Privacy policy.

01Who we are

Topline Studio is a sole-trader web design business operated by Ben Edwards, based in Liverpool, UK. We aren't (yet) a limited company, which means I — Ben — am personally the "data controller" under UK GDPR.

If you want to reach me about anything in this policy, email ben1.edw@gmail.com. Every email reaches a real human.

02What we collect

Only what's needed to do the job. Specifically:

Things you give me on purpose

• Lead intake form (the /start page): your name, email, phone, business name, industry, budget range, timeline, the URL of your existing site (if any), and any free-text notes you choose to share about goals or what's broken.
• Free audit form (the /audit page): the URL you want audited, and optionally your email if you'd like the report sent over.
• Email replies: anything you write back when I email you.

Things collected automatically

• IP address and browser user-agent — captured on form submissions and audit requests, used to rate-limit abuse and detect bots.
• Page-view beacon — a tiny script (assets/beacon.js) on a few public pages records which page you visited, the referrer, and the UTM tags on the URL. No fingerprinting, no cross-site tracking.
• Session ID — a random string stored in your browser's local storage so I can link an audit you ran to a lead you submit later. It's not tied to any identifier — clearing your browser data deletes it instantly.

03Why we collect it (lawful basis)

Under UK GDPR I rely on two lawful bases:

• Consent — when you submit a form, you're consenting to me using your details to reply, send a quote, and (if you're a client) deliver the work.
• Legitimate interest — basic analytics (page-views, referrers) and abuse prevention (IP-based rate limiting). I've balanced this against your privacy and concluded it's low-impact and reasonable for a business of this size.

04Who we share it with

I keep the supplier list short on purpose. As of the last-updated date above, your data may pass through:

• Google PageSpeed Insights API — when you run a free audit, the URL you submit is sent to Google's public PageSpeed API for grading. Personal data is not sent — only the public URL.
• Gmail / Google Workspace — outbound and inbound email (the toplinestudio.uk@gmail.com and ben1.edw@gmail.com addresses).
• Render — hosts the website, the database and the admin dashboard. Their servers are in the US.
• GitHub — stores the source code of the site (not the database).

05How long we keep it

Lead and audit records are kept until the earlier of:

• You ask me to delete them (just email and I'll do it within 30 days), or
• Seven years after our last invoice — UK HMRC requires self-employed traders to keep financial records that long.

Page-view logs and unconverted audits older than 24 months are automatically pruned.

06Your rights under UK GDPR

You have the right to:

• Access — ask for a copy of everything I hold about you.
• Rectification — ask me to fix anything that's wrong.
• Erasure — ask me to delete it (the "right to be forgotten").
• Portability — get your data in a machine-readable format.
• Objection — object to me processing your data on legitimate-interest grounds.
• Withdraw consent — at any time, with no need to justify it.

To exercise any of these, email ben1.edw@gmail.com. I aim to respond within 5 working days and complete the request within 30. There's no charge.

07International transfers

Some of my suppliers (Gmail, Render, GitHub) are US-based, which means your data may be processed in the United States. The UK government has issued an adequacy decision (the "UK Extension to the EU–US Data Privacy Framework") that allows this transfer lawfully. Where adequacy doesn't apply, my suppliers rely on Standard Contractual Clauses.

08Cookies and local storage

See the Cookie Policy for the full breakdown. Short version: I only use storage that's strictly necessary (admin login + audit attribution). No analytics cookies, no ad cookies, no tracking pixels.

09Children

Topline Studio is a B2B service aimed at small business owners. The site isn't directed at under-18s and I don't knowingly collect data from anyone under 18.

10Complaints

If you think I've handled your data badly, please email me first — I'll always try to put it right. If you're still not happy you have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)
ico.org.uk/make-a-complaint
Helpline: 0303 123 1113

11Changes to this policy

I'll update this page if my practices change — for example if I add a new supplier or analytics tool. The "last updated" date at the top of the page always reflects the current version. If the changes are material I'll email anyone who has an active lead on file.

12Contact

Questions about this policy, your data, or anything else — email ben1.edw@gmail.com.