Framecraft, a trading name of Bia Creative Ltd · BC-PP-001 · Version 2.0 · October 2026 · last updated 23 October 2026

 

 

1. Who we are

Bia Creative Ltd, trading as Framecraft, is the controller of the personal data described in this notice. We are registered in England and Wales, company number 13377889, registered office 18 Bond Street, Brighton BN1 1RD, VAT number 388 3641 55. ICO registration reference ZC278270. We also trade as A Life Of Literature for some work; this notice covers that work too.

 

Privacy contact: Jon Lee, Director. Email privacy@framecraft.io. Post: Bia Creative Ltd, 18 Bond Street, Brighton BN1 1RD.

 

 

2. What this notice covers

This notice explains how we collect and use personal data when you:

 

• visit framecraft.io or shop.framecraft.io, or mireille.world, the site of one of our creators, which we also operate and the site of our A Life Of Literature content brand, published at a Wix address while its alifeofliterature.com domain is reconnected;
• contact us, book a call or ask for a quotation;
• engage us for content services under our Services Terms and Conditions (FC-TC-001);
• open a Frameport account and place orders under the Frameport Online Services Terms (FC-TC-002);
• visit our premises, which have CCTV; or
• work with us as a freelancer or supplier.

 

Where a client or Frameport customer sends us content that contains personal data about other people, for example footage of identifiable individuals, the client or customer is the controller of that data and we process it on their instructions as a processor. Section 7 explains how. This notice is about the data for which we are the controller.

 

 

3. The personal data we collect

You give us: your name, job title and organisation; email address, telephone number and postal address; the content of enquiries, correspondence and support requests; project details such as delivery instructions and technical specifications; billing details, billing country and VAT number; your Frameport account details (email, password, which we store only as a hash, and multi-factor authentication settings); your Frameport orders, including file names, durations and formats; and, if you sign in with a third-party identity provider, the identifier that provider gives us.

 

On mireille.world you may give us your name and email address to join the mailing list, and a city and country if you RSVP for a show; the shop page collects nothing until a shop opens, and this notice will be updated before it does.

 

We collect automatically: your IP address, browser and device type, pages visited and referring site, when you visit our websites; sign-in events, session and security events on Frameport, including IP address and browser type; and download events for your orders.

 

We do not collect card numbers. Payments are taken by our payment processor, which gives us a reference and the last four digits only.

 

CCTV at our premises records images of visitors for security. Footage is kept for 90 days and then overwritten.

 

 

4. Why we use your data and the lawful basis

Answering enquiries, quotations and booked calls
Lawful basis (UK GDPR Article 6): Legitimate interests: responding to people who contact us

 

Performing a Work Order or a Frameport order, including delivery and support
Lawful basis (UK GDPR Article 6): Contract

 

Running your Frameport account, including security, fraud prevention and session controls
Lawful basis (UK GDPR Article 6): Contract; legitimate interests in keeping the service secure

 

Invoicing, payment, VAT, accounting and tax records
Lawful basis (UK GDPR Article 6): Legal obligation; contract

 

Sending service messages about your orders or account, and notices of changes to our terms
Lawful basis (UK GDPR Article 6): Contract; legitimate interests

 

Telling you about a new service or feature where you have an account or an active relationship with us; you can opt out at any time
Lawful basis (UK GDPR Article 6): Legitimate interests; consent where the law requires it

 

Sending the mireille.world mailing list to people who joined it; every message carries an unsubscribe link
Lawful basis (UK GDPR Article 6): Consent

 

Keeping our websites and systems secure and detecting misuse
Lawful basis (UK GDPR Article 6): Legitimate interests; legal obligation

 

Website analytics, where you opt in
Lawful basis (UK GDPR Article 6): Consent

 

CCTV at our premises
Lawful basis (UK GDPR Article 6): Legitimate interests: security of people, content and equipment

 

Dealing with legal claims and regulatory requests
Lawful basis (UK GDPR Article 6): Legitimate interests; legal obligation

 

Where we rely on legitimate interests we have weighed them against your rights, and you can ask us for that assessment.

 

 

5. Who we share your data with

We do not sell personal data. We share it only with:

 

• Service providers acting for us, listed in the table below, each bound by a contract that restricts what they can do with it.
• Freelancers who help deliver a project, under confidentiality obligations and only what the project needs.
• Our accountant, insurers and legal advisers where necessary.
• HM Revenue & Customs, regulators, courts and law-enforcement bodies where the law requires, and law-enforcement authorities or recognised anti-piracy and content-protection bodies where content uploaded to Frameport appears to be pirated, obscene or otherwise unlawful.
• A buyer or successor of our business, who would take over this notice.

