Who we are
Millstone is operated by Farside Ltd, a company registered in England and Wales, at The Conifers, Wardington, Banbury, OX17 1SP. For the personal data described here we are the data controller, except where a studio uses Millstone to hold data about its own clients, contractors and leads: for that data the studio is the controller and we process it on the studio's behalf, under our terms.
Questions about this notice: info@farsidestudio.com.
What this notice covers
It covers Millstone: the pages you see when signed in, and the links we send that work without an account, such as proposals, contractor agreements, questionnaires, invoices and meeting bookings.
It also covers our public website at millstone.work. The website is separate software and is described in its own section, Our public website, below. Everything else in this notice means the application.
You may be reading this on our website rather than in the application. We write this notice once, in the application, and the website republishes the current wording, so there is only ever one version of it.
What we collect
Contact and company records. For each person a studio records a name, and optionally a first and last name, an email address, a phone number, free-text notes, where the relationship came from, skills, and links to a website, LinkedIn, Instagram or another social profile. A studio may also hold an internal rating and a "hot / warm / cold" marker for its own follow-up. For each company it records a name, an email address, a phone number and notes. For contractors it separately holds day rates and VAT status, which only that studio's administrators can read.
Account details. If you have a login, we hold the email address you sign in with. Sign-in is handled by our database provider's authentication service; we never see or store your password.
Signatures. When you accept a proposal or sign a contractor agreement through a link you were sent, we record the name and email address you typed, the time you signed, a fingerprint of the exact document you agreed to, the browser user-agent string, and the IP address our hosting provider reported for the request. The IP address and user agent are recorded as evidence of the circumstances of signing. They may be blank: we store nothing rather than a guess when the value is missing or unreadable.
Project material. Projects, tasks, deliverables, meeting notes, time entries, expenses, bookings, proposals, agreements and invoices, together with any files uploaded to a project. These can contain personal data if somebody puts it there, such as a name in a note or a person in a document.
Meeting bookings. When you book a meeting through a link you were sent, we record the name and email address you gave, the slot you chose, and anything you wrote in the box asking what you would like to talk about. You do not need an account to do this.
Billing. When a studio subscribes to Millstone we hold its billing email address and the state of its subscription. Card details are entered on our payment provider's own pages and never reach us.
Usage analytics. We keep a log of things that happen in the application so we can see which parts of it get used, and so a studio knows whether a proposal or agreement it sent has been opened. The events we record are: page views, sign-ins, sign-outs, file downloads, the fetching and the opening of a proposal or agreement link, the opening and approval of a deliverable, the opening of an invoice, the opening of a review round, acceptance of a proposal, and a handful of studio actions such as creating or sending a proposal, sending an invoice, marking one paid, creating a record, completing a task and starting or stopping a timer.
Each event row holds the event name, the time the server received it, the page it happened on, your user id if you were signed in, a session id, and a small set of properties.
The page is stored as the path your browser was on, which on a record page includes that record's id. For page views we store a shaped version of it alongside, such as /admin/people/:id, and that shaped version is what our own reporting reads. The query string is never stored.
The properties are ids, counts and fixed values only, never names, email addresses or the text of a note. That is a rule our code follows rather than something the database enforces, so we state it as a practice, not a guarantee.
Assistant activity. If you connect an AI assistant to your account, every call it makes is logged: which tool it used, when, and whether it read or changed something. The log does not hold the content it read.
What we deliberately do not collect in the application
The application's analytics log records no IP address, no device or browser fingerprint, no referrer chain, and no identifier that could follow you to another website. There is no third-party analytics product in the application: the events go to our own database and nowhere else, and no analytics or advertising script runs on any page of it.
The session id that groups one visit's events together is not a cookie and is not persistent. It is held in your browser's sessionStorage, which means it is discarded when you close the tab, and a new one is created next time. It exists to put one visit's events in order, not to recognise you tomorrow.
Why we collect it, and our lawful basis
To provide Millstone to studios and the people they work with: running projects, quoting, contracting, invoicing, arranging meetings and sharing files. Lawful basis: performance of a contract, or steps taken at your request before entering one.
To keep a record of what was agreed: signatures, document fingerprints and the circumstances of signing. Lawful basis: our legitimate interest, and the studio's, in being able to demonstrate what was agreed and by whom, and legal obligations to keep accounting records.
