Privacy, in plain English.

Nothing that identifies you. There are no cookies, no tracking pixels, no session storage, and no advertising scripts. Nothing is written to your device and no profile of your visit is built.

There is one script on the site: Umami, a privacy-focused analytics service. It is cookieless. It records anonymous page views and a count of how many people click the email link — nothing that says who you are, no personal data, no following you across other websites, and no connection to any advertising network. I use it to see which pages are worth writing more of. That is the whole purpose.

The one unavoidable exception is server logs. Like every website, this one runs on third-party hosting, and those servers record standard request data — IP address, timestamp, the page requested, and browser user-agent — for security and to keep the site online. I do not use those logs to identify individual visitors and cannot link them to anything else.

There is no contact form here on purpose. Everything runs through email, so no third-party form service ever holds your enquiry.

I use trusted third-party providers for hosting, email and analytics. They process data on my behalf under contract, are bound to keep it confidential, and never use it for their own marketing or profiling.

If an enquiry becomes a paid project, the invoice details also reach my accountant and HMRC, as UK law requires. That is the entire list — there is no CRM, no advertising platform, and no data broker anywhere in it.

Those providers may store or process data on servers outside the UK. Where that happens the transfer is covered by the UK's approved safeguards — an adequacy decision, or standard contractual clauses with the UK addendum — so your data keeps the same protection it started with.

Enquiries that do not turn into work are deleted within 12 months. Enquiries that do are kept for the life of the project and then for 6 years after the final invoice, because UK tax rules require business records to be kept that long.

The legal bases, in the language the regulation uses: replying to an enquiry you sent me is my legitimate interest in responding to people who contact my business; delivering a paid project is performance of a contract; keeping invoice records is a legal obligation.

Email hello@cbwstudio.studio and I will do it within one month, free of charge. The only thing I cannot delete on request is invoice and tax records still inside that 6-year window, because keeping those is a legal requirement rather than a choice.

If you think I have handled your data badly, tell me first and I will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator.