Last Updated: 14 October 2026

Heavy Mask respects your privacy and is committed to protecting personal information handled through our website, software, applications, integrations and professional services.

This Privacy Policy explains what information we may collect, why we use it, how it may be shared, how long it may be retained, your rights, and the additional protections that apply when you connect third-party services such as Google.

1. Who we are

Heavy Mask (“Heavy Mask”, “we”, “us” or “our”) is a UK-based digital agency providing design, software development, web development, artificial intelligence, automation, digital growth and related services.

For personal information processed for Heavy Mask's own purposes, Heavy Mask is generally the data controller.

Contact:

Email: hello@heavymask.com

London:
The Harley Building
77 New Cavendish Street
London
W1W 6XB
United Kingdom

Luton:
72 Cardigan Street
Luton
Bedfordshire
LU1 1RR
United Kingdom

Where Heavy Mask processes information solely on behalf of a client, that client may instead be the controller and Heavy Mask may act as its processor.

2. Scope of this Privacy Policy

This Policy may apply when you:

• visit our website;

• contact us;

• request a quotation;

• become a client;

• use software or applications created or operated by Heavy Mask;

• create an account;

• download one of our tools;

• subscribe to communications;

• connect a third-party service;

• participate in a project;

• send us files or datasets;

• use an AI or automation feature;

• communicate with our team; or

• otherwise interact with Heavy Mask.

A particular product or service may also provide additional privacy information explaining processing specific to that product.

3. Information we may collect

The information collected depends on how you interact with us.

Identity information

This may include:

• name;

• username;

• job title;

• organisation;

• account identifier; and

• profile information.

Contact information

This may include:

• email address;

• telephone number;

• business address;

• postal address; and

• communication preferences.

Business and client information

This may include:

• organisation details;

• project requirements;

• proposals;

• contracts;

• instructions;

• business processes;

• client contacts;

• feedback;

• meeting information; and

• information necessary to deliver a project.

Account and authentication information

Where an account is used, we may process:

• account identifiers;

• authentication state;

• login timestamps;

• security information;

• OAuth permissions;

• connected-account identifiers; and

• access or refresh tokens where necessary to maintain an authorised integration.

We do not require or intend to obtain passwords for third-party services through OAuth integrations.

Payment and transaction information

This may include:

• invoices;

• billing information;

• payment status;

• transaction references; and

• information required for bookkeeping and tax compliance.

Where a third-party payment provider processes card details, Heavy Mask may not receive or store the full payment-card number.

Communications

We may retain communications including:

• email correspondence;

• support requests;

• project messages;

• meeting notes;

• feedback; and

• information you voluntarily send to us.

Project files and client data

When providing development, automation, AI, design or consultancy services, clients may provide information contained within:

• spreadsheets;

• databases;

• documents;

• PDFs;

• emails;

• website content;

• images;

• source code;

• application data;

• financial records;

• operational records; or

• other digital files.

Such files may incidentally include personal information relating to employees, clients, customers, suppliers or other individuals.

When we process this information solely on a client's instructions, Heavy Mask generally acts as a processor rather than the controller.

AI interaction data

Where a Heavy Mask service includes artificial intelligence or automated systems, we may process:

• prompts;

• instructions;

• uploaded files;

• relevant context;

• tool calls;

• workflow information;

• model inputs;

• generated outputs; and

• technical logs required to operate or troubleshoot the system.

The exact processing depends on the architecture of the particular service.

Technical and device information

Our websites and online services may automatically receive information including:

• IP address;

• browser type;

• operating system;

• device type;

• referring page;

• requested pages;

• date and time;

• diagnostic information;

• application version;

• crash logs;

• security events; and

• similar technical information.

Usage and analytics information

Where permitted, we may collect information about how our websites, applications or tools are used, including:

• pages visited;

• navigation;

• interactions;

• feature usage;

• approximate traffic source;

• session information;

• performance data; and

• aggregated statistics.

Cookies and similar technologies

Our website or applications may use cookies, local storage, pixels or similar technologies for purposes including:

• essential functionality;

• security;

• preferences;

• analytics; and

• measuring website performance.

Where consent is required for non-essential technologies, we will seek consent before using them.

Additional information may be provided in our Cookie Policy or consent interface.

Marketing information

Where applicable, we may maintain information about:

• marketing preferences;

• previous communications;

• interests relevant to our services; and

• whether you have opted out of marketing.

Public and professional information

For legitimate business-development purposes, we may obtain limited professional information from publicly available sources such as:

• company websites;

• professional directories;

• business registries; or

• publicly available professional profiles.

We do not use this as a licence to collect information indiscriminately.

