What I keep, why, and what happens to it

Privacy notice.

Last updated 18 August 2026 · UK data protection

The short version

I use client data to take orders, plan and deliver edits, communicate with you, secure the portal, keep business records and resolve payment/service problems. I do not sell client data or use it for third-party advertising.

Who controls your data

The data controller is Karim Huggins-Buschi, a sole trader trading as Hahkeemi b..

Address26 Abbott Road, E14 0GD, United Kingdom
Privacy contactkeemdoesvideo@gmail.com

What I collect

Identity & contactName/display name, email and any optional Discord, WhatsApp or social details you add.
Profile preferencesTime zone, pronouns if supplied, style notes and usual footage source.
Job informationBriefs, titles, platforms, footage links, planning dates, delivery links and revision notes.
Orders & paymentsWhat you bought, amount/date, PayPal order/capture identifiers, receipts and the Terms version accepted at checkout.
CommunicationsService-email history and manual notes I add after relevant Discord, email, call or meeting contact.
Security & operationsHashed sign-in/session tokens, session timing, browser user-agent where recorded, payment webhook/error data and internal audit events.

I do not receive or store your full card details. PayPal processes the payment and sends back the information needed to identify and reconcile the transaction, including payer details and payment identifiers.

Where the information comes from

Most information comes directly from you through checkout, the portal or our communications. Payment/payer information comes from PayPal. Operational records are created when the website performs actions such as sending an email, recording a payment, moving a job or logging a Studio action.

Why I use it — lawful bases

ContractTo create/manage your account, understand the brief, schedule work, deliver edits, handle revisions and communicate about the service you bought.
Legal obligationTo keep the sales/payment records I am required to keep for tax and accounting purposes.
Legitimate interestsTo secure the service, prevent/reconcile payment errors, maintain a limited business audit trail, respond to disputes and run the editing business effectively.

Optional reminder emails can be switched off in your portal. Essential emails about purchases, security, service decisions and delivery may still be sent while needed to provide or protect the service.

How long I keep it

  • Active client/profile and job content: kept while needed to provide your account and editing service. If you close the account, the system scrubs the profile and client-supplied creative/communication content that is not needed for retained records.
  • Orders, receipts and tax records: kept for at least the period required for self-employed business records — normally five years after the 31 January submission deadline for the relevant tax year, and longer where the law requires it or an HMRC enquiry remains open.
  • Sign-in data: magic links expire after 45 minutes and old link/session rows are periodically removed. An active server session expires after 90 days of inactivity; the browser session cookie can have a longer maximum lifetime but cannot authorise access without a valid server session.
  • Operational, security and reconciliation records: kept only for as long as reasonably needed to investigate errors, reconcile payments, secure the service, resolve disputes or maintain a proportionate audit trail. On account closure, private job/message payloads linked to the account are scrubbed where they are not needed for those purposes.

Who processes or receives data

  • Supabase — database and server-side account/booking records.
  • Vercel — website hosting and request/runtime infrastructure.
  • Resend — transactional and service emails.
  • PayPal — payment, authorisation, refund and payment-dispute processing.
  • Storage/delivery providers you or I use for a job — for example Dropbox or Google Drive where a source/delivery link points there.

These providers process data under their own infrastructure, security arrangements and contractual terms. I may also disclose information where reasonably necessary to comply with law, enforce or defend legal rights, or deal with fraud/payment disputes.

International processing

Some service providers can process or store information outside the UK. Where UK data protection law requires safeguards for an international transfer, I rely on the lawful transfer mechanism made available for the relevant provider/processing relationship.

Cookies and sign-in

The client portal uses a strictly necessary hb_session cookie after you sign in. The raw session token is held in the browser; the database stores a hash and the server-side session is what authorises access. The browser cookie can remain for up to a year, while the server session expires after 90 days of inactivity and can be invalidated sooner. An admin-only hb_asclient cookie is used solely when I open the test client portal. The site does not currently use advertising cookies or third-party analytics cookies.

Account closure

Closing an account removes portal access and scrubs the client profile, sign-in sessions, source/footage links, briefs, delivery links/notes, revision text, private contact notes and transient planning proposals. The system retains the minimum order/payment/receipt and operational history needed for accounting, reconciliation, security or legal records.

Some retained rows must remain structurally linked to a non-identifying former-client record so the accounting database remains internally consistent. The profile itself is replaced with a placeholder identity and the original contact/profile fields are removed.

Your data-protection rights

Depending on the circumstances, UK data-protection law can give you rights to ask for access to your personal data, correction, deletion, restriction, objection, or portability. Some rights have exceptions — for example, I may need to keep information that I have a legal obligation to retain or that is required to establish, exercise or defend legal claims.

To make a request, email keemdoesvideo@gmail.com. I may need enough information to confirm that the request relates to you before disclosing or changing account data.

If you are unhappy

Contact me first at keemdoesvideo@gmail.com so I can try to resolve the issue. You also have the right to complain to the UK Information Commissioner’s Office (ICO) about how your personal data has been handled.

Changes to this notice

I can update this notice when the website, providers or legal requirements change. The current version is published on this page with its last-updated date. Changes to the Privacy notice do not silently rewrite the commercial Terms attached to an already-paid order.