Privacy notice | KB Designs

Draft: designer to check

What to check

Controller details: trading entity, company name, number and registered office (site.json). Until they are set, the first section says so instead.
Whether you need to pay the ICO data protection fee, and if so, add the registration number here.
The lawful bases: your consent (the box on every form) plus steps before a contract for replying; legitimate interests for spam protection and site security. Check these are right for how you will actually use enquiries.
Who the controller is in law. The page names “KB Designs” (your 10 November choice), but a trading name isn’t a legal person: as a sole trader it is you; as a limited company it is the company, and its number and registered office must then be shown (site.json companyNumber, registeredOffice).
How long you keep enquiry emails in your own inbox. The page doesn’t promise anything about that; only the database deletes itself.
How long Resend keeps sent emails in its logs, and whether to say so.
International transfers: Cloudflare, Resend and Google are US companies. Check each one’s current UK transfer mechanism (UK–US “data bridge” or IDTA/addendum) in their data processing terms.
That Turnstile, Cloudflare’s hosting logs and Workers Logs (observability is on in wrangler.toml) work as described, using Cloudflare’s current documentation.
You promise “I won’t add you to a mailing list” and “I’ll only contact you about what you asked for”. Keep to both, or change them here and under every form.
This notice already applies: since 10 November 2026 the forms are live on the workers.dev address (D1, the real Turnstile widget and the Worker secrets are set) and real enquiries are stored. The Health Check answers "not available" until PSI_API_KEY is set (Guide 5). Sign this page off, or don't hand out the workers.dev address yet.
Workers Logs (observability is on in wrangler.toml) may keep a short record of each /api request, including the IP address, for a few days. Look at one entry in the Cloudflare dashboard: switch invocation logs off, or say so here.
Inbox copies: the page now says enquiries are emailed to you, but not how long you keep those emails. UK GDPR wants a period or a rule (e.g. "until the enquiry is dealt with"). Also name your email provider under "Who else handles it", and consider moving Resend to an account in your own name (it is currently the GSMT account).

Last updated: 10 November 2026 (draft).

Who is responsible for your data

KB Designs is responsible for your personal data. In UK data protection law (the UK GDPR and the Data Protection Act 2018), that makes KB Designs the “controller”.

To ask anything about your data, use the contact page.

The short version

Apart from what any web host handles to deliver pages (see Hosting), nothing is collected about you unless you send a form or use the health check.
When you send a form, it’s emailed to me so I can reply. A copy is kept in this website’s database, which deletes it automatically after 12 months.
I don’t sell your data, I don’t use it for advertising, and I won’t add you to a mailing list.

What I collect

When you send a form

This covers the contact form, the rough estimate form on the pricing page and the health check report form. I keep:

your name and email address;
anything else you choose to give: business name, website address, phone number and your message;
on the estimate form: the package and support plan you picked, monthly or yearly, the rough estimate shown to you, and whether you’d like a reply by email or a phone call (if you choose a call, your phone number is needed);
on the health check report form: the website address you checked and the results it got;
that you ticked the consent box, which version of its wording you saw (currently “2026-11-07-draft”) and the date and time you sent the form;
a scrambled (hashed) version of your IP address, mixed with a secret key first so the stored value doesn’t reveal it. It’s only used to stop spam and repeat sending. Your actual IP address isn’t saved with your message.

The consent box says: “I agree to KB Designs using these details to reply to this enquiry, as explained in the privacy notice.”

When you send a form, an email goes to me with what you sent, so I can reply.

If a form can’t send, it tells you, so you can try again later.

When you use the free health check

The website address you enter is sent to Google PageSpeed Insights, which visits that website to test it. A result is reused for 24 hours, so checking the same address again is quick. Saved results aren’t linked to you, and they’re deleted after 30 days. A website address isn’t usually personal data, but it can be if it contains your name.

You don’t need to give your name or email address to run a check. You only do that if you ask for a report, using the form described above.

Spam protection and limits

Forms and the health check use Cloudflare Turnstile to check that a person, not a bot, is using them. It loads only when you start using a form. Cloudflare looks at technical information about your browser, and your IP address is passed to Cloudflare to confirm the check.

To stop the forms and the health check being overused, each one counts how often it’s been used in the last 10 minutes against the same hashed IP address. These counts are deleted at the next daily clean-up, so within about a day.

Hosting

The site is hosted by Cloudflare. Like any web host, Cloudflare processes your IP address and basic browser details to deliver pages and protect the site from attacks. My own error logs record only what went wrong, never your name, email address or anything you typed.

Fonts and code are served from this site itself, so your browser doesn’t contact Google or other font or code services when you visit.

Visitor statistics

This site doesn’t count visitors yet. If it starts, it will use Cloudflare Web Analytics, which counts page views without cookies and without following you to other websites, and this notice will say so first. You can already opt out with the “Allow anonymous, cookie-free visitor counting” box at the bottom of every page.

Why I use it, and the legal basis

To reply to your enquiry, or send the estimate follow-up or report you asked for. Legal basis: your consent, which you give by ticking the box on the form, and taking steps you’ve asked for before a possible contract.
To keep the site secure and stop spam (the hashed IP address, the usage limits and Turnstile). Legal basis: legitimate interests.

I’ll only contact you about what you asked for.

Who else handles it

These companies process data for me, under terms that require them to protect it:

Cloudflare: website hosting, the database that stores form messages, Turnstile.
Resend: sends the email to me when you send a form.

Google runs the health check through PageSpeed Insights. It receives only the website address you enter, not your name or IP address.

These companies are based in the United States, so your data may be processed there. Where that happens, it’s protected by the safeguards UK law requires.

How long I keep it

Form messages, with their hashed IP address, are deleted automatically after 12 months.
Saved health check results are deleted after 30 days.
Usage counts for the limits are deleted within about a day.

If you become a client, I’ll keep what’s needed for the work and for my business records, and tell you how long when we agree the work.

Your rights

You have the right to:

ask for a copy of the data I hold about you;
ask me to correct it or delete it;
object to, or ask me to limit, how I use it;
ask for it in a format you can take elsewhere;
withdraw your consent at any time. This doesn’t affect anything done before you withdrew it.

To use any of these, use the contact page. I’ll reply within one month.

Complaints

If you’re unhappy with how I’ve handled your data, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.

Changes

If this notice changes, the new version will be posted here with a new “last updated” date.