4. Special-category and highly sensitive information

Heavy Mask does not generally need special-category personal data for ordinary website or agency operations.

However, a client's project dataset may contain information concerning matters such as:

• health;

• ethnicity;

• religion;

• biometrics;

• political opinions;

• sexual orientation; or

• other sensitive information.

Clients should not provide sensitive personal information unless it is necessary, lawful and agreed as part of the relevant service.

Where Heavy Mask processes such information on behalf of a client, the client is responsible for identifying an appropriate legal basis unless Heavy Mask is independently acting as controller.

5. How we obtain information

We may receive information:

• directly from you;

• from your employer or organisation;

• from a Heavy Mask client;

• through a website or application;

• through authorised APIs;

• from a connected third-party account;

• from service providers;

• from publicly available business sources; or

• automatically through your use of our systems.

6. Why we use personal information

Depending on the circumstances, we may use personal information to:

• respond to enquiries;

• provide quotations;

• enter into and manage contracts;

• deliver projects;

• develop software;

• provide support;

• operate websites and applications;

• authenticate users;

• provide connected-account functionality;

• process files at a user's request;

• perform API actions requested by a user;

• provide AI or automation functionality;

• maintain infrastructure;

• diagnose technical problems;

• improve reliability and security;

• prevent fraud and abuse;

• communicate with clients;

• administer accounts;

• process payments and invoices;

• maintain records;

• comply with legal obligations;

• establish or defend legal claims;

• improve our services;

• analyse website or application performance;

• conduct appropriate business development; and

• send marketing where permitted.

We will not use personal information for a materially incompatible purpose without establishing an appropriate legal basis and providing any required notice or consent.

7. Our legal bases

Under UK data protection law, our legal basis may include:

Contract

Processing may be necessary to enter into or perform a contract with you.

Examples include quotations, project delivery, support and account administration.

Legitimate interests

We may process information where necessary for legitimate business interests that are not overridden by your rights.

These interests may include:

• operating our business;

• maintaining client relationships;

• securing our systems;

• preventing fraud;

• improving our services;

• understanding service performance; and

• appropriate business-to-business marketing.

Legal obligation

We may process information to meet obligations relating to matters such as taxation, accounting, regulatory requirements and lawful requests.

Consent

We may rely on consent where appropriate, including for certain:

• marketing communications;

• cookies or tracking technologies;

• third-party integrations;

• access to particular information; or

• other processing requiring consent.

Where processing is based on consent, you may withdraw it subject to applicable law.

8. Information from connected services

You may choose to connect a Heavy Mask service to a third-party account.

Examples could include accounts provided by:

• Google;

• Microsoft;

• GitHub;

• cloud-storage providers;

• CMS providers;

• ecommerce systems;

• analytics services;

• social platforms; or

• other software providers.

We do not automatically obtain everything held in a connected account.

The information available to us is determined by:

• the feature being used;

• the permissions requested;

• the provider's API;

• the permissions approved by you; and

• where applicable, permissions imposed by your organisation's administrator.

We seek to request only permissions necessary for the relevant functionality.

9. Google API Services and Google user data

This section specifically applies where you connect a Google Account or where a Heavy Mask application accesses information through Google APIs.

Information we may request

Depending on the functionality you expressly choose to use, a Heavy Mask application may request permission to access specific Google information, potentially including:

• basic account information;

• name;

• email address;

• account identifier;

• Google Drive files or file metadata;

• Google Docs or Sheets information;

• Gmail information;

• Calendar information;

• contacts;

• Google Workspace information; or

• other Google data required by a clearly identified feature.

A particular application may use only a subset of these categories.

The OAuth consent process identifies the permissions actually requested.

How Google information is used

Information obtained from Google APIs is used only to provide or improve the user-facing feature for which the relevant access was granted.

For example, where expressly authorised, this may include:

• authenticating you;

• locating a file you asked the application to use;

• reading data necessary to perform a requested workflow;

• creating or updating a document;

• processing information requested by you;

• summarising information for you;

• displaying information back to you;

• creating or updating a calendar event;

• drafting or sending information where you specifically invoke such functionality; or

• performing another clearly disclosed action requested by you.

We will not silently use Google user information for unrelated purposes.

Google Limited Use commitment

Heavy Mask's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Where we access Google Workspace scopes, our use of information received from those scopes will also adhere to the applicable Google Workspace User Data and Developer Policy, including the Limited Use requirements.

Advertising and sale of Google user data

Google user data obtained through Google APIs is not:

• sold to data brokers;

• sold to advertising platforms;

• used for personalised advertising;

• used for interest-based advertising;

• used for retargeting; or

• used to determine creditworthiness or lending eligibility.

