This page explains what personal data we collect, why we collect it, and what we do with it when you use the Crayons & Code website.
I try to keep things simple, minimal, and respectful. No creepy tracking, no selling your data, no nonsense.
Who we are
Crayons & Code is the trading name of Thoughtcube Limited.
Data controller: Crayons & Code
Contact: use our contact form.
What data we collect
1) Messages you send us (contact forms and project enquiries)
If you submit a form on this website, we may collect:
- Your name
- Business name (if provided)
- Email address
- Phone number (if provided)
- Website URL (if provided)
- Your message and any details you include (goals, budget range, timescales, etc.)
We also collect a few technical fields to help prevent spam and abuse (for example, a form start timestamp and hidden “honeypot” fields). Depending on hosting and email delivery, your IP address may be processed in logs for security and troubleshooting.
2) Basic technical data
Like most websites, our hosting providers may automatically log limited technical data when you visit, such as:
- IP address
- Device and browser information
- Pages requested
- Date/time of requests
- Error logs (if something breaks)
This is used for security, performance monitoring, and debugging.
3) Analytics (privacy-friendly)
We use Umami, a privacy-friendly analytics tool, to understand which pages are useful and how the site performs.
The goal is to measure high-level trends (page views, referrers, popular pages) without building invasive profiles about individuals.
Where possible, we configure analytics to be cookie-free and to use aggregated reporting. We deliberately avoid heavyweight analytics approaches that rely on cross-site tracking and excessive data collection.
AI-assisted website guidance
If you use the website problem adviser, your question is sent to the configured AI provider to create the answer. The current provider is OpenAI, which processes the submitted question and selected published guidance under its own data-use and retention terms.
You must not enter personal, confidential, or special-category data.
Questions and answers are not deliberately stored in application analytics or ordinary logs. Limited technical request data may still be processed by hosting and security providers to deliver, protect, and troubleshoot the service.
If the adviser falls back to site search, the fallback search query can appear in the browser address bar and history and in limited hosting or security request logs. This is another reason you must not enter personal, confidential, or special-category data.
The result is automated guidance, not an audit or legal advice. It does not inspect your website and should be treated as a starting point.
What we use your data for
We use your data to:
- Respond to enquiries
- Prepare quotes and proposals
- Deliver services you’ve requested
- Create automated website guidance you request
- Improve the website’s content, accessibility, and performance
- Prevent spam and abuse
We do not sell your data.
Legal basis for processing (UK GDPR)
We process personal data under one or more of the following legal bases:
- Consent: when you submit a form or request contact
- Legitimate interests: to run and improve the website, prevent spam, and keep services secure and reliable
- Contract: where processing is required to provide services you’ve agreed to
Who we share data with
We only share data with service providers needed to run the website and handle enquiries, such as:
- Hosting and deployment providers (to serve the website and keep it secure)
- Email delivery providers (to send form submissions to us)
- Analytics providers (Umami)
- AI providers (currently OpenAI, when you use the website problem adviser)
These providers may process personal data only to provide their services. We do not share your data with advertisers.
Cookies
This website aims to use as few cookies as possible.
- If we run analytics in a cookie-free configuration, it may not set any analytics cookies at all.
- Some essential cookies may still be used by the platform for basic functionality, security, or load balancing, depending on how the site is hosted.
If we introduce any cookie-based tracking in future, we will update this page and, where required, display a clear cookie notice.
How long we keep your data
- Enquiries: kept only as long as needed to respond and follow up. If nothing progresses, we typically delete or anonymise messages after a reasonable period.
- Clients / projects: if you become a client, we may retain project communications and files for ongoing support and historical reference.
- Financial records: invoices and related records may be kept for longer to meet legal and accounting obligations.
Security
We take reasonable steps to keep data secure, including using reputable providers, HTTPS, and basic anti-spam protections. That said, no website can guarantee perfect security, so please avoid sending sensitive information through general contact forms.
Your rights
Under UK data protection law, you have rights including:
- Access to the personal data we hold about you
- Correction of inaccurate data
- Deletion (in certain situations)
- Objection to processing (in certain situations)
- Data portability (where applicable)
To exercise these rights, contact us.
If you’re unhappy with how we handle data, you can complain to the Information Commissioner’s Office (ICO).
Changes to this policy
We may update this policy occasionally to reflect changes to the website, tools, or legal requirements. The “Last updated” date at the top will be updated when changes are made.