Privacy Policy

Effective date: 31 August 2026

ICONMADE.AI is a trading name and website operated by CIRCLE OF NINE LTD., a company registered in England and Wales under company number 14648127, with its registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.

Website: https://iconmade.ai

Legal and privacy enquiries: hello@iconmade.ai

CIRCLE OF NINE LTD. is the controller of personal data described in this Privacy Policy. This Policy explains what we collect, why we use it, who we share it with, how long we keep it and the rights available to individuals under the UK GDPR and the Data Protection Act 2018.

1. Personal data we collect

• Identity and contact data, such as name, job title, organisation, email address, telephone number and country.
• Enquiry and correspondence data, including messages, briefs, preferences, feedback and support communications.
• Project data, including prompts, images, video, audio, logos, brand assets, reference material and information about people appearing in supplied content.
• Contract and transaction data, including proposals, approvals, invoices, payment status and limited payment references. We do not need to store full card details where payment is handled by a payment provider.
• Technical and usage data, such as IP address, device and browser information, pages viewed, timestamps, referrer, security logs and consent choices.
• Marketing data, such as newsletter preferences, consent records, engagement and unsubscribe status.
• Publicly available or third-party data supplied by a client, collaborator, platform or referral source where lawful.

We do not use photographs for biometric identification and do not intentionally collect special-category data unless it is genuinely necessary, lawful and appropriately protected. Please do not send sensitive information unless we ask for it and explain the basis for processing.

2. How we collect data

• directly from you through forms, email, meetings, file transfers, proposals and project delivery;
• automatically through necessary website technology and, where you consent, analytics or marketing technology;
• from a client or authorised representative who includes you in project material; and
• from public sources or professional platforms where appropriate and lawful.

3. Purposes and lawful bases

4. Client-supplied personal data

A client may provide personal data about models, staff, customers or other people. The client is responsible for having an appropriate lawful basis, giving required privacy information and obtaining any necessary releases or consents. Depending on the project, we may act as an independent controller or as a processor on the client's documented instructions. If processing terms are required, the parties will enter a separate data processing agreement.

5. Sharing personal data

We may share data only as reasonably necessary with:

• hosting, cloud storage, cybersecurity and website providers;
• email, newsletter, file-transfer, communication and customer-support providers;
• payment, accounting, banking and professional advisers;
• creative contractors and AI or media-processing providers involved in an approved project;
• regulators, courts, law-enforcement or public authorities where required; and
• a genuine purchaser, investor or successor in connection with a business transaction, subject to appropriate safeguards.

Providers may process data only for authorised purposes under contractual or legal duties. We do not sell personal data.

6. International transfers

Some providers may process data outside the United Kingdom. Where UK data protection law requires safeguards, we use an adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism, together with supplementary measures where appropriate. Contact us for information about relevant safeguards.

7. Retention

We keep personal data only as long as reasonably necessary. Our usual periods are:

• unsuccessful or inactive enquiries: up to 24 months after the last meaningful contact;
• contracts, invoices and core transaction records: generally 7 years after the relevant accounting period or longer if required for a claim or legal duty;
• working project files and supplied media: normally up to 90 days after final delivery, unless the proposal, support needs, consent or legal obligations require a different period;
• final project and approval records: for the contract period and a reasonable limitation period;
• newsletter records: until unsubscribe, followed by a minimal suppression record to respect the objection;
• security logs: normally up to 12 months unless an incident requires longer retention; and
• cookie and consent records: for the durations described in the Cookie Policy or consent platform.

We may anonymise information so it no longer identifies an individual and use the anonymised information for lawful business analysis.

8. Security

We use proportionate technical and organisational measures designed to protect personal data, including access controls, secure transfer methods, provider due diligence, authentication, backups and staff or contractor confidentiality. No internet service is completely secure; please use the secure upload method we specify and do not send sensitive files through unapproved channels.

9. Marketing

We send marketing to individuals only where permitted, normally with specific consent or a valid soft opt-in. Consent is optional and is not required to submit an enquiry or buy a service. You can unsubscribe using the link in an email or by contacting us. We may keep a minimal suppression record so we do not contact you again against your wishes.

10. Cookies

We use necessary technologies to operate the website. We use non-essential analytics, embedded-media or marketing technologies only where permitted and after the required consent. See the Cookie Policy and use Cookie Preferences to change your choice.

11. Your rights

Depending on the circumstances, you may have the right to:

• access your personal data and receive a copy;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• object to processing based on legitimate interests or to direct marketing;
• receive certain data in a portable format;
• withdraw consent at any time, without affecting earlier lawful processing; and
• complain to a supervisory authority.

To exercise a right, email hello@iconmade.ai. We may need information to verify your identity. You may complain to the UK Information Commissioner's Office at https://ico.org.uk/make-a-complaint/. We would appreciate the opportunity to address the concern first.

12. Automated decisions

We do not use personal data collected through the website to make solely automated decisions that produce legal or similarly significant effects. AI tools may assist creative production, but a human-led project process determines the service and Deliverables.

13. Children

The website and services are not directed to children. We do not knowingly accept enquiries or contracts from anyone under 18. A client must not supply a child's likeness or data unless the use is lawful, necessary, fully disclosed and supported by verifiable parental or guardian authority and any other required safeguards.

14. Changes and contact

We may update this Policy to reflect legal, technical or operational changes. The current version and effective date will remain available on the website. Material changes will be highlighted where appropriate. Questions and requests should be sent to hello@iconmade.ai or by post to CIRCLE OF NINE LTD., 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ.