Privacy

Last updated: TODO — set the date you publish this.

Before you go live: draft, not legal advice. Replace every TODO. If you will have customers in the EU or UK, have someone check this against GDPR once.

Who holds your data

TODO_LEGAL_ENTITY, TODO_JURISDICTION. Questions or requests: TODO_EMAIL. We answer within 30 days.

What we collect, and why

What you type into the form — your email, your app's address, what you are worried about. We use it to reply to you and to decide whether we can help. Nothing else.
Payment details — handled entirely by Stripe. We never see or store your card number. Stripe's own privacy notice covers that data: stripe.com/privacy.
Page analytics — TODO: if you use a privacy-first analytics tool such as Plausible or Fathom, name it here and say it sets no cookies and does not track people across sites. If you use nothing, say so and delete this line.
Your code and systems, during an engagement — only what the agreed tests need, only for as long as the engagement runs. See "During an engagement" below.

What we do not do

We do not sell your data. We do not share it with advertisers. We do not add you to a mailing list because you filled in a form — if we ever start a newsletter you will have to ask for it.

During an engagement

We are given access to your application to run the agreed tests. We take the minimum access needed, keep any evidence we capture encrypted, delete our working copies within seven days of finishing, and ask you to rotate every credential you shared. If we come across other people's personal data in your system, we tell you, we do not copy it, and we do not keep it.

Who else touches it

Only the services we need to run the business. TODO — list yours, e.g. Stripe (payments), TODO_FORM_PROVIDER (the contact form), TODO_EMAIL_PROVIDER (email), TODO_HOST (hosting). Each holds data under its own terms.

How long we keep it

Enquiries that go nowhere: 12 months, then deleted. Client records and invoices: as long as tax law requires, TODO_YEARS years. Engagement working material: deleted within seven days of the engagement ending.

Your rights

Ask us for a copy of what we hold, ask us to correct it, or ask us to delete it. Email TODO_EMAIL and we will do it within 30 days, free. If you are in the EU or UK you can also complain to your national data protection authority.