To run and improve the application: the usage analytics described above. Lawful basis: our legitimate interest in understanding whether the application works and whether the documents sent through it are being read. We have kept this to the minimum that answers those questions, which is why there is no IP address, no fingerprint and no third-party tracker.
To bill studios for their subscription. Lawful basis: performance of a contract.
To keep the service secure: sign-in records, two-factor codes, error logs and the record of assistant and API key use. Lawful basis: our legitimate interest in protecting the service and the data in it.
Where we rely on legitimate interests you can object, and we will stop unless we have a compelling reason not to. See Your rights below.
Product news
If you run a studio on Millstone (as its owner, an admin or a team member) we may ask whether you would like occasional emails about new Millstone features. We send them only if you say yes, and our legal basis is your consent (UK GDPR Article 6(1)(a) and PECR regulation 22). We use your email address and the name on your account, and we keep a record of your choice, the wording you were shown, and when and where you gave it, so we can show that you agreed. You can withdraw at any time, as easily as you gave it, by turning off Product news in Settings, Account, or by using the unsubscribe link in any of these emails. We send them through our email provider, Resend. We delete the record when your account is erased or closed. We never ask a studio's clients or contractors, and we never use a studio's own contacts for this.
Cookies and browser storage
A sign-in cookie. Set by the application, on its own domain, and it holds the session that Supabase's authentication service issued when you signed in. Strictly necessary: without it the application cannot tell who you are.
A "view as" cookie. Only ever set for studio administrators, when one of them previews the interface a client or contractor sees. It cannot be read by scripts in the browser, it only ever removes what is shown, and it is cleared when you close the browser.
Interface preferences. These are not cookies. Your light or dark choice, the widths you drag table columns and side panels to, which columns you have hidden on a table, and the icons you picked most recently are kept in your browser's localStorage. They are never sent to our server and they apply to that browser only.
The analytics session id. Also not a cookie: sessionStorage, gone when the tab closes, as described above.
There is no advertising cookie and no cross-site tracking cookie in the application, and no other company sets a cookie on it.
Your analytics choice
The usage analytics described above store a session identifier in your browser, so we ask before switching them on and we do not switch them on until you say yes. Declining changes nothing else about how the application works, and you can change your mind here at any time.
Saying no stops the page-view log: no session id is made, and your browser sends us nothing for it.
Two things sit outside this choice, and we would rather be exact about them than tidy. The first is what our own servers record from a request as it arrives: that you signed in, and that a link you were sent was fetched. Nothing is stored on or read from your device to do that.
The second is narrower and is genuinely sent by your browser. When you open a proposal, an agreement, an invoice, a deliverable or a review round, the page tells us it was opened. It is a separate signal because a server cannot tell the difference between a person and the link previewer in an email client, which fetches a URL to draw a thumbnail before anybody has clicked it, and knowing whether a document actually reached a human is the reason we record this at all. When you have not said yes, it still stores nothing on your device and creates no session id; it records that the document was opened, and when. It is not switched off by the control below.
{{consent}}
Who we share it with
We do not sell personal data and we do not share it for advertising. The companies below are our sub-processors; the sub-processors page names each one, what reaches it, where it is, and the terms we rely on.
Supabase hosts our database, our authentication and our file storage. All of the data described in this notice sits there, in Paris, France.
Vercel hosts and serves the application itself, from Paris, and therefore processes requests as they pass through.
Resend sends the email the application writes: proposals, invoices, reviews, reminders, invitations, account notices, the sign-in and password-reset links, and product news to those who asked for it.
Stripe takes a studio's subscription payment. Card details are entered on Stripe's own pages and never reach us.
Cloudflare answers for our domain's addresses and forwards mail sent to hello@ and support@millstone.work.
Google, only when somebody at a studio has connected their own Google Calendar. If you book a meeting with a person who has done that, we create the booking in their calendar: Google receives your name, your email address, and the meeting's title and times, adds you as a guest, and emails you the invitation and any cancellation. If nobody has connected a calendar, the booking is confirmed by the application on its own and none of this happens.
