Privacy notice

Who's responsible for your data

The data controller is Jake Armour, trading as Citriverse. Citriverse is a sole trader rather than a limited company, so there's no company number to quote.

What the enquiry form collects

The form on the contact page asks for five things: your name, your email address, the type of project you're interested in, a budget range, and your message. Two of those — the project type and the budget range — are optional. Nothing else about you is collected, and there's no account to create.

The form also contains a hidden anti-spam field that a real visitor never sees or fills in. If it comes back filled in, the submission is discarded and a note is written to the server log recording only how many characters were in that hidden field — never its contents, and never anything you typed.

No cookies, no analytics, no trackers

This site sets no cookies. It runs no analytics of any kind. It contains no third-party trackers, advertising pixels, embedded social media or session recording. Its fonts are self-hosted, so loading a page here doesn't make a request to anyone else's server. You're not being counted, profiled or followed around the web from here.

Why it's collected, and the lawful basis

The only reason for collecting any of it is to read your enquiry and reply to it. The lawful basis is legitimate interests (Article 6(1)(f) of the UK GDPR): you've chosen to contact a business about possible work, replying properly is necessary to run that business, and a reply is exactly what you'd expect to get. Nothing about that overrides your interests — it's a one-to-one answer to a message you sent.

If an enquiry goes further and turns into a quote or a proposal, that processing is also necessary for steps taken at your request before entering into a contract (Article 6(1)(b)).

Your details are never sold, never shared for anyone else's marketing, never used to build a profile, and never added to a mailing list. There's no mailing list to be added to.

Who else handles your enquiry

Three service providers are involved in getting an enquiry from the form to a person who can answer it. Each acts as a processor, handling the data only to provide its service:

• —Resend delivers the enquiry to the Citriverse inbox as an email. Resend is based in the United States, so sending an enquiry through this form involves a transfer of personal data outside the UK. That transfer happens under the data processing terms Citriverse has agreed with Resend, and the only data sent is the enquiry itself.
• —Cloudflare hosts the site and serves it through its network. As with any website, Cloudflare processes technical request data such as your IP address in order to deliver the page and to protect the site against abuse.
• —Microsoft provides the hello@citriverse.com mailbox where the enquiry lands and is read.

Cloudflare and Microsoft are also based in the United States, so their processing may involve transfers of personal data outside the UK as well. Cloudflare's processing covers every page view rather than only enquiries, since it serves the site itself. As with Resend, those transfers take place under the data processing terms each provider offers.

How long it's kept

Enquiries are kept for 12 months from the last contact, then deleted. Keeping them that long means a conversation picked up again months later doesn't have to start from scratch.

If an enquiry becomes a paid project, the records tied to that work are kept for as long as business and tax law requires them to be, which is longer than 12 months.

Your rights over your data

Under the UK GDPR you have the right to:

• —Access — ask for a copy of the personal data held about you.
• —Rectification — have anything inaccurate corrected.
• —Erasure — ask for it to be deleted.
• —Restriction — ask for its use to be paused while a concern is sorted out.
• —Objection — object to it being processed on the basis of legitimate interests.
• —Portability — where an enquiry has progressed to a quote and the processing is contractual, receive it in a portable, machine-readable form.

Portability is narrower than the rest by law: it only applies where processing rests on consent or on a contract, which is why it's scoped above to enquiries that have gone on to become quotes. The other five apply to everything described on this page.

To use any of them, email hello@citriverse.com. There's no charge, and you'll get an answer within one month. Asking plainly — "please delete that enquiry" — is enough; you don't need to cite an article number.

Complaining to the ICO

If you're unhappy with how your data has been handled, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint. Raising it directly first is welcome, but you're under no obligation to.

Changes to this notice

If what happens to your data changes, this notice changes with it, and the "last updated" date at the top changes too.