Privacy Policy

1. Contact form enquiries

When you use our contact form, we collect your name and email address, and the content of your message. We use this solely to respond to your enquiry.

Lawful basis: Legitimate interest: you have voluntarily contacted us about our services, and we have a clear interest in responding.

2. Instant estimate enquiries

When you use our public instant estimate tool, we collect your name, email address, and the project details you enter (page count and selected features). We also store the computed estimate result shown to you so the figure is preserved even if our pricing changes later. This data is used to follow up on your enquiry.

Lawful basis: Legitimate interest: you have voluntarily requested a pricing estimate, and we have a clear interest in following up.

3. Discovery call and meeting bookings

When you book a call or meeting via our scheduling tool (Cal.com), we collect your name, email address, the type of call booked, and the scheduled time. This data is used only to confirm, manage, and follow up on your booking.

Lawful basis: Legitimate interest: pre-contractual communication with prospective clients.

4. Client accounts

When you become a client we store your name, email address, phone number, and company name to manage your project and our business relationship. We also store an internal role (admin or client) and external reference IDs that link your account to our authentication provider (Supabase Auth) and payment processor (Stripe). Authentication credentials are held by Supabase, not by us directly. No card or payment data is stored by us.

If you upload a profile photo, we store it in Supabase Storage. If you save accessibility preferences in the portal (such as contrast, font size, or reading mode), we store those to your account so your choices persist across devices. These preferences may include disability-related information (such as a dyslexia reading mode); they are stored solely to improve your portal experience and are not shared with any third party.

Lawful basis: Contract performance: processing is necessary to deliver the agreed services.

5. Quotes

When we prepare a quote for you, we store the itemised services, amounts, applicable discounts, and any free-text notes associated with your quote. Quotes are linked to your client account.

Lawful basis: Contract performance: necessary for pre-contractual negotiations and to formalise the scope of work.

6. Project briefs

When we prepare a project brief for you, we record your name, email address, and company name alongside the agreed project scope: an overview, goals, pages and structure, features, design direction, client responsibilities, timeline, and out-of-scope items. Briefs are used to define and document the scope of work before or alongside a quote.

Lawful basis: Contract performance: necessary for pre-contractual negotiations and to formalise the scope of work.

7. Contracts

When you sign a contract with us, we store the signed contract document (as a PDF) and record your email address and the date and time of signing. Contracts are prepared and signed via SignWell, our e-signature provider, and then stored by us in Supabase Storage.

Lawful basis: Contract performance and legal obligation: the signed contract is a legally binding record of the agreed services.

8. Invoicing and payments

We collect your name, email address, and company name for invoicing purposes. Invoice records include itemised descriptions and amounts, payment dates, and reference IDs linking to Stripe. Card payments are processed entirely by Stripe: we never see or store your card details. Invoicing covers both one-off build projects and recurring maintenance plan subscriptions.

Lawful basis: Contract performance and legal obligation: HMRC requires retention of accounting records for six years.

9. Maintenance plan subscriptions

If you subscribe to a Cactus Co maintenance plan, we store your plan name, subscription status, current billing period, and cancellation information, alongside reference IDs from Stripe. No card data is stored by us.

Lawful basis: Contract performance: necessary to manage and deliver your ongoing maintenance plan.

10. Project messages and feedback

Within the client portal, we store messages exchanged between you and our team on individual projects, as well as general company-level communications. We also send periodic feedback requests at project milestones; any feedback you submit is stored against your project record. These records are used to manage your project and maintain a clear communication history.

Lawful basis: Contract performance: necessary to deliver and document the agreed services.

11. Website analytics

We use Umami to understand how visitors use our site. Umami is a privacy-first analytics tool that does not use cookies, does not collect personal data, and does not track individuals across sites or devices. No IP addresses are stored. Because no personal data is processed, Umami falls outside the scope of GDPR and requires no consent.