Who we are
designs and builds websites for small businesses. Address: . ICO registration number: . We are the "controller" of the personal information described here. Questions about your information: or .
What we collect and why
| What | Why we use it | Legal basis |
|---|---|---|
| Contact form: name, email, phone (optional), business name and your message | To reply to you | Legitimate interests (answering your question) |
| Order form: your contact and business details, the package and options you chose | To contact you about your order, confirm the price and invoice you | Steps to enter into a contract with you |
| Website brief: details about your business, services, hours, social links and anything else you tell us | To design and build your website | Contract |
| Visitor statistics: pages viewed, the site that sent you, campaign tags, country, device type, and a random number kept in your browser to tell new visitors from returning ones | To understand how people use our site and improve it | Legitimate interests |
| Spam protection on our forms: your IP address and technical signals from your browser, checked by Cloudflare Turnstile | To stop automated spam and abuse | Legitimate interests (keeping our forms and your data safe) |
| Notes we make about our calls and emails with you | To keep track of what we agreed | Contract / legitimate interests |
| Emails you send us or we send you: who sent and received them (names and email addresses), the date, subject line, a short preview and whether there are attachments | To see your emails alongside your enquiry or order, so we can reply properly and keep track of the work | Contract / legitimate interests |
Visitor statistics without cookies
We don't use advertising or tracking cookies, so there's no cookie banner. To count how many different people visit, and how many come back, our statistics keep a random number and the date of your first visit in your browser's local storage (not a cookie). The number is made up by your browser – it isn't linked to your name, email address or anything you type, and we only store a scrambled version of it. We use it for visitor statistics only, never for advertising, and we don't share it.
To tell people from bots, we also note which pages are requested and by what kind of browser or program, using an anonymous code made by scrambling your IP address and browser details together with a secret key and today's date, so the code is different every day. We don't store your IP address with your visit. To stop spam and abuse, we also keep a scrambled version of the IP address that sends a form for up to 24 hours.
If your browser sends a "Do Not Track" or "Global Privacy Control" signal, we don't count your visit and nothing is stored. You can also stop it here at any time: This stops both the statistics in your browser and the page counting on our server, for this browser. To remember your choice, your browser keeps a small note of it, including a cookie that only says "don't count me" – it isn't used for anything else. If you clear this site's data, your choice is forgotten and the random number is removed too.
Our pages, including our example sites, don't load anything from Google: our fonts are served from our own website.
Our forms use Cloudflare Turnstile, an “I'm human” check that replaces annoying picture puzzles. When you use a form, it checks your browser and IP address to tell people from bots. See Cloudflare's privacy policy for details.
Stored on your own device: your browser remembers which page you first arrived on until you close the tab, so we can see which pages lead to orders. The order and brief forms save your answers on your device so you don't lose them if you leave and come back. After you place an order, your device also keeps your order reference and the private link to your website brief, so you can get back to it. You can remove all of this at any time by clearing this site's data in your browser settings – nothing here is sent to us until you submit a form.
AI assistant
We use Anthropic (Claude) to help our team analyse enquiries and draft replies. It only runs when a team member chooses, or under limits set by the owner. For enquiries we send the minimum needed: your first name, business, town and the message you typed – never your email address or phone number.
When a team member asks it to summarise an email conversation or draft a reply, we send the text of the recent emails in that conversation to Anthropic, with email addresses and phone numbers removed first. Anthropic processes this on our behalf to produce the summary or draft; a team member always checks a draft before anything is sent.
Website chat assistant. If the chat assistant on our website is switched on and you use it, what you type in the chat is sent to Anthropic to write the reply. We don't save your chat messages. To prevent abuse, we limit how many questions can be asked using a scrambled version of your IP address (never the address itself), kept for up to 24 hours, and the chat uses the Cloudflare Turnstile check described above. Please don't type personal details such as health information into the chat – use the enquiry form if you want us to contact you.
We delete AI conversations and their messages after 12 months without activity, and AI analyses and proposed actions after 12 months. Scrambled email, phone and network-address codes used to spot repeat enquiries are cleared after 7 days. We keep AI usage records for 2 years. Batch-job records are deleted once they are more than 30 days old and their results have been collected.
