Privacy policy

Who we are

MISH MISH is a visualisation studio based in London, United Kingdom. We are the controller of the personal information this policy describes: your account, billing, security and support records. Contact: [email protected].

The personal data inside case material (parties, witnesses, patients, drivers) is different. You, or the firm you act for, are its controller, and we process it only as your processor under the Data Processing Agreement accepted with each request.

What we keep

Account details: your name, firm, work email and, if you add them, your phone number and password. Billing details on invoices and credit notes: the billing name, firm, address, case reference and amounts. Security and audit records: the IP address and browser of each sign-in, sign-in codes and security events, who opened or downloaded each case and file, quote approvals, and the agreements you accepted and when. Messages you send us through the Contact page or by email: your name, your email address and what you write (and, for an email, its subject and any files). Each is kept as a ticket in the studio’s support inbox, with a ticket id, our replies and our internal notes about it.

Case information, which is your answers in the request form, the files you upload, messages, drafts and the final deliverables, is processed under the Data Processing Agreement, on your instructions.

This website measures visits only if you accept in the cookie message. If you accept, Google Tag Manager and Google Analytics, provided by Google, count which pages are visited, the kind of device and browser used, the approximate area a visit comes from and how the visitor arrived, so that we can see how the site is used and improve it. This never includes anything from a case, an account, the request form or the client area: those pages are not measured at all. Google sets the cookies _ga and _ga_ followed by the identifier of our measurement property, which last up to two years. If you decline, or have not chosen, nothing is loaded from Google and none of these cookies is set. You can change your choice whenever you like with “Cookie settings” in the footer of every public page: switching measurement off stops it at once and removes the cookies from your browser. Your choice is kept in your browser only, for six months, and we keep no record of it on our servers. We use no advertising cookies and no advertising tracking.

Whatever you choose, we use three essential cookies, which work without your consent: a session cookie that keeps you signed in, an XSRF-TOKEN cookie that protects forms, and, if you tick “Keep me signed in”, a cookie that keeps you signed in for 30 days. On the request form, the Contact page and the sign-in page we also use Cloudflare Turnstile to tell people from automated programs. It works in the background, without a puzzle: while you are on those pages Cloudflare receives your IP address and details of your browser to make the check, under its data processing terms with us. It is not loaded anywhere else on the site.

Why we use it

To prepare your quote and produce the animation you ask for, and to send you codes, updates and invoices (contract, or our legitimate interest in serving your firm where you act for it); to keep the service secure, prevent misuse and record who did what (legitimate interests); and to meet accounting and legal duties (legal obligation).

Who helps us

We use a small number of service providers under data processing agreements. They are listed below with what each receives, why, where, and how a transfer outside the UK is covered. The list is the same one we keep for ourselves, and its date changes whenever a provider is added or removed. We do not share your information with anyone for their own purposes or for marketing.

Where a provider processes data outside the UK or the EEA, the transfer is covered by the UK International Data Transfer Addendum to the EU standard contractual clauses, as shown beside that provider.

What you write to us, and what we write to you, travels as ordinary email through our email provider and our support mailbox provider, both listed below. Please keep case contents and party names out of email: use your case’s messages in the portal, which only you and the studio can read. The text of a message from the studio about your case is also sent to you by email, so it will sit in your mailbox as well as in your portal.

The AI provider listed below is used for “Draft with AI” in the request form, and only when you press it. It drafts a case summary and scene suggestions from the notes you type, the text of the PDF or Word files you add, the pages of a PDF that is a scan (sent as pictures, because a scan has no text), the disputed issues you chose and what must not be shown. It does not use your data to train its models and retains it only for the short period its agreement with us allows for abuse monitoring, after which it is deleted.

Our motion designers may also use AI tools as an additional aid when producing a video. Every video is made by our motion designers. These tools are not given your case material: your files, images and descriptions stay out of them.

