Privacy policy
Last updated: 13 August 2026
This Privacy Policy explains how 4923 LTD, trading as "RED" (company number 15996709, registered office 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ) ("RED", "we", "us") collects and uses personal data when you use the Envelope service ("Envelope", the "Service"). RED is the data controller, registered with the UK Information Commissioner's Office under reference ZC186866. This policy is written to meet the UK GDPR and the Data Protection Act 2018.
1. What data we collect
- Account and billing data — your name, email address, and billing details. Payment card details are collected and stored by Stripe, not by us; we receive only limited transaction and customer information.
- Communications — the messages, briefs, files, canvases, and other content you submit in your private Slack channel, and our replies.
- Deliverables and project data — the design work produced for you and related project notes.
- Call data (Call plan) — scheduling details via cal.com and, where calls are recorded, transcripts and notes.
- Technical data — basic logs and analytics from serving the website (via Cloudflare), such as IP address and request metadata.
2. How and why we use it (lawful bases)
| Purpose | Data | Lawful basis (UK GDPR) |
|---|---|---|
| Provide the Service, produce and deliver design work, respond to briefs | Account, communications, project data | Performance of a contract (Art. 6(1)(b)) |
| Take payment and manage billing | Account and billing data | Performance of a contract (Art. 6(1)(b)) |
| Schedule, run, and record calls (Call plan) | Call data | Contract; consent for any recording (Art. 6(1)(a)) |
| Operate, secure, and improve the Service and website | Technical data | Legitimate interests (Art. 6(1)(f)) |
| Showcase completed work in RED's portfolio | Deliverables, project name | Legitimate interests, subject to opt-out (Art. 6(1)(f)) |
| Legal and accounting compliance | Billing records | Legal obligation (Art. 6(1)(c)) |
3. Automated processing by AI providers
Envelope uses a design agent (@RED). The briefs and content you submit are processed by third-party AI providers to generate design output. This means your submitted content is sent to those providers for processing. We do not use your content to train our own or third parties' public foundation models beyond what is necessary to produce your Deliverables, and we select providers that offer business/API terms excluding your data from their model training by default. No fully automated decision producing a legal or similarly significant effect on you is made (Art. 22).
4. Who we share it with (processors)
We use the following processors and service providers, who act on our instructions:
| Provider | Purpose | Location / transfers |
|---|---|---|
| Stripe | Payment processing, billing | US / global (SCCs / UK IDTA) |
| Slack (Salesforce) | Private client channels / silos | US / global (SCCs / UK IDTA) |
| Cloudflare | Website hosting (Pages), CDN, access gating | US / global (SCCs / UK IDTA) |
| Anthropic / AI provider(s) | Design agent processing of briefs | US / global (SCCs / UK IDTA) |
| cal.com | Call scheduling (Call plan) | US / global (SCCs / UK IDTA) |
| Fireflies | Call transcripts & notes (Call plan) | US / global (SCCs / UK IDTA) |
Where these providers are outside the UK, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. We do not sell your personal data.
5. How long we keep it
We keep personal data only as long as needed for the purposes above:
- Account, communications and project data — for the life of your subscription and for [12 months] afterwards, then deleted or anonymised.
- Billing and tax records — for [6 years] to meet UK accounting and tax obligations.
- Call recordings and transcripts — for [period], then deleted.
6. Your rights
Under UK GDPR you have the right to: access your data; have inaccurate data corrected; have data erased; restrict or object to processing; data portability; and, where we rely on consent, to withdraw it at any time. To exercise any of these, email hi@slash.red. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
7. Cookies
The Envelope website is static and does not set marketing or analytics cookies. Our host (Cloudflare) may set strictly necessary cookies for security and delivery.
8. Changes
We may update this policy from time to time; the "Last updated" date shows the current version.
9. Contact
Data protection queries: hi@slash.red.