Privacy policy

Who is the controller

This site is operated by James Willcocks, a freelance web developer based in South Devon, United Kingdom. For privacy matters you can contact me at Email us.

What data this site collects

Until you choose otherwise, this site sets no cookies and builds no profile of you. There are no marketing cookies, no tracking pixels, and no advertising scripts. If you select Accept on the cookie banner, the site loads Google Analytics (GA4), which sets a small number of analytics cookies so I can see which pages are useful and improve the site; if you select Reject, none are set and no analytics data is sent. Aggregate page counts may also be produced at the hosting edge without any cookies. The full detail is in the cookie policy.

If you submit the form on the contact or free first draft page, the site collects:

• Your name and email address (required to reply).
• Your business name and phone number, if you give them.
• The kind of project you pick, the message you write, and any link you add (an existing website or Facebook page, for example).
• How you found me, if you choose to say.
• The page the form was on and the site that referred you, if there was one. These are added automatically so I know which page an enquiry came from, and they're sent with your message rather than stored anywhere else.
• Your IP address and some basic browser signals, briefly, for spam protection through Cloudflare Turnstile (see below).

The form is protected by Cloudflare Turnstile, which checks that a real person is sending it. Cloudflare uses what it sees for that check, not for advertising.

Lawful basis

Contact-form submissions are processed on the lawful basis of your consent under Article 6(1)(a) UK GDPR: by submitting the form you're asking me to read and reply. The aggregate analytics processing relies on legitimate interests under Article 6(1)(f) for the limited purpose of understanding which pages people read, given that no individual is identified. The spam check relies on legitimate interests too: keeping the form usable for real enquiries. Google Analytics only runs with your consent, given through the cookie banner, and you can withdraw it at any time.

How long this data is kept

Contact-form messages are retained in my email for as long as the conversation is active and for a reasonable period afterwards (typically 24 months) so I can find context if you come back. You can ask me to delete them sooner.

Who I share it with

I don't sell your data and don't share it for marketing purposes. The only third parties involved in delivery are:

• Cloudflare: hosting infrastructure, aggregate analytics and the Turnstile spam check on the forms.
• Resend: outbound email delivery for the forms.
• Google: Google Analytics, only if you accept analytics cookies.
• My email provider, where the message ends up after sending.

Your rights under UK GDPR

You have the right to access the data I hold about you, to correct it, to ask me to erase it, to restrict its processing, to object, and to portability. To exercise any of these rights, email Email us. I'll respond within one calendar month.

If you're unhappy with how your data is being handled, you have the right to complain to the Information Commissioner's Office at ico.org.uk.

International transfers

This site is hosted on Cloudflare's global edge network, and contact-form email is delivered through Resend, a US-based email provider. Personal data submitted via the contact form may transit through Cloudflare data centres outside the UK as part of normal request routing, and passes through Resend to reach my inbox; both are relied on under standard contractual clauses (or equivalent safeguards) where applicable.

Changes to this policy

If this policy changes, the "last updated" date at the top will move and the previous version will be available on request.