Privacy Policy

1. Who We Are

Moji Studio is a Liverpool based digital studio providing website design and development, social media marketing and automation, AI automation and integrations, CRM and business tools, branding, technical SEO, ongoing website care, and related digital services.

The data controller for this website is Moji Technologies Ltd, operating under the Moji Studio brand.

Moji Technologies Ltd is a private limited company registered in England and Wales with company number 17181491. Registered office: 66 Paul Street, London, England, United Kingdom, EC2A 4NA.

2. Personal Data We Collect

2.1 Contact form

• Name and email address
• Business name, and phone or WhatsApp number, if you give them
• The services you are interested in, your budget range, preferred timeline, and what branding, content, or images you already have
• Your project overview and anything else you write in the form
• Your confirmation that you agree to be contacted, the time you sent the form, the page you sent it from, and the version of this policy shown to you

2.2 Email, WhatsApp, Instagram and Facebook

• Email: your email address, name, and the content of your emails and any attachments
• WhatsApp: your phone number, your WhatsApp profile name, the content of your messages, and when they were sent
• Instagram: your Instagram username, display name and the ID Instagram gives your account for us, the comments you leave on our posts and the messages you send us, the options you tap in our replies, and when each was sent. If you share them in the conversation, also your business name, what you need, your website, and your email address or phone number
• Facebook: your Facebook name, and the comments and messages you send to our Facebook Page
• Our replies to you, and notes our team adds about your enquiry or project

2.3 Free website check and review requests

• The address of the website you ask us to check, and the automated results (scores and findings about that website)
• If you ask for your full report and a review from our team: your first name and email address, your business name and phone or WhatsApp number if you give them, whether you ticked the box to receive tips and offers, the link or social media post you came from, the time you sent the request, and the version of this policy shown to you

If you only run the check and don't ask for the report, we don't keep the website address or results.

2.4 Technical and usage data

• Cookieless visit and enquiry counts from Cloudflare Web Analytics and our own analytics: the page, where the visit came from (such as a link in one of our posts), events such as an enquiry being sent or a phone, WhatsApp or email link being tapped, the date, a country and the type of device. These are not linked to your name or to any ID, and you can switch them off (section 10)
• Browser, device, and page usage data collected through Google Analytics, only if we enable it and you consent
• Cookie consent choices stored in your browser
• Anti-spam signals connected to form submissions, such as a hidden spam-trap field and how long the form was open
• Browser signals that Cloudflare Turnstile checks to confirm a person, not a bot, started a free website check
• Your IP address and browser details, which reach our hosting provider (Cloudflare) when you load a page

2.5 Website chat (MojiChat)

Our website has a chat, MojiChat, that answers questions about our services. It is automated, not a person, and it says so when a chat starts. If you stay on a page for a while, a short greeting may appear next to the chat button; nothing is stored in your browser until you open the chat.

• The messages you type and the replies you get, the page you were on, and when each message was sent
• Once you open the chat, a random visitor ID and whether the chat is open, kept in your browser, and the chat so far, kept only in that browser tab so it carries on if you change page (see our Cookie Policy)
• Browser signals that Cloudflare Turnstile checks, and message counts per visitor, so the chat can't be abused
• If you agree to leave your details so we can get back to you: your name, your email address or phone number, and what you need help with

If you leave your details, they and the chat go to our customer management system (MojiCRM) as an enquiry, or to our team by email if MojiCRM can't take it. The chat itself is kept in MojiEngage, the system that runs it, where website visitors are listed as contacts.

The replies are written by AI models that Cloudflare runs for us (Cloudflare Workers AI), using only information we have approved about Moji Studio. Cloudflare does not keep your messages after each reply or use them to train AI models. If we move the chat to a different AI provider, we will update this policy first.

Please don't share sensitive information, such as health or payment details, in the chat. You don't have to use it: the contact form, email and WhatsApp work just as well.

2.6 Instagram messages answered by MojiChat

When you message us on Instagram and none of our standard replies fits, MojiChat may answer. It says it is an automated assistant at the start of a conversation, after a long gap, and when it takes over again from our team, and you can tap Talk to the team at any time to reach a person.

