Privacy Policy

This policy explains how Bloomfound Co collects and uses your personal information when you visit this website, send an enquiry, or use the client portal. I've tried to keep it in plain English.

1. Who I am

Bloomfound Co is a trading name of [REGISTERED_COMPANY_NAME], a company registered in [REGISTERED_IN] with company number [COMPANY_NUMBER], whose registered office is at [REGISTERED_OFFICE_ADDRESS] ("Bloomfound Co", "I", "me", "my").

I am the controller of the personal information described in this policy. This means I decide how and why it is used.

If you have any questions about this policy or your information, email me at [CONTACT_EMAIL].

2. The information I collect

When you send an enquiry (the "Get a quote" form)

Your name, email address, business name and country
Your current website address, if you give it
Details about your project: the services you're interested in, your business type, goals, features, websites you like, budget range, timeframe and anything else you choose to tell me
How you heard about Bloomfound Co, if you tell me

When you email me

Your email address, name and anything you include in your message or attachments

When you become a client and use the client portal

Your name, business name and email address (used for your login)
Project information, messages you send, files you upload (for example logos, photos and written content), and your design approvals or feedback
Basic technical information needed to keep your account secure, such as login times and IP address

When you visit the website

Anonymous, aggregated usage information through Vercel Analytics, which does not use cookies
If you agree to analytics cookies, information about how you use the site through Google Analytics (see the Cookie Policy)
Standard server logs (such as IP address, browser type and pages requested), kept by my hosting provider for security and troubleshooting

I don't ask for, and you shouldn't send me, sensitive information such as health details, and I never ask for your passwords to other services through the website or email.

3. How and why I use your information

The law requires me to have a valid reason (a "lawful basis") for using your information. Here's what I use it for and why:

I don't sell your information, and I don't use it for automated decision-making or profiling. I won't add you to a marketing mailing list without your permission.

I only share your information with trusted service providers who help me run the business, and only as much as they need. They act on my instructions:

Vercel — website hosting and cookieless analytics
Supabase — client portal database, logins and file storage
Resend — sending emails from the website and portal
[EMAIL_PROVIDER] — my business email account
Google — Google Analytics, only if you consent to analytics cookies
Cloudflare — spam protection on forms (Turnstile), if enabled
My accountant, bank and payment providers, where needed for invoicing and legal records

I may also share information if required by law, or to protect my rights, or in connection with a sale or restructuring of the business (in which case the new owner would be bound by this policy).

5. International transfers

Some of my service providers are based in, or store data in, countries outside the UK, including the United States. When your information is transferred outside the UK, I make sure it is protected by appropriate safeguards, such as the UK's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, the UK Extension to the EU–US Data Privacy Framework, or a UK adequacy decision.

If you're based outside the UK, your information will be processed in the UK and in the countries where my service providers operate.

6. How long I keep it

Enquiries that don't become a project: up to 12 months after our last contact, then deleted.
Client and project records (including portal content): for the length of the project and then up to 6 years after it ends, so I can meet tax and legal obligations and deal with any questions or claims. Large project files may be deleted sooner once the project is handed over; I'll let you know before this happens so you can download anything you need.
Analytics data: as set out in the Cookie Policy.

7. Your rights

Under UK data protection law you have the right to:

Access the personal information I hold about you
Correct information that is wrong or incomplete
Delete your information in certain circumstances
Restrict or object to how I use your information in certain circumstances, including objecting to use based on legitimate interests
Data portability — receive information you gave me in a commonly used format
Withdraw consent at any time where I rely on consent (this doesn't affect anything done before you withdrew it)

To use any of these rights, email [CONTACT_EMAIL]. I'll reply within one month. There's normally no charge.

If you're in the European Economic Area or another country with its own data protection laws, you may have similar rights under those laws.

8. Complaints

If you're unhappy with how I've handled your information, please contact me first so I can try to put it right. You also have the right to complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk, or to the data protection authority in your own country.

9. Keeping your information secure

I use reputable providers, encrypted connections (HTTPS), access controls and secure logins to protect your information. The client portal only lets you see your own projects. No system is completely secure, so please keep access to your email account (which you use to log in to the portal) safe.

10. Children

This website and my services are for businesses and are not aimed at children. I don't knowingly collect information from anyone under 18.

11. Information I process for my clients

If, while building or looking after your website, I handle personal information that belongs to your business (for example, your customers' details), I do so as your processor on your instructions. The terms for this are set out in my Terms of Service and any data processing agreement between us.

12. Changes to this policy

I may update this policy from time to time. The latest version will always be on this page, with the date it was last updated at the top. If changes are significant, I'll let clients know by email.