 

Our service providers, by category. Clients and Frameport account holders can ask us for the named list and each provider’s location at any time.

 

Email, calendar and documents
What for: Correspondence, booked calls, project records
Where data is held: UK/EU regions of a US group, with UK transfer safeguards

 

Website hosting and forms
What for: framecraft.io, the contact form and website contacts
Where data is held: EU/US, with UK transfer safeguards

 

Application hosting and database
What for: Frameport accounts, orders and file records
Where data is held: United Kingdom

 

File storage
What for: Frameport content and outputs
Where data is held: European Economic Area

 

Network security and encryption
What for: In front of both websites
Where data is held: Global network; UK traffic

 

Payment processing
What for: Taking payments; the processor holds your card details as a controller under its own notice
Where data is held: UK/EU entity of a US group, with UK transfer safeguards

 

Invoicing and accounts
What for: Invoices and receipts
Where data is held: UK/EU

 

Automated media analysis
What for: Quality-control analysis for the Frameport QC report service and for content-services work where agreed
Where data is held: United Kingdom

 

Managed file transfer
What for: Receiving and delivering client files for content services
Where data is held: UK/EU endpoints of US groups, with transfer safeguards

 

Third-party AI services
What for: Frameport services that use them (section 6); configured so that your content is not used for training
Where data is held: United States, under the safeguards in section 8

 

AI assistant for our own administration
What for: Drafting correspondence, quotations and documents, business development, customer records and research; may see your business contact details and project information, never client content; configured so that nothing submitted is used for training
Where data is held: United States, with UK transfer safeguards (standard contractual clauses)

 

Error and uptime monitoring
What for: Technical events for Frameport; no content
Where data is held: EU/US

 

Password and secrets management
What for: Our own credentials; holds no customer data
Where data is held: US; no personal data of customers

 

 

6. AI and automated processing

Content services. We do not use artificial intelligence or machine-learning tools on client content unless the client’s Work Order says so. Where a Work Order enables them, the client’s content is never used to train any model, third-party services are configured to the same rule, and the client can ask for the list of tools used.

 

Frameport. Some Frameport services use automated tools, including AI tools that run on our own equipment in the United Kingdom and AI services from third parties, to analyse, describe, transcribe, assess or convert the files you upload. We do not use your files or outputs to train any model, ours or anyone else’s. Third-party AI services are used under our own accounts, configured so that your content is not used for training, and with no retention beyond the processing task. The providers we use are mainly based in the United States and process content there; section 8 explains the safeguards, and each service’s page says whether it uses them. Automated outputs can contain errors; the Frameport terms ask you to check them before you rely on them.

 

Our own administration. We use an AI assistant to draft correspondence, quotations and documents, to support business development and research, and to work with our customer records. It may see your business contact details and the business information you share with us. It never sees client content, and it is configured so that nothing we submit is used to train the provider’s models. Any processing of customer records by software, rather than by a person working interactively, is done through the provider’s business service under a data processing agreement.

 

Decisions about you. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Frameport’s automated checks (such as price calculation, VAT determination and sign-in security) do not have such effects, and you can ask a person to review any outcome.

 

 

7. Content that contains other people’s personal data

If you send us footage, audio or documents that feature or describe other people, you are the controller of that personal data and we are your processor. We process it only to perform the work you have ordered, keep it confidential, apply the security measures in section 10, delete it at the end of the agreed retention period, and engage sub-processors only as our terms allow. Content-services clients enter into a data processing agreement with us under our Services Terms; Frameport customers have the processing terms built into the Frameport terms (Schedule 1). If you appear in content a client has sent us and have a question about it, please contact the client, who decides how it is used; we will help them respond.

 

 

8. International transfers

We keep personal data in the United Kingdom wherever we can. Some of our providers are part of groups based outside the UK, and some processing (for example email and payment processing) touches servers in the EEA or the United States. Files uploaded to Frameport are stored in the European Economic Area. Content sent to third-party AI services for a Frameport service that uses them is processed in the United States. Where personal data leaves the UK we rely on a UK adequacy regulation, on the provider’s certification under the UK Extension to the EU-US Data Privacy Framework, on the International Data Transfer Agreement or Addendum approved by the Information Commissioner, or on the provider’s binding corporate rules. You can ask us for details of the safeguard used for any transfer.

