Privacy
policy.

Who we are

This site is run by The Creative Collective, trading as The Creative Collective. We build software for clients on a subscription. We are the controller of the personal data described on this page, meaning we decide what is collected and why.

For anything on this page, including a request to see or delete your data, write to hello@thecreativecollective.io. A person reads it.

What we collect

• The enquiry form. Your name, your email address and your message, exactly the fields you can see. The form also carries the page you sent it from, so we know what you were reading, and a hidden field that stays empty for humans and catches automated spam.
• Email and calls. If you write to us or book a call, we hold that correspondence and whatever you chose to put in it.
• Server logs. Our host records the IP address, browser and page for each request, as every web server does. We do not build these into profiles, and we do not look at them except when something is broken.
• Measurement. We do not currently run analytics on this site, but we intend to. When we do, it will be to see which pages get read and where visitors arrive from, not to identify you: and we will list the provider here and ask your permission before anything non-essential runs.

We do not ask for a phone number, a company size, a budget or a job title, and there is no account to create. Payment is handled by our billing provider once you are a client; card details never reach this site.

What we will never do

Everything above describes how the site works today and may change as we build. This section will not. These are decisions, not implementation details.

• We will never sell your data, or share it with anyone for their own purposes, at any price.
• We will never build an advertising profile of you, sell one, buy one, or use your data to follow you around other people's websites.
• We will never add marketing email you did not ask for. Sending us an enquiry gets you a reply, not a list subscription.
• We will never make the site's actual behaviour a mystery. Whatever is running on this site is named on this page and in the cookie policy, on the day it goes live.

Why we hold it, and on what basis

• To reply to you. You sent us a message asking for a reply; answering it is the whole point. Legal basis: taking steps at your request before entering a contract, or our legitimate interest in responding to people who contact us.
• To keep the site standing up. Server logs, and the check that stops the contact form being submitted by a script. Legal basis: our legitimate interest in a site that works and an inbox that is not flooded. A security measure protecting a service you asked for does not need permission first, which is why it is here and not under consent.
• To do the work, if you become a client. Legal basis: performing our contract with you.
• To understand what people read. Analytics, once we add it. Legal basis: your consent, which you give or withhold when asked and can withdraw at any time. Nothing that needs consent runs before you give it.

Who else can see it

This is the complete list: every company that can see any of it, and the one job each does for us. They may process your data only on our instructions, and none of them may use it for their own purposes. When we add a provider, it appears here.

• Cloudflare, Hosting and content delivery. Serves every page and runs the function behind the enquiry form. Sees the IP address and request metadata of anyone loading the site, as any web host must. Their privacy policy.
• Resend, Email delivery. Delivers the enquiry form to our inbox. Sees the name, email address and message from that one submission. Their privacy policy.
• Google, Our inbox and the booking calendar. Holds the mailbox your enquiry lands in, and runs the scheduling page behind “Book a call”. Booking a call is a visit to a Google page, under Google’s terms, not ours. Their privacy policy.

These providers operate internationally, so your data may be processed outside your own country. Each is contractually bound to protect it to the standard described here. Beyond the companies named above, we disclose personal data only where the law requires it.

How long we keep it

• Enquiries that go nowhere. Deleted within two years, and sooner if you ask.
• Client correspondence and records. Kept for the length of the engagement and then for as long as tax and accounting rules require.
• Server logs. Held briefly by our host on its own rolling schedule, then discarded.

Your rights

You can ask us to show you what we hold, correct it, delete it, hand it over in a portable format, restrict what we do with it, or object to us holding it at all. We do not charge for this and we do not ask why.

Write to hello@thecreativecollective.io. We reply within one working day and act within thirty. Since we hold almost nothing, most of these requests take a couple of minutes to satisfy.

If you think we have handled your data badly, please tell us first, but you are entitled to complain to your national data protection authority instead, and nothing here removes that right.

Security

The site is served only over HTTPS. The enquiry form is processed on our host's edge network and forwarded straight to our inbox; nothing you send through it is written to a database on this site, because this site has no database. Access to the inbox is limited to the three of us and protected by two-factor authentication.

No system is beyond reach. If we ever suffer a breach that puts your rights at risk, we will tell you and the relevant authority without delay.

Children

This site sells development work to businesses and is not directed at children. We do not knowingly collect data from anyone under 16.

Changes

If we change how any of this works, we change this page on the same day and move the date at the top. There is no archive of old versions; the page you are reading is the policy that applies.