Privacy policy
Last updated 11 November 2026
This page explains what personal data this website processes, why, who receives it and how long it is kept. The site sets no cookies of its own and uses no analytics or tracking.
Who is responsible
The controller under the GDPR is:
[Fill in: legal name and business form, postal address, email address, phone number]
Visiting the website
The site is hosted by Vercel. When you open a page, your browser sends your IP address and standard request details (page address, browser type, time). Vercel processes these to deliver the page and protect the service from attacks. The legal basis is our legitimate interest in running a secure website (Art. 6(1)(f) GDPR).
[Confirm with Vercel's data processing agreement: how long request logs are kept.]
Fonts and photos are served from this site itself, so opening a page sends no data to Google Fonts or image services.
The Book a Call form
When you send the form, we process your name, email address, the service you choose and anything you write about your situation. We use this only to arrange and prepare your discovery call. The legal basis is taking steps at your request before a possible contract (Art. 6(1)(b) GDPR).
The form is processed by a function running in Vercel's Frankfurt region and sent by email through Resend. We receive the details in our inbox, and you receive a short confirmation at the address you entered.
[Fill in: who hosts the inbox that receives the form, and how long enquiry emails are kept.]
Protection against misuse of the form
To stop the form being used to send spam, we count how often it is used, in a database run by Upstash. We store a keyed hash of your IP address for 15 minutes and a keyed hash of your email address for 24 hours, plus a daily total. The hashes cannot be turned back into your address without our secret key, and they are deleted automatically when they expire. The legal basis is our legitimate interest in preventing misuse (Art. 6(1)(f) GDPR).
[Confirm: the Upstash database region (an EU region is recommended).]
Booking a time with Calendly
The booking calendar is provided by Calendly, a company based in the US. It loads only when you click Pick a time on the Book a Call page. From then on, Calendly receives your IP address and anything you enter, and sets its own cookies. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by not opening the calendar again and deleting Calendly's cookies in your browser.
[Confirm in the legal check: whether clicking Pick a time counts as consent, now that the page no longer shows a cookie note beside the button.]
Transfers outside the EU
Vercel, Resend, Upstash and Calendly are US companies, so personal data may be processed in the US.
[Confirm for each provider: certification under the EU-US Data Privacy Framework, or the standard contractual clauses in its data processing agreement.]
Your rights
You have the right to:
- get a copy of the data we hold about you (Art. 15 GDPR)
- have wrong data corrected (Art. 16)
- have your data deleted (Art. 17)
- have its processing restricted (Art. 18)
- receive your data in a portable format (Art. 20)
- object to processing based on our legitimate interest (Art. 21)
- withdraw consent at any time, without affecting earlier processing (Art. 7(3))
To use any of these rights, contact us at the address in Who is responsible. You can also complain to a data protection supervisory authority (Art. 77 GDPR).
[Fill in: the supervisory authority responsible for the business's location.]