 

 

9. How long we keep your data

Enquiries and correspondence that do not lead to work
Kept for: 2 years from last contact
Why: Legitimate interests

 

mireille.world mailing list and RSVP entries
Kept for: Until you unsubscribe or ask us to remove you; RSVP entries 12 months after the show
Why: Consent

 

Client project records, Work Orders and delivery records
Kept for: Duration of the relationship plus 6 years
Why: Limitation period for contract claims

 

Frameport account data
Kept for: While the account is open, then 6 years
Why: Contract and tax records

 

Frameport content and outputs
Kept for: 7 days after delivery, then deleted; abandoned uploads removed after 24 hours
Why: Processing service, not storage

 

Frameport order and payment records
Kept for: 6 years after the end of the financial year
Why: HMRC

 

Frameport security and audit events
Kept for: Operational events 90 days; the record of each order’s lifecycle for as long as the order record
Why: Security; evidence of what was done to an order

 

Invoices, payments and accounting records
Kept for: 6 years after the end of the financial year
Why: HMRC

 

Website analytics (where you opted in)
Kept for: 26 months
Why: Provider default

 

CCTV
Kept for: 90 days
Why: Security

 

Freelancer and supplier records
Kept for: Duration of engagement plus 6 years
Why: Employment, tax and limitation periods

 

When data is no longer needed we delete it or anonymise it. Physical media are destroyed under our media destruction policy.

 

 

10. Security

We hold a recognised industry content-security assessment for our content services and apply the same discipline to personal data. Our measures include encryption of data in transit and at rest; network segmentation with default-deny rules between zones; named accounts with multi-factor authentication for administrators and cloud services; endpoint protection and central security monitoring; CCTV, locked premises and a short list of key holders; confidentiality obligations on everyone who works with us; and regular review of our security measures. No system is perfectly secure. If a breach affects your personal data we will tell you and, where required, the Information Commissioner, within the time the law sets.

 

 

11. Your rights

You can ask us to: give you a copy of your personal data (access); correct it (rectification); delete it, where there is no overriding reason to keep it (erasure); restrict how we use it; give you a copy in a machine-readable form where we process it by automated means on the basis of contract or consent (portability); and stop processing based on legitimate interests or for direct marketing (objection). Where we rely on consent you can withdraw it at any time. You also have the right not to be subject to a solely automated decision with legal or similarly significant effects.

 

To exercise a right, contact us using section 1. We respond within one month, extendable by two further months for complex requests, in which case we tell you within the first month. Requests are free unless clearly unfounded or excessive. We may ask you to confirm your identity.

 

Frameport customers can update most account details themselves. To close an account and have its data erased, use the account settings or contact us; we keep what the law requires us to keep (section 9) and delete the rest.

 

 

12. Cookies

framecraft.io is hosted by Wix. It sets cookies that are strictly necessary for the site to work and for security, and Wix’s own cookies for site performance and, where you accept them, analytics. You choose through the cookie banner on your first visit and can change your choice at any time there or in your browser; the banner’s settings list the cookies currently set.

 

mireille.world is also hosted by Wix and sets the same kinds of cookies as framecraft.io, managed through its own banner.

 

shop.framecraft.io sets: a sign-in cookie that keeps you signed in (strictly necessary; expires when your session ends); a cookie that remembers your cookie choice (strictly necessary; 12 months); and, only if you opt in, analytics cookies, of which none are in use at present. Our payment processor sets its own cookies on the payment step for fraud prevention. Change your choice at any time through “Cookie settings” in the footer.

 

 

13. Children

Frameport accounts are for people aged 18 or over. Our websites and services are not directed at children under 16 and we do not knowingly collect their data. If you think we have, contact us and we will delete it.

 

 

14. Changes to this notice

We may update this notice. The current version and its date are shown at the top. If a change materially affects how we use your data, we tell account holders and active clients by email before it takes effect.

 

 

15. Complaints

If you are unhappy with how we have handled your personal data, please tell us first using section 1 and give us the chance to put it right. You also have the right to complain to the Information Commissioner’s Office: Wycliffe House, Water Lane, Wilmslow SK9 5AF; 0303 123 1113; ico.org.uk/make-a-complaint.