Privacy Policy

1. Who we are

Thomas Brown, trading as mrportz ("mrportz", "I", "me"), is the data controller for personal data described in this Privacy Policy.

This website starts commissions. Ongoing work happens in Discord.

Contact for privacy requests: Discord username mrportz.

2. What this policy covers

This policy explains how I handle personal data when you visit lookdev.net (or related domains pointing here), when you contact me about commissions, and when I deliver work for you.

It does not cover third party sites such as Discord, lookdev.art, or payment providers. Those services have their own policies.

3. Personal data I collect

Depending on how we interact, I may process:

• Discord OAuth (identify scope): Discord user id and username while you are connected, stored in a signed session cookie so the site can create your channel.
• Commission start form: project title and brief text sent to Discord when a channel is created (not stored long term on this site unless server logs retain it briefly).
• Discord server content: messages and files you send in commission channels are processed by Discord under their policy.
• Billing: name and address for invoices when a job is invoiced.
• Payment related data: transaction references, amounts, and dates (payment card details are handled by payment processors, not stored by me unless required for accounting).
• Technical data: IP address, browser type, and standard server logs from hosting this static site.
• Portfolio and marketing: with your permission, screenshots or descriptions of completed work.

4. How I use personal data

I use personal data to:

• Respond to enquiries and provide commissioned Services.
• Prepare quotes, invoices, and delivery of files.
• Keep records for tax, accounting, and legal compliance.
• Protect against fraud, abuse, or disputes.
• Improve my website and portfolio with aggregated, non identifying analytics if enabled by hosting.
• Show completed work publicly only as described in the Commission Terms and any confidentiality agreement.

5. Lawful bases (UK GDPR)

I rely on the following lawful bases where applicable:

• Contract: processing needed to perform a commission or take steps at your request before a contract.
• Legitimate interests: running a freelance business, portfolio display of completed work, site security, and limited record keeping, balanced against your rights.
• Legal obligation: tax and accounting records.
• Consent: where required for optional marketing or sensitive uses beyond the commission.

6. Sharing and processors

I do not sell personal data. I share data only when necessary:

• Hosting and infrastructure providers that serve this website and store backups.
• Payment processors when you pay an invoice.
• Professional advisers (accountant, lawyer) when required.
• Authorities when required by law or to protect legal rights.

7. Retention

Commission messages and project files are kept for as long as needed to deliver the work, handle warranty or dispute periods in the Terms, and satisfy tax and accounting rules (typically up to seven (7) years for financial records).

Enquiry messages that do not become a commission are deleted within a reasonable period unless you ask me to retain them.

Server logs are retained according to hosting provider defaults unless a shorter period is configured.

8. International transfers

Some providers may process data outside the UK. Where required, I use appropriate safeguards such as UK adequacy regulations or standard contractual clauses offered by the provider.

9. Your rights

Under UK data protection law you may have the right to access, rectify, erase, restrict processing, object, and data portability where applicable.

You may withdraw consent at any time where processing is based on consent, without affecting prior lawful processing.

You may lodge a complaint with the Information Commissioner's Office (ICO) in the UK.

To exercise rights, contact me on Discord. I may need to verify identity before responding.

10. Security

I use reasonable technical and organisational measures appropriate to a solo freelance practice, including access controls and reputable hosting. No online transmission is completely secure.

11. Children

Services are not directed at children under 16. I do not knowingly collect data from children. If you believe a child has contacted me, ask them to stop and notify me so I can delete relevant messages.

12. Cookies and similar technologies

This site is largely static and does not use advertising trackers or analytics cookies that I control. Hosting may set essential cookies or process IP addresses for security and delivery.

If that changes, this policy will be updated and any non essential cookies will be disclosed.

13. Changes to this policy

I may update this Privacy Policy by posting a new version on this site with an updated effective date. Material changes will be highlighted where practical.