Privacy policy

Through this website I only collect information you choose to give me, or that a tool on this site needs in order to work. (The other cases are if I’ve contacted you about your business first, or if you become my client. Each has its own section further down: if I’ve contacted you and if you’re my client.)

• Get a quote form: your name, business name and business type, your email address, your phone number if you choose to give it, what you need help with, your budget range, your monthly budget if you choose one, and a description of your project.
• Contact form: your name, email address, phone number if you choose to give it, and your message.
• Time trial (“Time my site”): the website address you type in is sent to Google PageSpeed Insights to run the speed test. I don’t store the address or the result. To limit how often the tool can be used, I keep a scrambled (hashed) version of your IP address and the time of each check. Those rows are cleared once they are 24 hours old, the next time anyone uses the tool.
• Spam protection: to stop the same connection sending lots of forms in a short time, the quote and contact forms record your IP address and the time of the request in my Supabase database. These records are used only to limit repeat submissions.

I don’t use tracking cookies, and I don’t collect information about you just for browsing the site. See the cookie policy for details.

To respond to your enquiry: to understand what you need, put together a quote and get in touch with you about it. The Time trial details are used only to run the test you asked for and to stop the tool being overused, and the spam-limit records only to limit repeat form submissions. I don’t use any of it for marketing, and I don’t sell it or share it with anyone for their own purposes.

Form submissions are stored in a Supabase database (hosted in London, in the UK). Only I can read them, through my own account. The forms’ spam-limit records (IP address and time) and the Time trial’s hashed IP rows are kept in the same database.

This website is hosted by Cloudflare. Like any host, Cloudflare handles the technical details of your visit, such as your IP address, to deliver the pages to you. The Book a call page embeds Calendly’s booking calendar, which loads from Calendly whenever you visit that page, and any booking you make is handled by Calendly.

This site doesn’t run any analytics.

I keep quote and contact records for as long as reasonably needed to respond to you and, if you go ahead with a project, for basic business record-keeping afterwards. Spam-limit records (IP address and time) are kept only to apply the limit, and are cleared once they are 24 hours old, the next time anyone sends a form. Time trial rows (the hashed IP address and time) are cleared once they are 24 hours old, the next time anyone uses the tool. If you’d like your information deleted sooner, use the contact form and I’ll remove it.

Under UK GDPR you can ask me at any time what information I hold about you, ask me to correct it, or ask me to delete it. To ask, use the contact form and I’ll sort it myself. There’s no support queue.

If you’re unhappy with how I’ve handled your information, you can complain to the Information Commissioner’s Office (opens in a new tab).

• Supabase stores form submissions, the forms’ spam-limit records (IP address and time) and the Time trial’s hashed IP rows. See Supabase’s privacy policy (opens in a new tab).
• Cloudflare hosts this website. See Cloudflare’s privacy policy (opens in a new tab).
• Google PageSpeed Insights runs the Time trial speed test on the website address you enter. See Google’s privacy policy (opens in a new tab).
• Calendly powers the booking calendar embedded on the Book a call page, which loads from Calendly when you visit that page. See Calendly’s privacy policy (opens in a new tab).

If you’ve found this page from an email, letter or visit from me, this is what I keep about your business, where I got it, and how to make me stop.

What I keep. Your business name and address, your business phone number and email address, the names of owners or directors where they’re public (for example on Companies House or your own website), notes of any contact between you and me, and the public problems I noticed with your online presence, with where I saw each one and when.

Where it came from. Only public sources:

• Companies House
• OpenStreetMap
• the Food Standards Agency’s hygiene ratings
• your own website
• Google’s PageSpeed Insights tool, run on your website address
• your public Google profile, which I look at myself

Why. I offer web design to local businesses, and I think you may find that useful. My legal basis under UK GDPR is legitimate interests: I’ve written down why I think that’s fair to you, and weighed it against your rights. I don’t cold-email sole traders, English or Welsh partnerships, or businesses whose legal form I can’t confirm, and I only cold-call numbers I’ve checked against the telephone preference registers.

How long. If I never get in touch with you, I delete it after 6 months. If I do get in touch, I delete it 12 months after the last contact. If you become a client, I keep your details while you’re a client. After you stop being a client I review them and delete what I don’t need for my accounts, which I must keep for 6 years. If you ask me to stop, I keep only enough to make sure I never contact you again: your business name, email address, phone number, postcode, company number and website domain (for example yourbusiness.co.uk), with the reason and the date I added you to my do-not-contact list.

Your rights. You can object at any time, and I’ll stop and won’t contact you again. If I emailed you, the quickest way is to reply “stop”: every first email and follow-up I send ends with a line saying so. My letters don’t have that line, but they link to this page, so if I wrote to you, phoned or called in, just tell me to stop. You can also ask me for a copy of what I hold, or ask me to delete it. To do any of that, use the contact form.

If you’re unhappy with how I’ve handled your business’s details, you can complain to the Information Commissioner’s Office (opens in a new tab).

Where it’s held. In the same Supabase database in London, in the UK, as the rest of this page. Only I can see it. I don’t sell it or share it with anyone.

When you hire me for a website, automation or marketing work, I keep some extra information so I can do the work and run my business.

What I keep. Your name, business name, address, email address and phone number; the proposal, agreements and forms we’ve signed; invoices and payment records; our emails and my notes on the project; and the content you send me, such as words, photos and logos. If you give me access to accounts (for example your domain, Google Business Profile or social media pages), I keep those login details in a password manager, not in emails or documents.

Why. To do the work we’ve agreed and to get paid for it. My legal basis under UK GDPR is that I need it to carry out our contract. I keep financial records because the law requires it. I only show your site in my portfolio, or name your business as a client, if you’ve said yes to that in our agreement.

Where it’s held. In my business email, my accounting records and the same Supabase database in London, in the UK, as the rest of this page. Only I can see it. I don’t sell it. I only share it where I need to in order to run my business (for example, my bank handling your payments) or where the law requires it (for example, HM Revenue & Customs).

How long. I keep your details while you’re a client. After you stop being a client I review them and delete what I don’t need for my accounts, which I must keep for 6 years. When our work ends I remove my access to your accounts and remind you to change any passwords you shared with me.

Your customers’ information. If the work means I handle personal data about your customers (for example enquiries from your contact form, or the phone numbers an automation texts), I handle it on your behalf and only as you instruct. You’re responsible for it, and it’s covered by your own privacy notice and by the data-processing note in our agreement, not by this page.

Your rights. The rights in section 5 apply to you as a client too. To use them, use the contact form.

If this policy changes, I’ll update this page and the “last updated” date above.

Happy to explain anything on this page in plain English: use the contact form.