AI and machine-learning training

Google Workspace user data obtained through applicable Google Workspace APIs is not transferred, sold or used to create, train or improve a general-purpose or shared machine-learning or artificial-intelligence model.

Where AI is part of the user-facing feature, Google information may only be processed in a manner permitted by Google's applicable policies and for the authorised user-facing purpose.

We do not use Google Workspace user data to build unrelated model-training datasets.

Human access

Heavy Mask personnel will not access the content of Google Workspace user data except where permitted by applicable Google policy, such as where:

• you have expressly authorised human access to specific information for support or troubleshooting;

• access is necessary to investigate fraud, abuse, security or a technical incident;

• access is required by applicable law; or

• data has been appropriately aggregated and anonymised for permitted internal operations.

Human access is restricted to personnel who reasonably require it.

Sharing Google information

Google user data is not shared with third parties except where permitted by applicable Google policies and necessary for the relevant functionality, security, legal compliance or another expressly authorised purpose.

Where a service provider processes information for us, appropriate contractual and security safeguards will apply.

Google OAuth tokens

Where necessary to maintain a connection, a Heavy Mask application may store OAuth access or refresh tokens.

OAuth credentials and tokens must be handled as security-sensitive information.

Where stored by us, they are protected using appropriate technical safeguards, including encryption at rest where required, and are transmitted using secure protocols.

Revoking Google access

You may revoke a Heavy Mask application's access through your Google Account's third-party connection/security controls.

Where supported, you may also disconnect Google from within the relevant Heavy Mask application.

Revoking access prevents future API access using the relevant authorisation, although information already legitimately retained may take time to be removed from backups or may need to be retained where required by law.

Deleting Google-derived data

You may request deletion of Google-derived personal information held by Heavy Mask by contacting:

hello@heavymask.com

Where appropriate, deletion may also be available through the relevant product interface.

We will delete or anonymise data where required, subject to information that must legitimately be retained for legal, security, fraud-prevention or contractual reasons.

10. Artificial intelligence and personal information

Heavy Mask develops and uses AI-assisted systems.

Depending on the particular project, processing may occur:

• on infrastructure controlled by Heavy Mask;

• on client-controlled infrastructure;

• through locally hosted models;

• through private or enterprise AI services; or

• through third-party AI APIs.

We will determine the appropriate architecture according to the particular project, contractual arrangement and nature of the information involved.

We do not intentionally use confidential client data to train unrelated general-purpose AI models unless a separate arrangement expressly permits it and such use is lawful.

Google Workspace information is subject to the stricter commitments in the Google section above.

11. Automated decisions

Heavy Mask may build or operate automated workflows.

Unless expressly disclosed otherwise, we do not intend to make solely automated decisions about individuals that produce significant legal or similarly significant effects for Heavy Mask's own purposes.

Where a client uses technology developed by Heavy Mask to perform automated processing, the client may be responsible for determining the lawful basis, transparency requirements and safeguards applicable to that use.

12. How we share information

We may disclose information where reasonably necessary to:

Service providers

We may use suppliers providing services such as:

• hosting;

• cloud infrastructure;

• data storage;

• email;

• communications;

• analytics;

• authentication;

• software development;

• security;

• payment processing;

• accounting;

• support; and

• AI infrastructure.

Providers are given access only where reasonably necessary for the relevant service.

Professional advisers

Information may be disclosed to accountants, insurers, legal advisers or other professional advisers where reasonably necessary.

Legal and security reasons

We may disclose information where necessary to:

• comply with law;

• respond to lawful authority;

• establish or defend legal claims;

• protect individuals;

• prevent fraud;

• investigate abuse; or

• protect our systems.

Business transactions

If Heavy Mask undergoes a merger, acquisition, restructuring or sale, information may be transferred as part of the transaction subject to applicable legal and contractual protections.

Where Google user data is involved, any additional restrictions imposed by Google's Limited Use policies will apply.

13. Subprocessors

Where Heavy Mask processes personal information on behalf of a client, we may engage subprocessors to provide infrastructure or supporting services.

We will impose appropriate contractual obligations where legally required.

A project-specific agreement may impose additional requirements concerning subprocessors.

14. International transfers

Some technology providers may process information outside the United Kingdom.

Where UK data-protection law requires safeguards for an international transfer, we will use an appropriate transfer mechanism such as:

• UK adequacy regulations;

• approved contractual protections;

• the UK International Data Transfer Agreement;

• an applicable UK Addendum; or

• another legally recognised mechanism.

Additional technical or organisational safeguards may be used where appropriate.

