Privacy policy.

Last updated: 16 September 2026

Who we are

Built by Boot is a web design studio based in Greater Manchester, United Kingdom. For the purposes of UK data protection law (UK GDPR and the Data Protection Act 2018), Built by Boot is the data controller for the personal data described in this policy.

Contact for anything data-related: contact@builtbyboot.co.uk.

What we collect and why

The only personal data this website collects is what you choose to send us through its forms, such as the contact form:

• Your name and, optionally, your business name
• Your email address and, optionally, your phone number
• What you need and the message you write

We use this solely to read and reply to your enquiry, and, if you become a client, to carry out the work you've asked for. Our lawful basis is legitimate interest (responding to an enquiry you initiated) and, where we go on to work together, performance of a contract.

When you send an enquiry, an audit request or a guide request, we save it in a private database on our own hosting account with Hostinger, and we get an email to say it has arrived. The database can't be reached from the web, and only our team can sign in to see it. We add our own notes as we reply, so we have the history if you come back to us.

To stop our forms being flooded by bots, we also keep a scrambled (hashed) form of your IP address. It is not stored with your enquiry, it is only used to count how often the forms have been sent recently, and we clear it out after a day.

When you send an enquiry, we also email you a short note to say it arrived. If we send you a quote, we may follow up with up to two short reminders about it, and each one has a link to stop them.

The content intake form at /intake works differently, because it collects the material we need to build your site — including your logo and photos. It is processed by Basin (Cornerstone Software Inc., United States), who receive and store those submissions and files on our behalf so we can download them. Files stay there until we have your site built and are then removed. A copy of what you type into it (not the files) is also saved in our own database, next to our other enquiries. If you would rather not use it, email us and we will take your content another way.

If you ask for one of our free guides, we keep your email address and which guide you asked for, and email it to you when it’s ready. We only send you tips if you tick the box for them, and our lawful basis for those is your consent. Every tip has an unsubscribe link, and if you use it we keep your address on a list of people not to send tips to, so that we never do.

Cookies, analytics and advertising

Nothing loads until you choose. We use Google Analytics 4 to see which pages people find useful, and the Meta Pixel to measure whether our Facebook and Instagram advertising is working. Both load only if you press “Accept” on our cookie banner. Choose “Essential only”, or ignore the banner, and neither script is ever requested and neither sets a cookie. We do no fingerprinting.

If you do accept, Google Analytics sets cookies on your device and receives your IP address and basic details about your visit (pages viewed, approximate location, device and browser). Google acts as our processor for this, and may transfer data outside the UK. Our lawful basis is your consent, which you can withdraw at any time by clearing this site’s data in your browser — the banner will then ask you again.

The Meta Pixel is an advertising tracker, so it is worth being plain about what it does. If you accept, it sets cookies on your device and tells Meta (Facebook and Instagram) that you visited a page on this site, along with your IP address and browser details. Meta can match that against a Facebook or Instagram account, which is how we can tell whether an advert led to an enquiry. Meta is based outside the UK. The lawful basis is again your consent, and declining the banner means the pixel is never loaded at all.

Accepting also lets this site remember, in your own browser, which website or advert brought you here and the first page you saw. If you then send us a form, that goes along with it, so we can tell which of our marketing works. Google Analytics is also told that a form was sent, but not what was in it.

Two smaller technical points, in the interest of full transparency:

• Whichever choice you make on the cookie banner is saved in your browser’s local storage (a single value on your own device) so we don’t ask you again. That happens whether you accept or decline.
• Our fonts are served from our own server, not from Google Fonts or any other third party. If you have not accepted analytics, loading a page on this site does not send your IP address to anyone but our host.

Hosting and server logs

This website is hosted by Hostinger. Like almost all web hosts, Hostinger's servers keep standard access logs (IP address, pages requested, browser type, timestamps) for security and operational purposes. We don't use these logs to identify individual visitors.

How long we keep your data

Enquiries, and the emails we get about them, are kept for up to 24 months from your last contact with us, so we have context if you come back to us, and are then deleted. If you become a client, we keep project correspondence for as long as needed to deliver and support the work, and financial records for as long as UK tax law requires (currently six years). Addresses on our list of people not to send tips to are kept for as long as we need them to keep that promise.

Who we share it with

Only the service providers who make the website, our forms and our email work, each acting on our instructions, or where the law requires it. We never sell personal data. Currently that is:

• Hostinger: hosting, email, and the database our forms save to
• Basin (Cornerstone Software Inc., United States): the content intake form and its file uploads
• Google: Analytics, and only for visitors who accept the cookie banner
• Meta (Facebook and Instagram): advertising measurement, and only for visitors who accept the cookie banner

Basin, Google and Meta are based outside the UK, so using them involves an international transfer of data. All three rely on the standard safeguards permitted under UK GDPR for those transfers.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct it if it's wrong
• Have it erased ("right to be forgotten")
• Restrict or object to how we use it
• Receive a copy in a portable format

To exercise any of these, email contact@builtbyboot.co.uk. We'll respond within one calendar month. If you're not happy with how we handle your data, you can complain to the UK's Information Commissioner's Office at ico.org.uk.

Changes to this policy

If we change how this site handles personal data (for example, if we add analytics), we'll update this page and the "last updated" date above.