Website previews
We give you a private preview code so you can view your website while we build it. We keep the code's label, status, expiry and when it was used. When you view a preview, we record the pages viewed, device type, time spent and a scrambled form of your network address – never the address itself. This helps us run the preview service, understand your feedback and protect the design. Raw view records are deleted after 400 days. Change requests and sign-offs are kept with your order, under the order retention periods below.
Partner programme
For partners and applicants, we collect your name, business, email address, optional phone number and application message. We use these to consider your application, run the programme, keep in touch and record referrals, commission and payouts.
Unapproved applications are deleted after 12 months. Ended partners without money records are deleted after 12 months. Where there are money records, contact details are erased 6 years after the partnership ends; the money records are kept for the accounts.
Tracked links
We count clicks on our tracked links to understand which links bring people to our site. We do this without cookies and without storing your network address, using a daily scrambled visitor code. Click records are kept for 400 days.
Businesses we contact
To find businesses that might want a new website, we look at public business information: a business's own website, its public listings and the free Companies House register. We note the business name, website, town, the phone number and business email address it publishes, its company type, and what we noticed about its website. We use this under legitimate interests (offering our services to businesses).
We only send a first email to limited companies and LLPs, at an address they publish, and every email says how to opt out. We don't email sole traders or partnerships without permission. If you ask us not to contact you, we keep your website address and a scrambled form of your email address on a do-not-contact list so we never contact or research you again. Research we don't act on is deleted after 6 months; other records after 12 months.
Our research assistant is ChatGPT (OpenAI), used through our own account. It only reads public information.
Who we share it with
We don't sell your information or share it for marketing. Our website and database are hosted by Cloudflare, who process data on our behalf. Our email (including ) is provided by Google Workspace (Gmail), so Google processes the emails you send us on our behalf, and a copy of the details listed above is brought into our own admin system. Anthropic processes the information described in "AI assistant" above on our behalf. We may share information with our accountant and, if you ask us to, with your domain registrar or email provider when setting up your website.
International transfers
Cloudflare runs a global network, and Google and Anthropic are based in the USA, so your information may be processed outside the UK. Where that happens, it's protected by the UK's approved safeguards (the International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK–US Data Bridge where it applies).
How long we keep it
- Enquiries: up to 12 months after we last dealt with them. If your enquiry becomes an order, the enquiry is deleted 12 months later and the order holds your details.
- Orders that don't go ahead: deleted 12 months after they're cancelled. An order with no activity for 12 months is treated as cancelled. Briefs not linked to an order: up to 12 months.
- Orders that go ahead: we keep your order, messages, notes and website brief for as long as we're working with you – while your site is being built and for as long as you have a care plan with us. Once the work is finished and you have no care plan, we remove messages, notes and the brief after 2 years, and keep the order, invoice and payment records for 6 years for tax and accounting. The same applies if you cancel after paying.
- Emails: the copy of each email's details in our admin system is deleted automatically 13 months after the email's date, unless it belongs to an order we still keep (then it goes with the order, at most 6 years), and sooner if you ask us to erase your information. The emails themselves are kept in our Google Workspace mailbox for as long as we need them for the same purposes.
- Website briefs: when you send a brief, we keep scrambled codes made from your email address and phone number for up to 30 days to spot duplicate and spam briefs (the scrambled IP address for 24 hours). When you accept the terms for a website preview, a scrambled IP address is kept with that acceptance as evidence, for as long as the preview code exists.
- Deleted records stay in a recycle bin for 30 days, then are removed for good.
- Visitor statistics: up to 13 months, then deleted automatically.
- Spam-protection records (scrambled IP addresses): up to 24 hours.
Your rights
You can ask to see, correct or delete the information we hold about you, ask us to stop using it, or ask for a copy to take elsewhere. Email and we'll reply within one month. If you're unhappy with how we handle your information you can complain to the Information Commissioner's Office (ico.org.uk), but please talk to us first.