• To write each reply, your message and up to 20 messages from the last 24 hours of your conversation with us are sent to AI models that Cloudflare runs for us (Cloudflare Workers AI), using only information we have approved about Moji Studio. Cloudflare does not keep them after each reply or use them to train AI models
• If you agree to pass on your details so our team can follow up, the conversation and your details go to our customer management system (MojiCRM). Nothing goes there without your agreement
• The assistant's record of the conversation is deleted 90 days after it was last active. The messages kept in MojiEngage follow the Instagram retention in section 7

3. How We Use Personal Data

• To reply to your enquiry by email, phone, or WhatsApp, and to prepare proposals
• To keep a record of each enquiry and conversation in our customer management system (MojiCRM), so we can follow up, see what was agreed, and deal with any questions later
• To send an automatic email confirming we received your contact form enquiry
• To run the free website check you ask for and, if you ask for your full report, to show it to you and for our team to review your website and get in touch about it
• To reply automatically on Instagram when you comment on our posts or message us, for example when you comment a keyword from one of our posts, using MojiEngage, a system we built. The automatic replies answer your question and ask for the details our team needs, then pass your enquiry to our team by email. You can ask to talk to the team at any point
• To answer questions in the chat on our website and, if you leave your details, to pass the chat to our team so they can reply
• To provide services and manage active client work
• To operate and secure the website and contact form, and to filter spam
• To understand site usage, see which pages, posts and links lead to enquiries, and improve the website and our marketing
• To keep records needed for contractual, tax, accounting, and legal purposes

We only send you marketing, such as tips and offers, if you tick the box asking for it, and you can unsubscribe at any time. We do not make decisions about you by automated means; the free website check scores a website, not a person. Automatic replies on Instagram and in the website chat only answer and route your enquiry; a person on our team decides how to follow it up.

4. Lawful Bases

Under UK GDPR and, where relevant, EU GDPR, we rely on these lawful bases:

• Replying to enquiries and preparing proposals: steps you ask us to take before entering a contract. If you contact us on behalf of a business, our legitimate interest in answering business enquiries.
• Free website check and review requests: steps you ask us to take (running the check, and the report and review you asked for), and our legitimate interest in following up about that review.
• Tips and offers: your consent, given by ticking the box. You can withdraw it at any time.
• Automatic replies to Instagram comments and messages: our legitimate interest in answering people who contact us on social media promptly, including outside working hours. You can ask us to stop them at any time.
• Website chat: our legitimate interest in answering questions about our services and keeping the chat safe. Where you ask us to get back to you, steps you ask us to take before entering a contract.
• Keeping enquiry and conversation records and sending confirmation emails: our legitimate interest in keeping an accurate record of what customers asked and what we told them, so we can follow up and resolve questions.
• Providing services: performance of our contract with you, or with the business you work for (our legitimate interest in dealing with its staff).
• Website security and spam filtering: our legitimate interest in keeping the website and contact routes safe and usable.
• Cookieless analytics: our legitimate interest in understanding how the website is used. You can switch it off at any time with Reject Optional in the cookie settings.
• Google Analytics, if enabled: your consent, which you can withdraw at any time in the cookie settings.
• Accounting and legal records: legal obligation.

You do not have to give us your details, but we cannot reply to an enquiry without a way to contact you.

5. Named Providers and Recipients

We do not sell your personal data. We share it only with the providers that run our website, email, WhatsApp, Instagram, Facebook, website chat and customer records, and only for the purposes above. The contact form is processed at https://contact.mojistudio.co.uk/contact.

• Cloudflare: hosts this website (Cloudflare Pages), runs the contact form (Cloudflare Workers), and runs our customer management system (MojiCRM on Cloudflare Workers, D1 and R2), which stores enquiries and conversations. Cloudflare Email Routing and Email Sending pass business email into MojiCRM and send our emails, including automatic enquiry confirmations and the notice of each contact form enquiry to our mailbox. Cloudflare also runs MojiEngage (Cloudflare Workers and D1), our own system that receives Instagram comments and messages sent to us and emails our team the details you share there. Cloudflare Turnstile checks that free website checks and website chats are started by a person. Cloudflare also runs the chat on our website (MojiChat, served by MojiEngage, on Cloudflare Workers and D1) and stores those chats, and Cloudflare Workers AI writes MojiChat's replies on our website and to Instagram messages, using open AI models that Cloudflare runs. Workers AI does not keep the messages after each reply and does not use them to train AI models.
• Proton: hosts our business mailbox, which receives email to our addresses and contact form notifications.
• Meta Platforms (WhatsApp Business Platform): carries WhatsApp messages between you and us when you message our WhatsApp business number. The messages are then kept in MojiCRM.
• Meta Platforms (Instagram and Facebook): operates Instagram and Facebook. Comments and messages you send to our Instagram account or Facebook Page pass through Meta, which also processes them under its own privacy policy. We receive Instagram comments and messages in MojiEngage through Meta's official API, and we read and answer Facebook comments and messages in Meta's own tools.
• Google (PageSpeed Insights): runs the speed and quality test in our free website check. Google receives only the address of the website being checked, never your name or contact details.
• Google (Google Analytics 4): optional website analytics, only if you accept analytics cookies.
• Professional advisers, payment providers, or authorities where legally required or necessary for service delivery.

