Privacy Policy

1. Information We Collect

• Contact Information: Email addresses, names, and messages submitted through our contact forms.
• Technical Data: IP addresses, browser type, device information, and website usage analytics.
• Project Data: Information shared during consultations, project requirements, and business objectives.
• Communication Records: Email correspondence, meeting notes, and project documentation.

2. How We Use Your Information

• Service Delivery: To provide consulting, design, and development services as agreed.
• Communication: To respond to inquiries, provide project updates, and maintain client relationships.
• Improvement: To analyse website usage and improve our services and user experience.
• Legal Compliance: To meet legal obligations and protect our legitimate business interests.

3. Data Sharing & Third Parties

• Service Providers: We use Supabase for data storage, and tools such as analytics and scheduling providers to run the site and our service. These providers have their own privacy policies.
• AI Tools: Where AI helps deliver your project, we may use third-party AI services, which can process data outside the UK. We agree with you what data is included and exclude confidential information unless specifically agreed.
• No Sale of Data: We never sell, rent, or trade your personal information to third parties.
• Legal Requirements: We may disclose information if required by law or to protect our rights.
• Business Transfers: In the event of a merger or acquisition, data may be transferred to the new entity.

4. Data Security & Retention

• Security Measures: We implement appropriate technical and organisational measures to protect your data.
• Data Location: We keep client and project data in UK or EU-based storage where practical. Some third-party tools (such as AI services) may process data outside the UK and EU; see International Transfers below.
• Retention Period: Contact form data is retained for 2 years. Project data is retained for 7 years for legal and business purposes.
• Data Deletion: You can request deletion of your personal data, subject to legal retention requirements.
• Breach Notification: We will notify affected users and authorities of any data breaches as required by law.

5. Your Rights (GDPR & UK GDPR)

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data in certain circumstances.
• Portability: Request transfer of your data to another service provider.
• Objection: Object to processing of your data for direct marketing or legitimate interests.
• Restriction: Request restriction of processing in certain circumstances.

6. Cookies & Analytics

• Essential Cookies: We use necessary cookies for website functionality.
• Analytics: We may use analytics tools to understand website usage patterns.
• No Tracking: We do not use invasive tracking or advertising cookies.
• Browser Settings: You can control cookie preferences through your browser settings.

7. Free Website Check and Engine Enquiries

• What we store: The website address you enter and the report we produce. Your IP address is kept only as a one-way code, used to stop misuse, and deleted after 30 days.
• If you give your email: We store your email, your name if you give it, which boxes you ticked and when. We use it to send you the report. If you tick the boxes, Scott may get in touch about the results, send his thoughts on your homepage message, or send occasional updates. Each box is optional and unticked to start with.
• Lawful basis: Sending the report you asked for is in our legitimate interests and yours. Follow-ups and updates rely on your consent, which you can withdraw at any time by replying “stop” or emailing privacy@productofexperience.com.
• Who else is involved: Supabase stores reports and emails. Resend delivers the emails. Google PageSpeed Insights receives the website address to run its test. Cloudflare Turnstile checks that a person, not a bot, started the check. Anthropic’s Claude reads the homepage text and a screenshot of it to describe the first impression it gives; it receives no personal data. Netlify hosts the site.
• Sharing reports: Anyone with a report’s link can view it. Links are long and random and are not listed anywhere, and reports contain no email addresses.
• Engine enquiry form: When you use the form on the Engine page we store your name, business, email, and your website and message if you give them. We use them to reply to you and send an automatic acknowledgement. If you tick the box, we also send occasional updates, which you can stop at any time. They are stored in Supabase and sent with Resend, and kept for 2 years.
• Retention: Reports and emails are kept for 2 years, then deleted. Ask us to delete either sooner at any time.

8. International Transfers

We keep data in UK or EU-based storage where practical. Some service providers and AI tools may process data in countries outside the UK and EU. Where they do, we ensure appropriate safeguards are in place, and we agree with clients what data is included, excluding confidential information unless specifically agreed.

9. Updates to This Policy

We may update this privacy policy from time to time. Significant changes will be communicated via email or website notice. Continued use of our services constitutes acceptance of updated terms.

10. Contact & Complaints

For privacy-related questions or to exercise your rights, contact us at privacy@productofexperience.com.

Under the Data (Use and Access) Act 2025, you have a legal right to raise a data protection complaint directly with us. This applies to any concern about how your personal data has been collected, used, stored or shared; a suspected breach of UK GDPR or the Data Protection Act 2018; how a Subject Access Request or other data subject right has been handled; or marketing sent without valid consent.

How to submit a complaint

Email privacy@productofexperience.com with your name and contact details, a clear description of your concern, and any relevant dates or reference information. There is no formal form required — a plain email is enough.

Our complaints process

1. Receive. We log the complaint with the date received, your name and contact details, and the nature of the concern.
2. Acknowledge — within 30 days. We send a written acknowledgement confirming receipt and that your complaint is under review. This is a legal requirement under the DUA Act 2025.
3. Investigate. We review the relevant data, processes, and records, and assess whether UK GDPR or the DPA 2018 has been breached, seeking specialist advice where needed.
4. Respond. We provide a full written response explaining our findings and any corrective action taken or planned, without undue delay following acknowledgement.
5. Escalation info. We inform you of your right to escalate to the Information Commissioner's Office (ICO) if you are unsatisfied with our response.
6. Record & close. We update the complaints log with the outcome and closure date, and retain records for a minimum of three years.

Timescales

• Acknowledgement: within 30 days of receipt (legal requirement).
• Full response: without undue delay (target: within 30 days of acknowledgement).
• Record retention: minimum 3 years from closure.

Escalation to the ICO

If you are not satisfied with our response, or if we fail to respond within a reasonable timeframe, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

The ICO generally expects individuals to raise a complaint with the relevant controller first before contacting the ICO directly.

Records

We maintain a complaints log which records the date a complaint is received, the complainant's name and contact details, a summary of the complaint, the date acknowledgement was sent, the outcome and date of the full response, and any corrective action taken.

Complaint records are held securely and accessed only by Scott Byrne-Fraser. They are not used for any purpose other than managing and learning from complaints.