Privacy Policy

The short version

We collect what you type into a contact form, and nothing else. There are no analytics scripts, no advertising pixels, no session recording and no tracking cookies on this website. We do not sell or rent your information to anyone.

What we collect, and when

The only personal information we collect is what you choose to send us through a form on this site — the hero form, the sidebar form on articles, or the contact page form.

• Your name, and your firm's name if you give it
• Your email address and phone number
• Your practice area and budget range, if you select them
• The services you tick, and the message you write
• Which page you submitted from, so we know what you were reading

Why we process it

To reply to your enquiry, to prepare the audit or proposal you asked for, and to keep a record of the conversation. That is a legitimate interest in responding to a business enquiry you initiated; where consent is the applicable basis, submitting the form is that consent.

We do not add you to a marketing list because you filled in a contact form. If we ever start sending a newsletter, it will be a separate opt-in.

Who processes it for us

Your submission is handled by a short, specific list of service providers. Each one only receives what it needs to do its job.

• Supabase — stores form submissions and the site's own content, in a hosted Postgres database
• Brevo — sends us the notification email and sends you the confirmation receipt
• Vercel — hosts the website and processes the request that carries your submission

Other requests your browser makes

Some pages load assets from third parties, which means those companies see your IP address and user agent as part of serving the file. We do not send them any information about you, and none of these are analytics or advertising services.

• Google Fonts — one webfont used in the site footer
• Unsplash — placeholder photography on some pages
• Simple Icons — brand logos on the platform strip

Cookies

The public website sets no cookies. There is no consent banner because there is nothing to consent to.

The private admin area at /admin uses a session cookie to keep the site owner signed in. It is strictly necessary for that login and is never set for ordinary visitors.

Spam protection

Forms include a hidden field that automated submissions tend to fill in, and the endpoint limits how many submissions one IP address can make in a short window. Your IP address is used for that check in memory at the moment of the request and is not written to our database.

How long we keep it

Enquiries are kept for as long as they are commercially useful — typically up to 24 months from your last contact with us — and then deleted. If you become a client, records tied to the engagement are kept for as long as we have a contract plus any period required for tax and accounting.

Your rights

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Email us and we will action it within 30 days. If you are in the UK, EU or a US state with a comparable privacy law, you also have the right to object to processing and to complain to your supervisory authority.

Security

The site is served over HTTPS. Form submissions are stored with row-level security so that only an authenticated administrator can read them, and administrative access is limited to the people who need it. No system is perfect, and we do not claim otherwise — but we do not collect information we do not need, which is the most reliable protection there is.

Children

This is a business-to-business website. It is not directed at children and we do not knowingly collect information from anyone under 16.

Changes to this policy

If we change how the forms work, add analytics, or introduce any other processing, we will update this page and change the date at the top before the change goes live.