Legal
Privacy and cookies
What we collect, why we collect it, who else sees it, and how to make us stop. Written to be read rather than to be survived.
Who we are
This site is run by Brassneck Studio Ltd, which designs and builds websites and makes games. We are the data controller for everything described on this page, which means we are the ones responsible for it and the ones you complain to first.
Cookies, and why there isn't a banner
This site sets no cookies at all. Not necessary ones, not analytics ones, not advertising ones. There is nothing to accept, so we do not ask you to accept anything.
Most cookie banners exist because the site is doing something to you that legally requires your permission. We are not, so a banner would be theatre. Here is the whole truth about what touches your browser.
What we do instead of tracking you
We use Umami to count visits. It does not use cookies, it does not store an identifier on your device, it does not follow you to any other website, and it cannot tell who you are. What it records is the page you looked at, the site that sent you (if any), your browser, your operating system, your device type, and your country. That is the lot. We use it to find out which pages people actually read, which is the only reason we have it.
The one honest asterisk
The Umami script does read a single value from your browser's local storage, called umami.disabled. It is an off switch, and the only person who ever sets it is us, on our own machines, so our own visits do not pollute the numbers. Nothing is written to your device and nothing is read that identifies you. We mention it because "we touch nothing" would be very slightly untrue, and we would rather tell you than be caught rounding.
Things we deliberately do not have
- No advertising or remarketing tags. No Meta pixel, no Google Ads, no LinkedIn Insight.
- No cross-site tracking of any kind.
- No session recording or heatmaps. Nobody is watching your mouse move.
- No selling of data, to anyone, ever. There is no version of this business where that is on the table.
What we collect, and why we are allowed to
When you send us an enquiry
The contact form asks for your name, your email address and a message. We use it to reply to you and, if it turns into a project, to run that project. Our lawful basis is taking steps at your request before entering into a contract, and after that legitimate interests in answering people who write to us. You are not signed up to anything by sending an enquiry, and we do not add you to a mailing list.
When you are a client
While we are building something for you we hold your contact details, whatever content and images you send us, invoices and correspondence, and any access credentials you give us. Lawful basis: performance of our contract with you, and legal obligation for the accounting records.
Where we build a site that collects data from your customers, you are the controller of that data and we are your processor. Which of us is responsible for what is set out in our terms.
When you just visit
The anonymous counts described above, and nothing else from us. Lawful basis: legitimate interests in knowing whether anybody reads the thing we built. Since none of it identifies you, the interest is a fairly easy one to balance.
Things that happen because of how the web works
Two of these are worth naming because a privacy policy that pretends they do not happen is not much of a privacy policy.
- Our host keeps server logs. The site is served by GitHub Pages, and like every web server it records requests, including IP addresses, for security and abuse prevention. Those logs are GitHub's, not ours, and we do not have a copy of them.
- The typefaces are ours. They used to come from Google Fonts, which meant your browser said hello to Google before you had read a word. We now serve them from this domain, so that no longer happens. Mentioned because it is the sort of thing most sites still do without telling anybody.
Who else sees it
A short list, and it gets shorter when we can manage it. These are the only third parties involved in this website, each bound to use the data only for what we ask. There is no advertising network on this list and there is not going to be one.
| Who | What they do | What they get | Where |
|---|---|---|---|
| Umami Software | Counts visits | Anonymous page views, referrer, browser, device type, country | European Union |
| Formspree | Delivers the contact form to our inbox | Whatever you typed into the form | United States |
| GitHub | Hosts the site | Server logs, including IP addresses | United States |
| Zoho | Our email and client records | Enquiries and correspondence once they reach us | European Union |
Sending data outside the UK
Several of those are American companies, so some of this data leaves the UK. Where it does, the transfer relies on the UK's International Data Transfer Addendum to the standard contractual clauses, or on the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. In practice the only thing crossing the Atlantic with your name on it is an enquiry you chose to send us.
We will also hand over data if the law makes us, which has not happened and would surprise us a great deal.
How long we keep it
- Enquiries that go nowhere: twelve months, then deleted. Long enough for you to come back, short enough that we are not sitting on a graveyard of old emails.
- Client records: six years after the last invoice, because HMRC and the Limitation Act both want them kept that long.
- Access credentials: deleted as soon as the work needing them is finished, and we would rather you changed them afterwards anyway.
- Analytics: aggregate counts with nothing personal in them, kept for as long as they are useful.
Your rights
Under UK data protection law you can ask us to show you what we hold about you, correct it, delete it, restrict what we do with it, hand it over in a portable format, or stop processing it altogether. You can also object to anything we do on the basis of legitimate interests, and where we are relying on consent you can withdraw it at any time without having to explain yourself.
Email oliver@brassneck.studio and say what you want. It is free, we will answer within a month, and we are not going to make you justify the request. Realistically, for most people reading this, the honest answer will be that we hold nothing at all.
There is no automated decision-making here and no profiling. Nothing on this site decides anything about you.
If we get it wrong
Tell us first, at oliver@brassneck.studio. We would much rather fix it than read about it.
If we do not fix it, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. Complaining to them costs you nothing and you do not need our permission.
Changes to this page
If we add a tool, change a provider, or start doing something with data that we do not do today, this page changes first and the date at the top changes with it. If the change is a significant one and we hold your email address because you are a client, we will tell you rather than making you notice.