Privacy, in plain English.

Nothing that identifies you, unless you type it in yourself — the contact form, or the email address the cost guide asks for. Nothing is stored on your device either, beyond the one cookie recording your answer to the analytics question below. No page on this site is paywalled and there are no advertising scripts anywhere on it.

Umami, a privacy-focused analytics service, is on every page. It is cookieless. It records anonymous page views and counts of a few actions — email links clicked, forms sent, template links followed — nothing that says who you are, no personal data, no following you across other websites, and no connection to any advertising network. We use it to see which pages are worth writing more of. That is the whole purpose.

Google Analytics 4 can also run, counting the same actions — but only if you accepted it. Unlike Umami it sets cookies on your device, first-party ones used to tell a returning visit from a new one, and it sends your IP address to Google, which works out roughly which country you are in and then discards it. We do not use it for advertising and it is not linked to any ad account.

Which is why there is a bar at the bottom of the page the first time you arrive. Accept and the Google script loads. Decline and it is never requested at all — not loaded and blocked, but never fetched, so nothing of yours reaches Google. Either answer is remembered for twelve months in a single cookie that records only that one word, and you are not asked again in that time.

Changed your mind either way? Clearing this site's cookies in your browser forgets the answer, and you will be asked once more on your next visit. There is no settings panel to hunt through, because there is only ever one question.

The one unavoidable exception is server logs. Like every website, this one runs on third-party hosting, and those servers record standard request data — IP address, timestamp, the page requested, and browser user-agent — for security and to keep the site online. We do not use those logs to identify individual visitors and cannot link them to anything else.

The contact form is not a third-party form service. What you type is posted to this site's own server, handed straight to our email provider, and forgotten — there is no database behind it and no copy kept anywhere but our inbox. The same applies to the email address you give to download the cost guide.

The form is protected by a hidden field that only automated scripts fill in, and by a limit on how often the same visitor can submit. Neither needs a captcha service, so no third party is watching you fill the form in.

The 3-year cost guide asks for an email address before it opens. That address is sent to our inbox the same way an enquiry is, and it is not added to a list — there is no list. The guide opens whether or not we ever write back.

We use trusted third-party providers for hosting, email delivery and analytics. Form submissions pass through Resend, which delivers them to our inbox. They process data on our behalf under contract, are bound to keep it confidential, and never use it for their own marketing or profiling.

If an enquiry becomes a paid project, the invoice details also reach our accountant and HMRC, as UK law requires. That is the entire list — there is no CRM, no advertising platform, and no data broker anywhere in it.

Those providers may store or process data on servers outside the UK. Where that happens the transfer is covered by the UK's approved safeguards — an adequacy decision, or standard contractual clauses with the UK addendum — so your data keeps the same protection it started with.

Enquiries that do not turn into work are deleted within 12 months. Enquiries that do are kept for the life of the project and then for 6 years after the final invoice, because UK tax rules require business records to be kept that long.

The legal bases, in the language the regulation uses: replying to an enquiry you sent us is our legitimate interest in responding to people who contact our business; delivering a paid project is performance of a contract; keeping invoice records is a legal obligation.

Email hello@cbwstudio.studio and we will do it within one month, free of charge. The only thing we cannot delete on request is invoice and tax records still inside that 6-year window, because keeping those is a legal requirement rather than a choice.

If you think we have handled your data badly, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator.