1.Who is responsible for your data
OutrightSite is a trading name of Rene Roach, a sole trader based in England and Wales. For the personal data described here, Rene Roach is the "data controller" ("we", "us", "our").
- Address for service: 61 Bridge Street, Kington, HR5 3DJ, United Kingdom
- Contact and data protection enquiries: [email protected]
2.The short version
- We only collect what we need to build and hand over your website.
- We do not sell your data, ever.
- We never keep copies of your account passwords or access tokens after your build.
- Your card details go straight to Stripe. We never see or store them.
- You have strong rights over your data, set out in section 9, including a clear way to complain.
3.The personal data we collect
When you buy and we build your site, you give us your name and any owner name for your certificate, your business name and details, your contact email, and any phone number, address, opening hours or social links, plus the business information you type into the brief so we can write your copy.
To deploy into your own accounts, you connect your GitHub and Cloudflare accounts. These give us temporary access to build your site in your accounts during the build. We do not keep these after handover (see section 8).
When you pay, payment is handled by Stripe. We receive confirmation that a payment succeeded and basic order details. We never receive or store your full card number.
When you contact us, we keep that correspondence so we can help you.
We do not run tracking cookies or third-party advertising trackers on the OutrightSite site.
4.Data about your website's visitors
Your finished website lives in your accounts, not ours. The visitor analytics we set up (Cloudflare Web Analytics) are cookieless and sit in your Cloudflare account, and your contact form delivers enquiries to you through Web3Forms. Once we hand the site over, you are the data controller for your site and its visitors. This policy covers only the data OutrightSite handles as part of selling and building your site.
5.Why we use your data, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Build and hand over your site | To deliver what you paid for | Performance of a contract |
| Take payment | To complete your purchase | Performance of a contract |
| Reply to your enquiries and support you | To run the service well | Legitimate interests |
| Keep invoices and business records | Tax and accounting duties | Legal obligation |
| Keep the service secure and prevent abuse | To protect you and us | Legitimate interests |
| Send you marketing, if you opt in | Only if you ask for it | Consent |
6.Who we share your data with
We use a small number of trusted providers to run the service, under their own terms:
- Stripe — takes and processes your payment.
- Anthropic — we send your business brief to Anthropic's Claude AI to draft your website copy. We do not send it your account tokens or card details.
- Cloudflare — hosts our own service, and (in your account) your site's hosting and analytics; also our email routing.
- GitHub — stores your site's code, in your account.
- Web3Forms — delivers your site's contact-form enquiries to you.
- Pexels — supplies licensed stock photography (we send search terms, not your personal data).
We share your data only as needed to run the service, or where the law requires it. We never sell your data.
7.Sending data outside the UK
Some of these providers (for example Stripe and Anthropic) are based in, or process data in, the United States or other countries. Where your data is transferred outside the UK, we rely on the safeguards the law allows, such as UK adequacy decisions or the International Data Transfer Agreement.
8.How long we keep it
- Account access (GitHub authorisation, Cloudflare token): held only for your build, then deleted at handover. We do not keep them.
- Your build brief and contact details: removed automatically once your site is delivered and your handover pack is emailed. We keep only a minimal, non-personal delivery record (which site, the date, and the public links to your live site and its code) for our own accounts. You can also ask us to erase everything at any time.
- Business details and invoices: kept only as long as needed to deliver and support your site, and for as long as tax and accounting law requires us to keep financial records (generally around six years).
- Email correspondence: kept while it is useful for supporting you, then deleted.
9.Your rights
Under UK data protection law you have the right to access your data, correct it, erase it where that applies, restrict or object to how we use it, get certain data in a reusable format (portability), and withdraw consent at any time where we relied on it. To use any of these, email [email protected]. We will respond within one month.
10.Complaints
If you are unhappy with how we have handled your personal data, please tell us first at [email protected] so we can put it right. We will acknowledge your complaint within 30 days and respond without undue delay.
You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO): ico.org.uk, helpline 0303 123 1113.
11.Our regulator registration
Rene Roach, trading as OutrightSite, is registered with the Information Commissioner's Office (ICO) as a data controller (registration number ZC150902) and pays the annual data protection fee.
12.Security
We take reasonable steps to protect your data. Payments run through Stripe over encrypted connections, account tokens are held only for the duration of your build and then discarded, and we do not store card details.
13.Changes to this policy
We may update this policy from time to time. The version that applies is the one published at outrightsite.com/privacy. If we make an important change, we will note the date it took effect.