We keep your secrets.Here’s exactly how.

Remigia Studio Ltd (“Remigia”, “we”, “us”) is a product design and engineering studio, registered in England and Wales, with people in London, Dubai and Lagos. We run remigia.io and are the controller of the personal data described in this policy.

Questions, requests or complaints about your data go to hello@remigia.io with the subject line “Privacy – your name”. A real person reads every one. Our founder is responsible for data protection.

We only collect what we need to reply to you and to run the site safely:

Your brief

Your name, your company (optional), where you're starting from, what you'd like built, your idea in one line, when you'd like to start, a rough budget and your email address. We also store the bird codename and reference number we give your brief.

Things you send us

Emails, call notes, files and anything else you choose to share while we talk about or work on your project.

Technical data

When you visit, our hosting and security provider processes your IP address, browser, device type and the pages requested, so the site can be delivered and protected from abuse. Our spam check looks at similar signals to tell people from bots.

Visit statistics

Which pages and buttons are used, how far people scroll, where visitors come from (the referring site and your country, worked out from your IP address), your device type and how fast pages load. Collected without cookies or anything stored on your device, and we don't build a profile of you or follow you between visits.

Settings on your device

Your light or dark preference is saved in your own browser so the site remembers it. It never leaves your device.

We don't ask for, and don't want, sensitive information such as health, religion or ethnicity. Please leave it out of your brief.

We don't use advertising, tracking or analytics cookies, and we don't fingerprint your device. Our visit statistics are cookieless by design.

Our hosting provider may set a strictly necessary security cookie to tell people from bots when traffic looks suspicious. It isn't used to track you and doesn't need your consent.

Under UK data protection law we need a reason, called a lawful basis, for each use:

Replying to your brief and preparing a proposal

Taking steps at your request before entering into a contract.

Delivering your project and supporting it afterwards

Performing our contract with you or your organisation.

Keeping the site secure and understanding how it's used

Our legitimate interests in running a safe, working website, balanced against your rights.

Keeping accounts and records

Complying with our legal obligations, for example tax and company law.

Occasional news from us

Only with your consent, which you can withdraw at any time. We don't currently send a newsletter.

We don't make decisions about you by automated means, and we don't build profiles of you.

When you write a brief, we give it a bird codename and a reference such as RMG-26-042. The bird is chosen at random. It isn't based on anything you've told us, and it isn't a profile, a score or a judgement. Its only job is to make your brief easy to find, and slightly more fun to talk about.

We never sell or rent your personal data. We share it only with providers who help us run Remigia, under contracts that require them to protect it and use it only on our instructions:

• Cloudflare, for hosting, security and spam protection.
• PostHog, for visit statistics, on its EU servers.
• Zoho, for our email.
• The design, development and project tools named in your proposal, if we work together.
• Professional advisers such as accountants and lawyers, under a duty of confidentiality.

We may also disclose data if the law requires it, to protect our rights, or to a buyer if Remigia's business is ever sold, in which case this policy goes with it.

Our team works from the United Kingdom, the United Arab Emirates and Nigeria, and our providers run global infrastructure, so your data may be accessed or stored outside the country you're in.

Where data leaves the UK, we rely on UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and we apply the same security standards wherever our people are. We also follow the transfer rules of Nigeria's Data Protection Act 2023 and the UAE's Personal Data Protection Law where they apply.

• Briefs and conversations that don't become a project: up to 24 months, then deleted.
• Client, project and contract records: for the engagement plus six years.
• Security logs: a short period, typically days or weeks, set by our hosting provider.
• Visit statistics: kept only in aggregate, so they can't identify you.

When we no longer need data, we delete it or anonymise it so it can't be traced back to you.

• Encryption in transit everywhere (HTTPS), and encryption at rest through our providers.
• Multi-factor authentication on every account that can reach your data.
• Access limited to the people working on your enquiry or project.
• Prompt deletion when the retention periods above run out.

No system is perfectly secure. If a breach ever puts your data at risk, we'll tell you and the relevant regulator as the law requires, without delay.

Depending on where you live, you have the right to:

• Ask for a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted.
• Restrict or object to how we use it, including for marketing.
• Receive your data in a portable format.
• Withdraw consent at any time, where we rely on it.

Email hello@remigia.io with the subject “Privacy – your name”. We’ll reply within one month, free of charge, and we may ask you to confirm who you are first.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You can also complain to your data protection regulator: the Information Commissioner's Office in the UK, the Nigeria Data Protection Commission, or the UAE Data Office.

We may update this policy as Remigia grows or the law changes. The version and date at the top always show the current one. If a change materially affects how we use data you've already given us, we'll tell you directly before it applies.

• Version 1.1 · 10 October 2026 · Visit statistics now come from PostHog (EU), still without cookies.
• Version 1.0 · 9 October 2026 · First version. Written by humans, read by at least one more.