Privacy Policy

Last updated: 27 September 2026

Who we are

Whinstone Digital is a sole-trader web design and development business operated by Alex Smith, based in North East England. For anything in this policy, contact WhinstoneDigital@gmail.com.

What we collect

Depending on how you interact with the site, we may collect:

• Your name, email address, business name and website, when you use a contact form or the free security scan request
• Business name, contact name, email, and your signature, when you sign a service agreement through the client agreement tool — this covers custom builds and our Maintenance, Marketing, and Security plans
• Billing name and email, when you pay for a service via Stripe Checkout, invoice, or payment link
• If you take out a Marketing Retainer, access to your own advertising, analytics, or social media accounts, where you've given us that access to deliver the service — these always remain your accounts, and access is removed once the service ends
• The content of any message you send us directly

We do not collect or store payment card details ourselves — all card payments are handled entirely by Stripe (see "Third parties" below).

Why we collect it

We use this information to respond to enquiries, deliver the services you've paid for or requested, prepare and store signed service agreements, manage any ad/analytics/social accounts you've given us access to for a Marketing service, issue receipts and invoices, and meet our own legal and tax obligations. We do not sell or rent your data to anyone, and we don't use it for advertising.

Cookies & tracking

This site does not currently use analytics or advertising cookies. It does use a live chat widget (Crisp), which sets its own functional cookies so it can recognise you if you return to a conversation — see Crisp's privacy policy for details on how they handle that data. If you go through to Stripe Checkout to pay for a service, Stripe may set its own cookies on their domain as part of processing your payment securely — that's covered by Stripe's own privacy policy, not this one.

If we add Google Analytics to this site in future, it will only ever run after you actively accept it via an on-page banner — nothing is set without that choice, and rejecting or ignoring the banner means no analytics cookies are used. You can change your mind at any time by clearing your browser's cookies/site data for this domain, which resets that choice.

Third parties

We use a small number of trusted providers to run this business, each of whom processes data under their own privacy terms:

• Stripe — payment processing (card details never reach us directly)
• Cloudflare — website hosting and delivery
• Crisp — live chat widget on this site, if you choose to use it
• Google (Ads, Analytics/GA4, Business Profile) — only where you've taken out a Marketing service that uses these, and only within the account access you've given us
• Meta (Facebook/Instagram) — only for clients on Social Media Management
• Mailchimp or Brevo — only for clients on Email Newsletter Management, to send your newsletter to your own mailing list

Occasionally we may bring in a subcontractor to help deliver part of a project. Where that happens, they're bound by the same confidentiality obligations we are, as set out in the Confidentiality and Subcontracting clauses of your signed service agreement.

How long we keep it

We keep enquiry-related information for as long as needed to respond to it, signed service agreements for the life of the agreement plus a reasonable period afterward, and financial records (invoices, payment records) for at least 6 years, in line with UK HMRC record-keeping requirements. Anything else is deleted once it's no longer needed.

Your rights

Under UK GDPR, you have the right to ask what personal data we hold about you, to have inaccurate data corrected, and to request it be deleted where we're not required to keep it for legal reasons (such as tax or contract records). To make a request, email WhinstoneDigital@gmail.com. If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (ICO).

If you're a client's customer

If a business we work with collects personal data from its own customers — through a contact form or mailing list on a site we've built or maintain, for example — that business is responsible for its own compliance with UK GDPR, including having its own privacy policy. We only handle that data as far as reasonably necessary to deliver the service they've asked for. This policy covers Whinstone Digital's own collection of your data as a visitor or client, not a client's use of their own customers' data.

Changes to this policy

We may update this policy occasionally as the business grows — the date at the top will always show when it was last changed.