Privacy Policy

Who we are

The data controller is Little Web Lab, a small UK web studio based in Boston, Lincolnshire, run as a sole-trader business under that trading name. Our full legal identity and postal address are in the Legal notice in our Terms. If anything here isn't clear, just email [email protected] and we'll explain it properly.

What we collect

• When you ask for a free preview: your name, business name, trade, email and phone number, and (if you give them) your Google Maps listing or current website, your domain, the plan you're interested in and anything you write in the message. We email you a short note to confirm we've got them.
• When you become a customer: the details we need to build and run your site (your business information, photos, hours, services), your login details, and billing information. Card payments are taken by Stripe on its secure pages — we never see or store your full card number.
• Enquiries sent to your site: if your plan includes a contact or quote form, the messages people send through it are stored for you to read in your client dashboard. We process these on your behalf, as your processor — the rules we follow are in our Data Processing Annex.
• When you visit: basic, privacy-friendly visitor stats (like how many people viewed a page) via cookieless Cloudflare Web Analytics. These are aggregated and aren't used to track you across the web.
• On our clients' sites: when you tap a call, WhatsApp, email, directions or “book” button on a site we run, the site records a simple tally of that tap (which button, which page, which website sent you there) so the business can see how people reach them. No IP address, device details or cookies are stored, and nothing identifies you.
• Demo bookings: if you try the booking calendar on one of our sample sites (the salon or the dental practice), the name, email and phone you enter create a real test appointment in our demo Setmore account so you can see the confirmation flow. No payment is taken, and demo bookings are cleared periodically.

If we've called you

We ring local businesses to offer them a website. If that was you: we took your business name, phone number and the fact that you have no website (or a broken one) from public business listings — usually Google Maps and the like, and sometimes the public Companies House register. If you do have a website, an AI model (Anthropic's Claude) may read its public text to judge whether it looks dated. Before we ring, we check the number against the Telephone Preference Service registers through 121prodata. After a call we keep your business name, your number and a short note of what was said, so we know what we talked about and don't ring you twice about the same thing. We keep that until you tell us to stop, and in any case no longer than 12 months after the last call. Say the word — on the phone, or by emailing [email protected] — and we delete it and don't call again. We don't call numbers registered with the Telephone Preference Service (TPS or CTPS).

Cookies

We don't use tracking or advertising cookies, so there's no cookie pop-up to click through. If you log into a client dashboard, we store a small sign-in marker in your browser's storage to keep you logged in — nothing is shared with anyone else. Our anti-spam check (Cloudflare Turnstile) may set a short-lived cookie purely to tell people from bots. Both are strictly necessary for the service you asked for, which is why the law doesn't need us to ask first.

Why we use it

• To reply to your enquiry, build your free preview and, if you go ahead, look after your site.
• To take payment for your plan and keep your account running.
• To do the “getting found” work you're paying for (such as your Google Business Profile), on your behalf.
• To keep the website secure, stop spam, and make it better. To stop abuse of our forms we keep a scrambled (hashed) form of your IP address for about a day.

Our legal bases are: performing our contract with you (building and running your site), our legitimate interests (replying to enquiries, keeping things secure, understanding site usage), and legal obligations (keeping tax records).

Who processes it for us

Only the services we need to run things. We'll never sell your information to anyone.

• Cloudflare — hosting, our anti-spam check (Turnstile), cookieless Web Analytics, and storage for the photos and files you send us.
• Supabase (EU region) — client accounts and the enquiries sent to client sites.
• Resend — the automatic emails we send (enquiry notifications, login and account emails). They all go from our own Little Web Lab address, showing the business's name, with replies going back to that business.
• Setmore — the booking calendars on Get Booked sites and on our sample sites (demo accounts).
• Stripe — subscription billing and card payments.
• Google — for the Business Profile work we do on your behalf, our own business email, signing you in if you choose “Sign in with Google”, and looking up public business listings (Google Maps) when we find businesses to call.
• Anthropic — the AI model (Claude) behind the helper on the change-request form: it reads the request you're writing, and any photo of a price list or opening-hours sign you ask it to read, so it can ask a clarifying question or turn the photo into rows you check before anything is saved. We also use it to judge whether a business's public website looks dated before we call. Anthropic doesn't use this data to train its models.
• 121prodata — checks a business phone number against the Telephone Preference Service registers (TPS and CTPS) before we call it. Only the number is sent.

International transfers

We keep data in the UK and EU wherever we can. Cloudflare, Resend, Stripe, Setmore, Google and Anthropic may process some data in the United States; where they do, transfers are covered by standard contractual clauses (and the UK addendum) so your data keeps the same protection.

How long we keep it

• Enquiries and leads: enquiries sent through a client's site, 24 months from when they arrived. Your own enquiry to us, if you don't become a customer, 24 months after we last spoke. Then deleted automatically.
• Notes from a cold call: until you tell us to stop, and at most 12 months after the last call.
• Your page, if you never become a customer: if you never become a customer, your login and anything you sent us are deleted 12 months after our last contact (24 if you wrote to us first).
• Client accounts: for as long as your plan runs, then deleted 30 days after it ends, automatically. One thing stays: our customer record for you (your business name, contact details, the dates, what you paid and our notes of what we did), which we keep for 6 years after your plan ends — for tax and in case of a legal claim — and then delete automatically. Your account page shows the exact date once your plan ends. A late payment on its own never deletes anything: a plan only ends for non-payment after 60 days unpaid and a final notice giving the date (Terms, section 7), and then the same 30-day deletion applies.
• Change requests: what you asked for, and any photos you attached, for 12 months after we finish the job — then deleted automatically. We keep them that long so we can tell you what we changed and when, and no longer.
• Visitor stats: aggregated only; nothing identifies you individually.

Ask us to delete what we can sooner, and we will.

Your rights

You can ask to see the information we hold about you, correct it, have it deleted, restrict how we use it, object to how we use it (and you can always say no to marketing calls or emails), or receive a copy to take elsewhere. Just email [email protected] and we'll sort it, normally within a month. If you're ever unhappy with how we've handled your data, you can complain to the UK regulator, the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to put it right first.

Children

Our services are for businesses. We don't knowingly collect information from anyone under 18.

Changes to this policy

If we update this policy we'll change the date at the top. For anything significant, we'll let customers know directly.

Contact

Questions about your data? Email [email protected], or call or WhatsApp the number on our contact page — one number does both, and a real person answers.