What we do with a connected Google Calendar. Connecting asks Google for two permissions. With the first (calendar.readonly) we read the list of your calendars and, for the ones you choose, only the times you are busy, through Google's free/busy service. We never read the titles, descriptions, locations or guests of your events. With the second (calendar.events) we create, move and cancel the events for meetings booked through Millstone, in the one calendar you choose, with a Google Meet link. We store the access we are given encrypted. We use it only to show when you are free and to keep your bookings in your calendar. We do not sell it, use it for advertising, or use it to train AI models, and nobody reads it unless you ask us to, the law requires it, or it is needed for security. Disconnecting in Settings revokes our access at Google and deletes what we stored.
Millstone's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
AI assistants, only if a person connects one to their own account. While the connection is live the assistant can read and change what that person could, and what it reads reaches the company that provides it, such as Anthropic or OpenAI. It is off unless somebody sets it up and can be revoked at any time.
We will also disclose data where we are legally required to, and to our own professional advisers where necessary.
Our public website
Everything above is about the application. Our website at millstone.work is separate software and we would rather describe it than let a reader assume the application's answers apply to the page in front of them.
It runs no analytics, sets no cookies and loads nothing from any other company. The only things it keeps on your device are your own choices, in your browser's localStorage: light or dark, the grid view, and which docs sections you folded, plus a note in sessionStorage so the opening animation plays once per tab. If you are signed in to the application, the website asks it once whether you are, so it can offer Open app or Log out; that request carries the application's own sign-in cookie, which the application set, not the website. None of this is behind the choice offered in this notice because there is nothing on your device for that choice to govern.
The signup and waitlist forms are ours. What you type into them is sent to the application and stored there, and from that point the rest of this notice applies to it in the ordinary way.
The legal notices on the website are republished from the application, word for word, and refreshed within a few minutes of a change.
Where the data is held
In a Postgres database run by Supabase, and in Supabase's file storage, in Paris, France (eu-west-3). The application is served from Vercel's Paris region.
A meeting booked into a connected Google Calendar also exists in that Google account, on Google's infrastructure, for as long as the event does. Where any provider stores or processes data outside the UK, we rely on the transfer safeguards in their data processing terms, as set out on the sub-processors page.
How long we keep it
Project and financial records: seven years. Proposals, agreements, signatures, invoices and the projects they belong to are kept for seven years from the date the record was issued, and then reviewed and cleared. HMRC and the Companies Act require six years from the end of the relevant accounting period, and seven is what six becomes once you are counting from a record's own date rather than from a year end. Signatures and document fingerprints are part of this: they are the evidence that an agreement existed and what it said.
Contact records: reviewed after three years. Names, email addresses and phone numbers are kept while the relationship is live. After three years with no recorded contact a record is marked dormant and comes up for review by the studio. It is not deleted automatically: a quiet client is not the same as a former one. What happens at review is a decision a person makes.
Analytics events. Deleted automatically six months after they happened.
Assistant activity. Part of the same log, deleted after six months.
Error log. Deleted automatically ninety days after the error was resolved or last seen.
A closed studio. When a studio closes its account, its data is kept for thirty days so the closure can be undone, then deleted. Records the studio must keep by law can be exported before closing.
Your rights
Under UK GDPR you have the right to:
- ask what personal data we hold about you, and get a copy;
- have inaccurate data corrected;
- ask us to delete data, where we do not have to keep it for a contract or a legal obligation;
- ask us to restrict how we use it while a question is resolved;
- receive data you gave us in a portable, machine-readable form, or have it sent to someone else;
- object to us using it where we rely on legitimate interests, including the usage analytics described above.
There is no automated decision-making in Millstone that produces legal effects, and no profiling for advertising. The internal ratings a studio keeps on contact records inform its own follow-up and nothing is decided automatically from them.
If your data is held by a studio that uses Millstone, the studio is the controller for it and the request is theirs to answer; we will help them do so. Ask us using the contact details below. We will respond within one month.
How to contact us, and how to complain
Email info@farsidestudio.com, or write to Farside Ltd, The Conifers, Wardington, Banbury, OX17 1SP.
If you are not happy with how we have handled your data you can complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. We would rather you came to us first so we can put it right, but you do not have to.
Changes to this notice
If we change what we collect or what we do with it, we will update this page. Last updated: 26 October 2026.
---
Draft, not legal advice. This notice was assembled by reading the application's source code and describes the system as built. It has not been reviewed by a solicitor and should be checked professionally before it is relied on.