Trust
Trust & Security
This page is maintained by Tiltedhue Ltd to answer common security and privacy questions about the tiltedhue.com website and our client engagements. It describes the controls and practices we have in place today. It is not an independent certification or audit.
What this site does
tiltedhue.com is a marketing site for our creative content studio. It does not host customer accounts, payments, or end-user data. The only personal information we actively receive through the site is what you choose to send via the enquiry form or by email.
Access & authentication
- The public website has no end-user login. There are no customer accounts to compromise.
- Internal tools used to operate Tiltedhue (email, project management, file storage) are protected by strong passwords and multi-factor authentication where supported by the provider.
- Access to enquiry correspondence is limited to Tiltedhue staff who need it to respond to you.
Data we collect
Via the enquiry form or email we typically receive your name, email address, company (if provided) and any project context you share. We use this only to reply to your enquiry. We do not sell personal data, and we do not use it for marketing. Full detail is in our Privacy Policy.
Encryption in transit
The website and enquiry form are served over HTTPS. Email between Tiltedhue and our providers is transmitted over TLS where supported by the receiving mail server.
Subprocessors & integrations
We rely on a small number of trusted providers to run our business. Each acts as a processor on our behalf and is bound by their own data-protection obligations:
- Google Workspace — email and document storage.
- Lovable Cloud — website hosting and the backend that receives enquiry-form submissions.
- Resend — delivery of transactional emails (such as the confirmation you receive after submitting the form).
We review this list when we add or change a provider.
Cookies & analytics
This site does not set marketing or advertising cookies. We may use minimal, privacy-friendly analytics to understand which pages are visited in aggregate. Standard server logs are kept for short periods for security and diagnostic purposes.
Retention & deletion
If a project does not proceed, we delete enquiry correspondence within 12 months. If a project does proceed, we retain relevant records for the duration of the engagement and for as long as required afterwards to meet legal, tax and accounting obligations (typically up to 7 years). You can request deletion at any time — see "Your rights" below.
Privacy requests & your rights
Under UK GDPR you can ask us to access, correct, delete, restrict, or port the personal data we hold about you. Email info@tiltedhue.com and we will respond within one month.
Incident & security contact
If you believe you have found a security issue affecting Tiltedhue or one of our sites, please email info@tiltedhue.com with the subject line Security. Please give us a reasonable opportunity to investigate before any public disclosure. We will acknowledge reports within a few business days.
Shared responsibility
Tiltedhue is responsible for how we collect, handle, and retain the information you share with us, and for the configuration of the providers we use. Our hosting and backend providers are responsible for the security of the underlying platform. You are responsible for the security of the device, account, and network you use to contact us.
Compliance posture
Tiltedhue Ltd is a UK company and processes personal data in line with UK GDPR and the Data Protection Act 2018. We do not currently hold an independent security certification such as SOC 2 or ISO 27001. If you need contractual data-protection terms for an engagement, contact us and we will work with you to put suitable arrangements in place.
Changes to this page
We update this page when our practices or providers change. The "last updated" date at the top reflects the most recent version.