A Firefly Labs company.
This is the plain English version of how {{companyName}} handles your data. The short version: we collect only what we need to run the business and deliver your project, we don’t sell or share your data, and you can ask us to delete it at any time.
Last updated: {{date}}
{{companyName}} is operated by {{CompanyName}}, a company registered in England and Wales (company number {{companyNumber}}) with its registered office at {{contactAddress}}.
For privacy questions, contact us at {{email}}.
We are the data controller for personal data we collect about you under UK GDPR and the Data Protection Act 2018.
We only collect personal data when we have a clear reason to, and we tell you what we’re doing with it.
Our website uses Plausible Analytics, a privacy-focused analytics service that doesn’t use cookies and doesn’t identify individual visitors. Plausible records anonymous, aggregated information about visits — pages viewed, the country a visit came from, the type of device used, and where the visit came from (referring website or search). None of this can be used to identify you personally.
Our hosting provider (Vercel) keeps standard server logs (IP address, timestamp, page requested) for short periods for security and reliability purposes. These logs aren’t used to track individuals and are deleted after a short retention period.
We self-host the fonts used on the website. We don’t use Google Fonts, Google Analytics, Facebook Pixel, HubSpot tracking, or any other third-party tracking technology that follows you across the internet.
If you fill in our contact form, email us, or book a call, we collect:
Contact form submissions are sent to our customer relationship management system (HubSpot) so we can keep track of our conversations with you and respond properly. HubSpot only receives the form data you submit — it doesn’t track your visit to our website.
Why: to reply to you and, if it’s relevant, to talk about working together.
Legal basis: legitimate interest (responding to enquiries) and, if it becomes a project, contract performance.
We use Calendly to schedule introductory calls. When you click our “book a call” link, you’re sent to Calendly’s own website, where you choose a time and submit your details directly to Calendly. We do not embed Calendly on our website — Calendly only receives your information once you’ve actively chosen to use it.
Calendly collects: your name, email address, the time slot you book, and any information you add to your booking. They share that information back with us so we know who is on the call and when.
Calendly operates under its own privacy policy, which we recommend reading if you have specific concerns:
Calendly’s privacy policy: https://calendly.com/privacy
Legal basis: legitimate interest (arranging meetings) and, if it becomes a project, contract performance.
If you commission a project with us, we collect:
Why: to deliver your project, invoice you, keep proper business records, and stay in touch about your site.
Legal basis: contract performance (delivering the work you’ve bought), legal obligation (HMRC record-keeping), and legitimate interest (keeping you informed about your project).
We don’t see or store your card details. Payments are processed by Stripe, who handle card data under their own privacy policy and PCI-compliant infrastructure. We receive confirmation that payment has succeeded and the basic transaction information needed to invoice you properly.
Stripe’s privacy policy: https://stripe.com/gb/privacy
During the project, we’ll receive content from you (copy, images, brand assets, etc.) that we use to build your site. We store this on secure systems for the duration of the project and for a reasonable period afterward in case you need it again.
This website doesn’t set any tracking cookies. Plausible Analytics works without cookies. We don’t use Google Analytics, Facebook Pixel, HubSpot tracking, or any other technology that follows you across the internet.
Calendly is not embedded on our website — when you click to book a call, you’re sent to Calendly’s own site, where their own cookie policy applies.
If we ever add a tool that does set non-essential cookies, we’ll show you a cookie banner first and ask for your consent.
Your browser may set its own essential cookies to make the site work (for example, remembering you’ve closed a notification). These aren’t used to track you.
We share your personal data only with the service providers we need to run the business. We don’t sell your data. We don’t share it for marketing purposes.
Our current service providers (called “data processors” under UK GDPR) are:
International transfers: some of these providers (Stripe, Vercel, HubSpot, Calendly) are based in the United States. Where data is transferred outside the UK, we rely on UK GDPR-approved safeguards — the UK Addendum to the EU Standard Contractual Clauses, or the EU-US Data Privacy Framework where applicable — to protect your data.
Under UK GDPR, you have the right to:
To exercise any of these rights, email {{email}}. We’ll respond within one month.
ICO website: https://ico.org.uk
We don’t run a marketing mailing list. If we add one in the future, it will be opt-in only and you’ll be able to unsubscribe from every email we send. We’ll update this policy before that happens.
If you’ve been a customer, we may occasionally email you about your project, our services, or things directly relevant to the work we’ve done together. You can ask us to stop at any time.
We take reasonable technical and organisational measures to protect your data — encryption in transit (HTTPS), secure access controls on our systems, two-factor authentication on critical accounts, and limited access among the people working on your project. No system is perfectly secure, but we take it seriously.
If we ever suffer a data breach that puts your rights at risk, we’ll notify you and the ICO as required by law.
Our services aren’t intended for, or marketed to, children under 18. We don’t knowingly collect data from children.
We may update this policy from time to time. The current version is always at this page, with the “last updated” date at the top. Material changes will be communicated to active customers by email.
For any privacy question — questions about this policy, requests to exercise your rights, complaints — email {{email}}.
{{CompanyName}} · {{contactAddress}} · Company number {{companyNumber}}
WebCraft Pro — A Firefly Labs company.
