Legal

Privacy policy

The short version: if you get in touch, I only collect what you choose to send me, I use it to reply to you and do the work, and I never sell it or add you to a marketing list. If I contacted your business first, this section explains what I keep.

Last updated: October 2026

Who I am

Castleberg Digital is a web design and hosting business based in Settle, North Yorkshire, run by one person, me. For anything in this policy, contact [email protected].

What I collect, and why

Apart from the optional analytics described below, this site only collects information you type in yourself:

Contact form: your name, email, phone number (optional) and message. Used to reply to you, nothing else.
Quote form: your name, email, phone number (optional) and what you tell me about your business and project. Used to prepare your quote and recommendation.

The legal basis for this under UK GDPR is “steps taken at your request before entering a contract”. In plain English: you asked me something, so I use your details to answer.

If you say yes to the cookie question, Google Analytics records your visit: which pages you looked at, roughly where from, and on what kind of device, so I can see what’s useful. The legal basis for that is your consent, and you can withdraw it any time with Change your cookie choice at the bottom of any page. Say no and nothing is sent to Google Analytics. There are no advertising pixels and no marketing list. The cookie policy has the detail.

Who else touches your data

A few carefully chosen services help run this site. Each receives only what it needs:

Resend turns the contact and quote forms into an email in my inbox. The forms are part of this site, not a third-party embed, and nothing you type is stored on the site itself. Resend is a US company, so your enquiry is processed in the US under their data transfer safeguards (their privacy policy).
Cloudflare Pages hosts this site and, like all web hosts, keeps standard server logs (IP address, pages requested) for security (their privacy policy).
Google Analytics: only if you say yes to the cookie question. It’s run by me, Castleberg Digital, on my own Google account, and Google processes the data, including in the US (their privacy policy).
WhatsApp: only if you choose to message me there. It’s run by Meta, and your number and messages are handled under its own terms (their privacy policy).
Google Fonts serves this site's typefaces, which involves your browser requesting font files from Google's servers (their privacy policy).

I never sell your information, and I don't share it with anyone beyond the services above.

How long I keep it

Enquiries that don't become projects are deleted within 12 months. If you become a client, I keep project correspondence for the length of our work together plus 6 years (the UK limitation period for contract records), then delete it.

Businesses I contact about a website

As well as people who get in touch with me, I contact local businesses I think could use a better website. To do that I keep a short record of each business: its name, trade, town, public contact details (Facebook or Instagram page, business email, business phone number), what I noticed about its website, and the odd public post of its work.

I find businesses in public places: Facebook and Instagram business pages, Google, the business’s own website, Companies House, the Food Standards Agency’s hygiene ratings, open business maps such as Overture Maps and Foursquare, council licence registers, and the Kennel Club’s Assured Breeders list.

The legal basis is legitimate interests: offering a website service to a business that could use one. I’ve weighed that against what a business would reasonably expect, and written the assessment down.

How I get in touch:

Email: only to limited companies, LLPs and PLCs, at an address the business publishes itself.
Phone: only numbers I’ve checked against the Telephone Preference Service. Live calls from me, never recorded or automated.
Facebook and Instagram: only business pages and accounts, never personal profiles, and I send each message myself. For sole traders and partnerships, the electronic marketing rules (PECR) say these messages need your agreement first, and I don’t ask for it in advance. That’s why I stop for good the moment you tell me to.

I write every message myself. My first message tells you where I found you.

My outreach records are kept on Cloudflare. Emails go through Google Workspace, and Facebook and Instagram messages through Meta. When a reply isn’t clear, Anthropic’s AI (Claude) may help me sort it, with names and contact details taken out first.

If you’d rather I didn’t contact you, just say so by replying, on the phone, or at [email protected]. I’ll stop straight away on every channel. To make sure it never happens again, I keep a scrambled code made from your business’s details, not the details themselves. You can also ask what I hold about you, or ask me to delete it.

How long I keep it:

If I never contact a business: its record is deleted 25 days after I found it.
If I contact a business and it doesn’t reply: 12 months after my last message I cut the record down to a short “contacted before” note (the dates, the type of business and the rough area), and delete that note 2 years later.
If you tell me to stop: I keep the scrambled code for good, and nothing else.

Your rights

Under UK GDPR you can ask me at any time to:

show you the personal data I hold about you;
correct it if it's wrong;
delete it;
stop processing it, or hand it over to you in a portable format.

Email [email protected] and I'll sort it, no forms, no fuss. If you're not happy with how I've handled something, you can complain to the Information Commissioner's Office.

Changes

If how this site handles data changes, this page changes first, and the date at the top moves.