Cloudflare R2. Receives: Files clients upload and the studio's videos and deliverables, stored encrypted. Why: Private file storage. Where: EU (Cloudflare R2, EU jurisdiction). Transfer outside the UK: None: UK or EU. Since 1 October 2026.

Amazon SES. Receives: The recipient's email address and the text of the emails we send. Why: Sending sign-in codes, quotes, invoices and notices. Where: UK (London, eu-west-2). Transfer outside the UK: None: UK or EU. Since 1 October 2026.

Our support mailbox provider. Receives: The emails people send to the support address, with their subject, text and attachments, and the emails we answer them with. Why: Receiving questions and replies, which the studio reads as tickets. Where: UK or EU. Transfer outside the UK: None: UK or EU. Since 20 November 2026.

Amazon Bedrock, the AI provider for “Draft with AI”. Receives: Only when a client presses "Draft with AI": the notes typed in the request form, the text of the PDF and Word files added, the pages of a scanned PDF as pictures, the disputed issues chosen and what must not be shown. Why: Drafting a case summary and scene suggestions, under a data processing agreement with no training on client data. Where: EU (Frankfurt, eu-central-1). Transfer outside the UK: None: UK or EU. Since 5 October 2026.

Cloudflare Turnstile. Receives: The visitor's IP address and browser details, on the request form, the Contact page and the sign-in pages only. Why: Telling people from automated programs. Where: Global network. Transfer outside the UK: UK International Data Transfer Addendum to the EU standard contractual clauses. Since 8 October 2026.

Our hosting provider. Receives: All data held by the website, in the UK or EU. Why: Running the server and database. Where: UK or EU. Transfer outside the UK: None: UK or EU. Since 1 October 2026.

This list was last updated on 19 October 2026.

How long we keep it

Your case and its files stay in your account until you delete the case or ask us to remove them. You can delete a draft, and a case that is finished: delivered, closed, declined or cancelled. A case in progress cannot be deleted; you can cancel it before production starts, or ask us to remove a single file. We do not delete a finished case on our own timetable; the studio may close it, and closing it removes nothing.

A message you send through the Contact page or by email is kept as a ticket with our replies until you ask us to remove it. When your account is removed, your tickets are emptied: the name, address, subject, messages, notes and files are deleted, and only an anonymous ticket id and its dates remain. A ticket about a case is part of the case and is removed with it. The support mailbox also holds the original of each email in its Processed folder; the studio clears that folder, and removes an email from it if you ask.

When you delete a case it disappears from your account at once. Its records and files go to a locked store for 30 days and are then erased for good; there is no restore. Encrypted backups of the database are kept for up to 30 days. We keep a note that the deletion happened, without the content. Invoices, credit notes and receipts are kept for as long as accounting law requires; they show the billing name, firm, address, case reference and amounts, and no case content.

Account details are kept until your account is removed. Sign-in codes expire after 10 minutes. Security and access records are kept for 12 months.

Your rights

You can ask for a copy of your information, ask us to correct or delete it, object to or restrict its use, and ask for it in a portable format. In your profile you can download a copy of your data once a day, and ask for everything about you to be removed; we complete a removal within one month. Where a case is still in progress, it is finished or cancelled first, and the month runs from then. You can also email [email protected]. You can complain to the Information Commissioner’s Office (ico.org.uk).

For personal data inside a case, send your request to the firm that instructed us; we help them answer it.

Security

Files are stored encrypted in a private bucket in the EU (Cloudflare R2, EU jurisdiction) and are only reachable through short-lived links after we check your access. Only our production staff can open case material, under a duty of confidentiality; finance staff see billing details only. Openings and every download are recorded. Staff use separate accounts and must use two-factor sign-in. You sign in with a code sent to your email, and can add a password and two-factor sign-in in your profile. If a breach affects your information, we will tell you and the regulator as the law requires, within the time the law sets.

Changes

If we change this policy, we will update the date at the top of this page.