Who looks after your information

Colin Hancock, trading as Chai Webs, based in Shrewsbury, United Kingdom, is the controller responsible for personal information collected through chaiwebs.co.uk. For privacy questions or requests, email colinhancockweb@gmail.com or call +44 7837 906069.

When you get in touch

The enquiry form collects your name, email address, optional phone number, chosen service, message, confirmation that you agree to share your details, submission time and a reference. We use these to respond, discuss your requirements and manage potential projects. Please do not send passwords, payment details or sensitive personal information.

Providing the required fields is necessary to send the form. You can instead contact us by phone or email. The checkbox confirms your request for a response; it does not subscribe you to marketing or enable Analytics. We rely on steps towards a contract when you enquire about our services, and legitimate interests in handling other correspondence and protecting the service. Records needed for legal obligations are retained on that basis.

Enquiries are saved in a private database and submission log outside the public website folder, and sent by email to our Gmail inbox. The form uses a session cookie, chai_contact, for security and a keyed hash of your IP address to limit abusive submissions. A hashed IP is still potentially personal information, not anonymous data.

Spam protection with Turnstile

Opening the contact pane loads Cloudflare Turnstile to distinguish genuine visitors from bots. Cloudflare processes technical signals including IP address, browser/user-agent information, connection characteristics and this website's origin. We send the verification token to Cloudflare to validate a submission, not the contents of your message.

We use this service for our legitimate interests in protecting the contact form and preventing abuse. Cloudflare also uses signals to improve bot detection as explained in its Turnstile Privacy Addendum. Cloudflare's cookie behaviour depends on its security configuration, including optional clearance cookies. Security protection is separate from your Analytics choice.

Optional Google Analytics

Google Analytics 4 is loaded only after you accept Analytics cookies. It measures pane views and selected interactions, such as opening a portfolio project or successfully sending an enquiry. Google may process cookie identifiers, technical/browser information, approximate location and usage information. We do not send names, emails, phone numbers, message text or audio to Analytics, and our custom page-view events omit URL query strings and fragments.

Consent is our basis for this optional measurement. Advertising storage, advertising personalisation and Google Signals are disabled in our site integration. Rejecting Analytics leaves the website and contact form usable. You can withdraw consent through Cookie settings at any time; future tracking stops, Analytics cookies set by this integration are removed and the page may reload. Withdrawal does not undo processing that already took place. Read how Google uses information from partner sites.

Cookies and browser storage

chai_contact - necessary security

A session cookie used to secure form requests. It is configured without a persistent expiry and normally ends with your browser session; browser session-restoration settings can affect this.

chai_analytics_consent_v1 - your preference

Local storage, not a cookie. It remembers Accept or Reject for 180 days. It contains the choice, version and expiry, not a visitor ID. If browser storage is blocked, the choice may not survive a reload.

chaiwebs_ga and chaiwebs_ga_Y2RCFVD5K5 - optional Analytics

Google's identifiers for Analytics measurement, only after acceptance. Our integration uses a Chai-specific prefix and sets a 12-month cookie lifetime without extending it on each visit. Browser restrictions may shorten this.

You can also clear cookies and local storage using your browser settings. Clearing your saved preference causes us to ask again; Analytics stays off until accepted.

Hosting, fonts and external services

GoDaddy provides the hosting and mail infrastructure. Server logs may include IP addresses, requested URLs, timestamps and browser information for operation and security. Google provides Gmail and, currently, the Google Fonts files used by this site; loading those fonts sends technical connection information to Google independently of Analytics.

Audio files, microphone input, shared audio and device motion are processed locally in your browser for the interactive visuals. This website does not upload or save those recordings or motion readings. External links, including WhatsApp, Facebook, LinkedIn and portfolio websites, take you to services with their own privacy practices. We do not sell your contact information.

Sharing and international processing

Access is limited to Colin and service providers needed to host, protect, measure and deliver communications for this site. Information may also be disclosed where law requires it or to establish or defend legal claims. Google, Cloudflare and GoDaddy may process information outside the UK. Applicable safeguards may include recognised adequacy arrangements and contractual protections; the applicable arrangements depend on the provider and service. Their privacy notices and contractual terms describe their processing.

How long information is kept

We keep enquiry correspondence and the private archive for as long as needed to respond, manage a project or resolve relevant disputes, and review information for deletion when it is no longer needed. The archive is not automatically erased when an email is sent. Where the scheduled queue worker runs, delivered queue records are removed after 30 days; that does not remove the archive, exported log, emails or backups. Client and financial records may require longer retention to meet legal obligations.

Detailed Analytics retention is controlled in our Google Analytics property (standard options are 2 or 14 months), while aggregate reports may remain longer. This is separate from cookie expiry. Hosting, email and security providers apply their own operational retention arrangements. Contact us for details or to request deletion of your enquiry records, subject to any obligations requiring us to keep them.

Your choices and rights

Depending on the circumstances, you can ask to access or correct your information, request deletion or restriction, object to processing based on legitimate interests, and request portability where applicable. You may withdraw Analytics consent at any time. We do not use your enquiry information for solely automated decisions with legal or similarly significant effects.

Email colinhancockweb@gmail.com to exercise your rights. We may need to verify your identity and will normally respond within one month, subject to lawful extensions. You can also complain to the Information Commissioner's Office. We update this notice when our practices change and show the revision date above.