects about you.
Who we share it with
We use service providers to run MSD (listed on the sub-processors page): Cloudflare (hosting, database, file storage, bot protection), Stripe (payments) and our email provider (transactional email). If you choose Google or Microsoft sign-in, Google or Microsoft confirms your identity to us (name, email address, and for Microsoft your organisation's tenant identifier); they do not receive your project data. We may share data if the law requires it, or with a buyer if the business is sold (you would be told).
International transfers
Project files and account data are stored in the European Union. Some providers may process data in other countries, including the United States; where they do, we rely on UK adequacy regulations or the UK International Data Transfer Addendum / Agreement. [Transfer mechanism per provider to be confirmed.]
How long we keep it
- Account and project data: while your account is open. Deleted projects stay in trash for 30 days. When you delete your account we delete your data, except backups, which expire within [backup period to be confirmed].
- Billing records: 6 years after the end of the financial year they relate to, as required for UK tax.
- Security and audit logs: up to 12 months. Contact messages: up to 24 months.
Your rights
You can ask to access, correct, delete or export your data, to restrict or object to its use, and to withdraw consent at any time (for analytics: “Cookie settings” in the footer). You can export or delete your account yourself in Account settings. You may complain to the Information Commissioner’s Office (ico.org.uk), but we would welcome the chance to help first.
Security
Passwords are stored as salted, slow hashes. Connections are encrypted. Staff access to customer projects requires the customer’s time-limited permission and is logged. Administrative access requires two-factor authentication.
Cookies
See the Cookie Policy.