Your details, and what happens to them.

Who I am

Ashlar is a small, independent web studio run by Sam Simmonds, building booking-ready websites for local service businesses. If you have any question about your data, email me at samsimmonds77@gmail.com and I'll answer it myself.

What I collect

The only personal data I collect is what you choose to send through the review form: your name, your business name, your email address, your phone number (optional), your current website address (optional), the main goal you pick from the list, whether you tick the optional marketing box, and whatever you write in the message. I don't collect anything you don't type in.

If you book a call instead, the booking form takes your name, email and the time you choose. That runs on Cal.com — see below.

Why I collect it, and my lawful basis

I use these details to reply to your enquiry and, if you go ahead, to carry out the work you've asked for. The lawful basis is legitimate interest (responding to someone who has contacted me about a service) and, where we go on to work together, performance of a contract. If you tick the optional marketing box, the basis for that — and only that — is your consent.

I only send you marketing if you tick the optional box on the form to ask for it — that's consent, and it's separate from your enquiry. Leave it unticked and you'll only ever hear back about what you asked for. If you do opt in, you can tell me to stop at any time and I'll remove you.

How long I keep it

Every enquiry that comes through the form is also saved to a private spreadsheet so I can keep track of who has asked for what. I keep that lead record for up to 24 months, then delete or anonymise it. If your enquiry doesn't turn into work, you can ask me to remove it sooner and I will.

If we do work together, I keep what's needed for our working relationship and for legal and accounting requirements, then remove it.

Who I share it with

I don't sell your data and nobody gets it for their own purposes. Your enquiry comes straight to me by email. But getting it to me, and keeping track of it, involves a few suppliers, and you should know who they are.

Cloudflare hosts this site and runs the anti-spam check on the form (Turnstile), so the form submission passes through them. Resend delivers the resulting email to my inbox — they're based in the US, so that step involves a transfer outside the UK, made under the UK's approved safeguards for US transfers. Google (Google Sheets and Apps Script) stores each enquiry in my private lead spreadsheet — Google is US-based too, so that transfer is covered the same way, under Google's data-processing terms; this is a temporary store while I set up a dedicated system. Cal.com handles bookings if you use the booking page, on their EU service. Each of these only handles your details to provide that service to me, and none of them use it for anything else.

Your rights

Under UK GDPR you can ask me to show you the data I hold about you, correct it, or delete it, and you can object to how I use it. Email samsimmonds77@gmail.com and I'll act on it. If you're not happy with how I've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Cookies and tracking

This site does not set advertising or tracking cookies, so there's no cookie banner to click through. For visitor numbers I use Cloudflare Web Analytics, which is cookieless: it counts page views without following you around, without fingerprinting your device, and without building any profile of you. If that ever changes, this notice changes first.

A few things do use storage, and none of them track you. The site remembers in your browser that you've seen the opening animation, so it doesn't replay on every visit. If sending the form fails, what you typed is kept in your browser just long enough to put it back in the boxes, so you don't have to retype it — it never leaves your device that way, and both of these are cleared when you close the tab. The anti-spam check on the review form, plus the booking calendar if you open it, may also set their own cookies to work at all. All of that is strictly necessary for those features, which is why there's still no banner.