Privacy Policy

01The short version

The rest of this page is the detail required by data protection law.

10Who is responsible for your data

The data controller is [LEGAL ENTITY NAME], registered at [REGISTERED ADDRESS], company number [COMPANY REG. NUMBER]. You can reach us at [hello@yourdomain.com].

11What we collect

When you submit the contact form we collect only the fields in that form:

Our server also processes your IP address transiently, solely to apply a rate limit that stops automated spam. It is used for that check and is not stored in a database or attached to your enquiry.

We do not collect special category data, and you should not send it to us through this form.

100Why we use it, and our legal basis

We use the information only to read your enquiry, reply to it, prepare a quote and, if you engage us, deliver the work.

• Steps at your request prior to a contract (UK/EU GDPR Art. 6(1)(b)) — responding to your enquiry and quoting.
• Legitimate interests (Art. 6(1)(f)) — keeping a record of business enquiries and protecting the form from spam and abuse.
• Consent (Art. 6(1)(a)) — the tick box on the form confirms you are happy for us to contact you about this enquiry. You may withdraw it at any time.
• Legal obligation (Art. 6(1)(c)) — keeping accounting records where a project proceeds.

We do not use your data for automated decision-making or profiling, and we do not send marketing to enquiry addresses unless you separately ask us to.

101Where your enquiry goes

Know this before you submit the form. When you send an enquiry our server does three things with it:

• Telegram — the contents are delivered to a private team chat through the Telegram Bot API, so we see it immediately. Telegram carries and stores that message under its own privacy policy.
• Google Sheets — a row is appended to a private enquiry sheet so we can track what has been answered. Access is limited to our team.
• Meta Conversions API — when we are running advertising we tell Meta a lead occurred. Your email and phone are hashed with SHA-256 before they leave our server, and we never send Meta your name or your message. This happens only if you accepted marketing cookies.

Practically: do not put anything in the form you would not want held in a messaging app and a spreadsheet. If your enquiry is commercially sensitive, send a short note instead and ask us for an NDA and a secure channel — we will provide both before you share any detail.

110Cookies and tracking

We use two optional trackers and neither one loads until you accept it in the banner. Nothing is written to your device before that click. There is no session recording and no data broker involved at any point.

To change your mind: clear this site data in your browser settings and reload the page. The banner reappears and nothing loads until you answer it.

Separately, the site loads fonts from Google Fonts, so your browser makes a request to Google servers and Google receives your IP address as part of it. That is not a cookie and not tracking, but it is an external request. A content blocker prevents it and the site falls back to your system fonts.

111Who we share it with

We do not sell, rent or trade personal data. We share it only with:

• Telegram — delivery of the enquiry message.
• Google — Sheets, where the enquiry is recorded, and Analytics, only with your consent.
• Meta — hashed email and phone for advertising measurement, only with your consent.
• Vercel — our hosting provider, which processes requests to this site.
• Professional advisers, or authorities — where we are legally required to.

1000International transfers

We serve clients in Saudi Arabia, the United Kingdom, the United States, Europe and Russia, and our providers operate globally. Your data may therefore be processed outside your home country, including outside the UK and EEA.

Where we transfer personal data out of the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses, or on the transfer being necessary to perform a contract with you.

1001How long we keep it

• Enquiries that do not become projects — kept up to 24 months, then deleted.
• Enquiries that become projects — kept for the engagement and then as long as required for legal, tax and accounting purposes, typically 6–7 years.
• Rate-limit IP checks — held in memory only and discarded within minutes.

You can ask us to delete an enquiry sooner and we will, unless we are required to keep it.

1010Your rights

Depending on where you live, you have rights over your personal data. Under UK and EU GDPR these include the right to access it, correct it, erase it, restrict or object to its processing, port it, and withdraw consent at any time.

Saudi Arabia's Personal Data Protection Law grants comparable rights, including access, correction and destruction. Residents of California and other US states with privacy legislation may have rights to know, delete and opt out of sale — we do not sell personal data. Russian residents have rights under Federal Law No. 152-FZ.

To exercise any of these, email [hello@yourdomain.com]. We respond within 30 days and will not charge you for it. If you are unhappy with our response you can complain to your local supervisory authority — in the UK that is the Information Commissioner's Office (ico.org.uk), and in the EU your national data protection authority.

1011Security

The site is served over HTTPS. Our credentials are held as encrypted environment variables and never in the page source or the public codebase. The contact endpoint validates and length-limits every field, carries a hidden anti-spam field and applies a per-address rate limit.

No system is perfectly secure. We cannot guarantee the security of data transmitted over the internet, and any transmission is at your own risk.

1100Children

This is a business-to-business website and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, contact us and we will delete it.

1101Changes to this policy

If we change this policy we will update the “last updated” date above. Material changes affecting how we use data you already gave us will be notified by email where we hold one for you.

1110Contact