15. Data security

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;

• unlawful processing;

• accidental loss;

• alteration;

• destruction; and

• disclosure.

Measures may include, depending on the system:

• encrypted network communications;

• encryption of sensitive stored credentials;

• access controls;

• authentication;

• least-privilege permissions;

• system logging;

• security updates;

• credential management;

• backups;

• monitoring;

• restricted staff access; and

• secure development practices.

No online system can guarantee absolute security.

16. How long we retain information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, contractual and security purposes.

Retention depends on the type of information.

Typical considerations include:

Enquiries

Enquiry correspondence may normally be retained for a reasonable business-development period following the last substantive interaction.

Client and contractual records

Contracts, invoices and relevant business correspondence may generally be retained for up to six or seven years following the end of the relevant relationship where appropriate for taxation, accounting or legal-claims purposes.

Project information

Working files and project data are retained according to the nature of the project, client instructions and ongoing support requirements.

Data processed solely on behalf of a client may be returned or deleted following the end of the engagement subject to agreed retention requirements and backups.

Connected-account data

OAuth tokens and data held specifically to maintain an integration are retained only while reasonably required to provide the connected functionality or until access is revoked, subject to limited legal or security requirements.

Technical and security logs

Logs may be retained for a period reasonably necessary for security, troubleshooting and abuse prevention.

Marketing information

Marketing records may be retained until you opt out or they are no longer required.

We may retain minimal suppression information to ensure an opt-out continues to be respected.

Backups

Information deleted from live systems may remain in encrypted or protected backups for a limited period until those backups are overwritten in the ordinary backup cycle.

17. Data minimisation

We seek to collect only information reasonably necessary for the relevant purpose.

This is particularly important for API integrations.

Applications should not request access to a category of information merely because it might become useful in the future.

18. Your rights

Depending on applicable law and the circumstances, you may have rights including:

• the right to be informed about processing;

• the right to access your personal information;

• the right to correct inaccurate information;

• the right to request deletion;

• the right to restrict processing;

• the right to object to certain processing;

• the right to data portability;

• rights concerning certain automated decision-making; and

• the right to withdraw consent where processing relies on consent.

These rights are not absolute and legal exceptions may apply.

To exercise a right, contact:

hello@heavymask.com

We may need to verify your identity before fulfilling a request.

19. Client-controlled information

If your information has been provided to Heavy Mask by one of our clients and Heavy Mask is acting solely as processor, the client is generally responsible for responding to your data-protection request.

We will reasonably assist the client where required.

20. Marketing communications

We may contact existing or prospective business clients regarding relevant Heavy Mask services where permitted by law.

Where consent is required, we will seek it.

You can opt out of electronic marketing at any time by using any unsubscribe mechanism provided or by contacting us.

Service, security and contractual communications are not necessarily marketing and may continue where required.

21. Cookies and electronic communications

Non-essential cookies and similar technologies will only be used in accordance with applicable rules.

Where consent is required, non-essential technologies should not be enabled until appropriate consent has been obtained.

Users should be able to manage or withdraw relevant choices.

Further information may be provided through our Cookie Policy and cookie controls.

22. Children's information

Our general website and professional services are not directed at children.

We do not knowingly seek to collect children's personal information through our general website where it is unnecessary.

If a particular client project or product is intended for children, appropriate product-specific privacy safeguards will be implemented where required.

23. Third-party websites and platforms

Our website or software may link to or integrate with services operated by other organisations.

Their handling of information is governed by their own privacy practices.

Heavy Mask is not responsible for another organisation's independent processing of personal information.

24. Data breaches

Where a personal-data breach occurs, we will investigate and take appropriate action.

Where required by law, relevant controllers, regulators and affected individuals will be notified within the applicable time periods.

Additional contractual notification requirements may apply where Heavy Mask acts as a processor.

25. Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to:

• our Services;

• technology;

• integrations;

• data practices;

• third-party requirements; or

• applicable law.

The latest revision date appears at the top.

Where a material change affects how previously collected information is used, we will provide additional notice or seek consent where required.

Where Google user data is concerned, we will not begin using that data for a materially different purpose without satisfying applicable disclosure and consent requirements.

26. Complaints

If you have a concern about how Heavy Mask processes personal information, please contact us first at:

hello@heavymask.com

You may also have the right to complain to the Information Commissioner's Office (ICO), the UK's data-protection regulator.

27. Contact

For privacy questions, data requests, deletion requests or questions regarding connected-account information, contact:

hello@heavymask.com

Heavy Mask
The Harley Building
77 New Cavendish Street
London
W1W 6XB
United Kingdom