Privacy Policy

What we collect

When you use a form on this site: your name, and an email address or phone number, plus anything you choose to write in the message box. Nothing else. We do not ask for an address, and we do not fingerprint or profile you.

When you chat with Kensa, the assistant on this site: what you type, so it can answer you. If you leave your name and number for a callback, we also record your enquiry: your name and number, what you are interested in, the kind of business you run and where, when you would like a call, and the conversation itself. Kensa never asks for more than that, and never texts you.

When you email or ring: whatever you tell us, plus the message itself.

When you visit: our hosting provider processes standard technical information such as your IP address in order to serve the page and protect the site from abuse. We do not run advertising trackers and there is no analytics on this site at present. Every file a page needs — fonts included — is served from this domain, so simply reading a page here does not announce your visit to anybody else.

We never sell personal data to anyone, and we never will.

Why we collect it, and our lawful basis

Enquiries — to reply to you and, if we end up working together, to deliver and support the work. Lawful basis: legitimate interests in running the business, and taking steps at your request before entering a contract.

The assistant — to answer the questions you ask it, and, when you leave your details, to pass your enquiry to Mick so he can call you back. Lawful basis: legitimate interests in answering people who ask about our services, and taking steps at your request before entering a contract.

Newsletter — to send you the updates you asked for. Lawful basis: consent, which you gave by signing up and can withdraw at any time using the unsubscribe link or by emailing us.

Client records — to do the work, invoice for it, and meet our legal and accounting obligations. Lawful basis: contract, and legal obligation for the accounting records.

Who processes it

Form submissions go to a system we built and run ourselves — not to a third-party form service. These are the companies that handle your data along the way, and what each one does:

• Cloudflare — hosts this website and runs the service that receives form submissions. Also provides the email routing that forwards mail sent to our address. It also runs Kensa: it stores the assistant's records in the European Union, and its AI service helps Kensa find the right answer (that service gives no location guarantee, and does not train its models on what it sees).
• Anthropic (United States) — provides the AI model that writes Kensa's replies, so each message you send in the chat passes through it. It deletes what it receives within 30 days (up to 2 years if a message is flagged for breaking its usage rules), and does not train its models on it.
• Neon — hosts the database your enquiry is stored in, in the London (eu-west-2) region.
• Resend — sends the notification telling us your enquiry arrived, and the confirmation email back to you.
• Twilio — sends a text message alerting us to a new enquiry, from a form or from Kensa, so it does not sit unseen. It never texts you.
• Google — provides the Gmail account our email is forwarded to. Nothing else on this site touches Google: the fonts are served from our own domain precisely so that visiting a page does not report your IP address to a third party.

Each of these acts on our instructions under a data processing agreement. None of them are permitted to use your data for their own purposes.

Where your data is held

Your enquiry is stored in a database hosted in London, United Kingdom. It is not copied to another country, and it does not sit on a server in the United States. That was a deliberate choice rather than a default.

An enquiry you leave with Kensa is held in two places: the assistant's own database, which Cloudflare runs in the European Union, and a copy in our London enquiry database alongside form enquiries, so every enquiry is handled in one place.

Some things do cross the border, and it would be misleading not to say so. What you type to Kensa passes through Anthropic, a US company, so it can write the reply. The notification email and the confirmation we send you are handled by Resend, and the alert text by Twilio — both US companies, so those messages pass through their systems. Our website is served from Cloudflare's global network, so the request for a page is handled at whichever location is nearest to you.

Where a provider processes data outside the UK we rely on safeguards recognised under UK data protection law, such as the International Data Transfer Addendum or equivalent contractual protections. The record itself — your name, your message, your contact details — stays in London.

How long we keep it

Enquiries that do not become work, from a form or from Kensa — up to 24 months, then deleted. Long enough that we recognise you if you come back, not so long that we are hoarding.

Questions Kensa could not answer — kept for up to 12 months, word for word but with nothing saying who asked, so Mick can answer it for the next person. A conversation that ends without you leaving your details is not kept at all.

Client records — 7 years after the end of the work, which is the period our accounting obligations require.

Newsletter — until you unsubscribe, after which we keep only the minimum needed to make sure we do not email you again by mistake.

AI and your data

We write a good deal on this site about businesses being straight regarding their use of AI, so here is ours.

We use AI tools to help run the business — drafting, research, and building software. Where any of that involves personal data belonging to you or your customers, it is done on business-tier accounts where the provider does not use the content to train their models, and never on free or personal accounts.

No automated system makes a decision about you. Every enquiry is read by a person. The confirmation email you receive after submitting a form is automatic, but it is a fixed message, not an AI-generated reply, and it does not analyse what you sent.

This site has an AI assistant, Kensa. It tells you up front that it is an assistant, answers only from this site's own published information, and hands anything it does not know to Mick rather than making something up. It decides nothing about you: every enquiry it takes is read by Mick, a person. Your IP address is used only to limit how fast messages can be sent, to protect the service from abuse, and is never stored.

Where we link to an assistant running on a client's site, that assistant is operated by that business under their own privacy notice.

Cookies

This site sets no cookies of its own. There is no analytics, no advertising, and nothing tracking you between visits or between sites — which is why there is no cookie banner. Cloudflare may set strictly necessary cookies for security and performance where required to deliver the site.

Your rights

You can ask us to give you a copy of the personal data we hold about you, correct it if it is wrong, delete it, restrict what we do with it, or object to us processing it. Where we rely on consent, you can withdraw it at any time. There is no charge, and we will respond within one month.

Email [email protected]or ring 07501 439406. Ask for your data to be deleted and it will be, without us trying to talk you out of it.

If you are not happy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you came to us first so we can put it right, but it is your right either way.

Changes to this policy

If we change the tools we use or the way we handle data, this page changes at the same time and the date at the top updates. A privacy notice that lags behind what a business actually does is the most common data protection failure there is, and we are not going to be an example of it.