Your data, plainly.

When you send a message, request a quote, or book a meeting, I store what you filled in: your name, email address, and optionally your phone number, company, budget range and the message itself.

Alongside that I store your IP address and browser user-agent. That is used only to spot automated spam — it is never used to profile you or to work out who you are.

I do not have accounts, so there is nothing to log in to and no password of yours to lose.

To reply to you. That is the whole purpose. If you ask about a project, I need somewhere to send the answer.

If we end up working together, I keep the thread so there is a record of what was agreed. If we do not, it sits unused until it is deleted.

This site sets one cookie, and it is the Laravel session cookie that makes form submissions secure. It contains no personal information and it expires when you close your browser.

Your theme preference — light or dark — is stored in your own browser using localStorage. It never leaves your device and I cannot read it.

If analytics are enabled in future, they will be privacy-first and cookie-free, and this page will say so before that happens.

Nobody, with two unavoidable exceptions: the company hosting the server, and the service that delivers email. Both only handle your data in order to pass it to me.

I do not use third-party form services, chat widgets or CRM tools. Your message goes from this site straight into a database I control.

I will never sell your data. There is no scenario in which that happens.

Enquiries that did not become work: two years, then deleted.

Enquiries from clients I worked with: kept while the working relationship lasts, plus the period I am legally required to retain business records.

You can ask for earlier deletion at any point and I will action it within 30 days.

You can ask me what I hold about you, ask for it to be corrected, or ask for it to be deleted. Email me and I will handle it — you do not need to justify the request or use any particular wording.

If you are in the UK or EU, the GDPR gives you these rights formally. I apply them to everyone regardless of where you are, because separating people by jurisdiction would be worse than just doing the right thing.

The site is served over HTTPS only. Form submissions are protected against cross-site request forgery, rate-limited against abuse, and filtered for spam before anything is stored.

The database sits on a server I administer, with nightly off-site backups. Admin access requires two-factor authentication.

No system is perfectly secure. If something did go wrong in a way that affected you, I would tell you directly rather than burying it.

If what I collect changes, this page changes at the same time — not later. The date at the top always reflects the last real change.