6. International Transfers

Some of our providers process data outside the United Kingdom. Where they do, we rely on the safeguard listed below. You can ask us for more detail, or a copy of the relevant safeguard, using the contact details in section 13.

• Cloudflare: Cloudflare, Inc. is based in the US and runs a global network. Transfers rely on the UK Extension to the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses and UK Addendum in Cloudflare's data processing addendum as a fallback.
• Proton: Proton AG is based in Switzerland and stores data in Switzerland, Germany and Norway, which the UK recognises as providing adequate protection (UK adequacy regulations).
• Meta Platforms (WhatsApp Business Platform): WhatsApp LLC (part of Meta) processes messages in the US and other countries. Transfers rely on the EU Standard Contractual Clauses with the UK Addendum, set out in WhatsApp's Business Data Transfer Addendum for the UK.
• Meta Platforms (Instagram and Facebook): Meta Platforms Ireland Limited provides Instagram and Facebook in the UK (Ireland has UK adequacy). Onward transfers to Meta Platforms, Inc. in the US rely on the UK Extension to the EU-US Data Privacy Framework, with the safeguards in Meta's own data transfer terms as a fallback.
• Google (PageSpeed Insights): Google LLC runs PageSpeed Insights in the US and other countries. A business website address is not usually personal data; where it is, transfers rely on the UK Extension to the EU-US Data Privacy Framework.
• Google (Google Analytics 4): Google Ireland Limited provides Google Analytics in the UK (Ireland has UK adequacy). Onward transfers to Google LLC in the US rely on the UK Extension to the EU-US Data Privacy Framework.

7. Retention

• Enquiries that do not go ahead, including free website check and review requests: 12 months after the enquiry was last updated.
• Messages and conversations (contact form, email, and WhatsApp): 24 months after the message, unless they relate to a project or an open question.
• Instagram comments and messages in MojiEngage: the text of messages and the details you share are deleted 90 days after they arrive. Records of what the system did, without message text, are kept for up to 2 years for security and troubleshooting. Enquiries passed to our team are then kept as described above.
• Facebook comments and messages: kept in Meta's tools under Meta's own retention, and handled by us like other messages above.
• Website chats: if you don't leave your details, the chat is deleted 90 days after it was last active. If you do, it is kept with your enquiry as described above. In your browser, the chat in that tab is cleared once you leave your details or close the tab, and the visitor ID stays until you clear your browser storage. Your name and contact details are never kept in your browser.
• People we have talked to who did not become clients: 24 months after our last contact.
• Client and project records: for the duration of the project and 6 years after the final invoice or project close, for accounting and contractual record-keeping.
• Cookie consent preferences: until you update your choice or clear local browser storage.
• Website analytics data: our own cookieless counts are deleted after 13 months; any other analytics data is kept for up to 14 months.
• Spam-prevention signals: only for as long as needed to protect the form, investigate misuse, or keep the service secure.

8. Security

We use reasonable technical and organisational measures to protect personal data. No website, service provider, or method of internet transmission is completely secure, so we cannot guarantee absolute security.

9. Your Rights

Subject to applicable law, you may have the right to request access, correction, deletion, restriction, objection, portability, and withdrawal of consent where consent is the lawful basis.

You can exercise your rights by contacting us using the details below. We may need to verify your identity before responding.

To stop receiving WhatsApp messages from us, reply STOP. Reply START if you want to hear from us there again.

To stop automatic replies on Instagram, tell us in the conversation and our team will switch them off for you. To ask us to delete your Instagram conversation data, email legal@mojistudio.co.uk with your Instagram username.

10. Cookies and Analytics

We use local browser storage for cookie preferences, and cookieless analytics (Cloudflare Web Analytics and our own counts) to see how the site is used and which links lead to enquiries. It sets no cookies and stores nothing on your device, and it stays off if you choose Reject Optional in the cookie settings or your browser sends Global Privacy Control. Google Analytics is used only if we enable it and you opt in. Once you open the website chat, it keeps a visitor ID in your browser and the chat so far in that tab. For more detail on the technologies in use and how to manage them, see our Cookie Policy.

11. Children

Our website and services are not directed at children. We do not knowingly collect personal data from children through this website.

12. Changes to This Policy

We may update this policy to reflect changes in our services, website tools, providers, or legal obligations. The date at the top of this page shows the latest revision.

13. Contact

For privacy questions or rights requests, contact:

14. Complaints

If you are unhappy with how we handle personal data, you can contact us first and you also have the right to complain to the Information Commissioner's Office in the UK:ico.org.uk.