Your details, and what happens to them.

Who I am

Ashlar is a small, independent web studio run by Sam Simmonds, building booking-ready websites for local service businesses. If you have any question about your data, email me at samsimmonds77@gmail.com and I'll answer it myself.

What I collect

The only personal data I collect is what you choose to send through one of the two forms. The review form takes your name, your business name, your email address, your phone number (optional), your current website address (optional), the main goal you pick from the list, whether you tick the optional marketing box, and whatever you write in the message. The contact form takes the same things minus the website address and the marketing box: your name, your business name, your email address, your phone number (optional), what you pick from the list, and whatever you write in the details box. I don't collect anything you don't type in.

If I send you a link to book a call, that booking form takes your name, email and the time you choose. It runs on Cal.com — see below.

Why I collect it, and my lawful basis

I use these details to reply to your enquiry and, if you go ahead, to carry out the work you've asked for. The lawful basis is legitimate interest (responding to someone who has contacted me about a service) and, where we go on to work together, performance of a contract. If you tick the optional marketing box, the basis for that — and only that — is your consent.

I only send you marketing if you tick the optional box on the review form to ask for it — that's consent, and it's separate from your enquiry. There is no such box on the contact form, so a message sent there never opts you into anything. Leave it unticked, or use the contact form, and you'll only ever hear back about what you asked for. If you do opt in, you can tell me to stop at any time and I'll remove you.

How long I keep it

Every enquiry that comes through the form is also saved to a private spreadsheet so I can keep track of who has asked for what. I keep that lead record for up to 24 months, then delete or anonymise it. If your enquiry doesn't turn into work, you can ask me to remove it sooner and I will.

If we do work together, I keep what's needed for our working relationship and for legal and accounting requirements, then remove it.

Who I share it with

I don't sell your data and nobody gets it for their own purposes. Your enquiry comes straight to me by email. But getting it to me, and keeping track of it, involves a few suppliers, and you should know who they are.

Cloudflare hosts this site and runs the anti-spam check on the form (Turnstile), so the form submission passes through them. Resend delivers the resulting email to my inbox — they're based in the US, so that step involves a transfer outside the UK, made under the UK's approved safeguards for US transfers. Google (Google Sheets and Apps Script) stores each enquiry in my private lead spreadsheet — Google is US-based too, so that transfer is covered the same way, under Google's data-processing terms; this is a temporary store while I set up a dedicated system. Cal.com handles call bookings when I send you a private booking link, on their EU service. Each of these only handles your details to provide that service to me, and none of them use it for anything else.

Your rights

Under UK GDPR you can ask me to show you the data I hold about you, correct it, or delete it, and you can object to how I use it. Email samsimmonds77@gmail.com and I'll act on it. If you're not happy with how I've handled your data, you can complain to the Information Commissioner's Office (ico.org.uk).

Cookies and tracking

This site does not set advertising or tracking cookies, so there's no cookie banner to click through. For visitor numbers I use Cloudflare Web Analytics, which is cookieless: it counts page views without following you around, without fingerprinting your device, and without building any profile of you. If that ever changes, this notice changes first.

A few things do use storage, and none of them track you. The site remembers in your browser that you've seen the opening animation, so it doesn't replay on every visit. If sending either form fails, what you typed is kept in your browser just long enough to put it back in the boxes, so you don't have to retype it — it never leaves your device that way, and both of these are cleared when you close the tab. The anti-spam check on the forms may also set its own cookies to work at all. All of that is strictly necessary for those features, which is why there's still no banner.