Privacy, and who you are actually dealing with
- Last updated 5 August 2026
- No cookies, no analytics, no tracking
- One form, one recipient
- Enquiries kept 12 months
Who I am
- Who
- Stephen Evans, a sole trader based in Crowborough, trading as Kestrel.
- Where
- Crowborough, East Sussex, TN6, United Kingdom. I work from home, so the full address is not published; email or ring me and I will give it to you.
- hello@madebykestrel.co.uk
- Phone
- 07544 148113
- VAT
- Not registered. Published prices are what you pay.
- Trading name
- Kestrel is a trading name. There is no limited company, so the person named above is the one you are contracting with and the one responsible for your data.
What the form collects
- Required
- Your name, and an email address that looks valid. Without both I cannot reply, and the form refuses the submission.
- Optional
- Your business or website name, and anything you write in the message box.
- The four answers
- What you need building, a rough budget band, when you want it live, and the one-line summary those three produce.
- Not required by law
- None of it. There is no statutory obligation to give me any of this; it is what makes a useful reply possible.
- Automatically
- The internet address your submission comes from, used only to count submissions so one source cannot flood the form. It is held in the server's memory and never written to a file or a database.
The message box is free text and it is read by one person, me. Please do not put anything sensitive in it, and that includes health information, anything about someone’s finances, or details about a third party who has not agreed to it. If you need to tell me something like that, ring me instead.
Why I am allowed to hold it, and what for
Four purposes. Reading and replying to your enquiry. Stopping automated abuse of the form. Hosting and running the site at all, which produces server request logs whether anyone submits anything or not. And keeping a record of work I have done.
The lawful basis for all four is legitimate interests, under Article 6(1)(f) of the UK GDPR. The interest is straightforward: I cannot run a business that quotes for work without reading the enquiries, keeping the form usable, or keeping the site online. If you would rather I did not hold your enquiry, say so and I will delete it.
Who else sees it
Three companies, named rather than described as trusted partners. Vercel hosts the site and runs the code, so it processes the submission in transit and keeps server logs. Resend sends me the notification email, and uses Amazon SES underneath. IONOS runs the mailbox the notification arrives in.
Your email address goes to Resend twice: once inside the message and once as the reply-to address, so it is handled as an addressing field and not only as text. Vercel and Resend are US companies, so your enquiry does leave the UK. Both operate under the UK extension to the EU-US Data Privacy Framework. Nobody else receives it, it is never sold, and it is not used for marketing.
How long I keep it
- Enquiries that go nowhere
- Twelve months, then deleted. Long enough to remember a conversation from last year, short enough not to be hoarding.
- Clients
- Six years after the end of the work, because HMRC requires self-employed records to be kept and that period is the binding one.
- Server logs
- Kept by Vercel for the period set by their platform rather than by me, and then discarded. They contain requests, not form contents.
- The abuse counter
- Ten minutes, in memory only. It disappears when the server restarts.
What this site does not do
No analytics. Not Google Analytics, not a tag manager, not a privacy-friendly alternative. Nothing counts your visit. No cookies are set, by me or by anyone else, which is why there is no cookie banner: asking your consent for nothing would only train you to click through the banners that matter.
No third-party scripts, no embedded fonts from someone else’s server, no social pixels, no advertising, no mailing list, no profiling and no automated decisions about you. The content security policy on every page blocks the site from loading or calling anything outside itself, which is the part you can verify rather than take on trust.
Your rights, and how to complain
You can ask me for a copy of what I hold about you, ask me to correct it, ask me to delete it, ask me to restrict what I do with it, and object to my holding it at all. Because the basis is legitimate interests rather than contract, the right to data portability does not apply, and I would rather say that than list a right you do not have.
Email hello@madebykestrel.co.ukand I will reply. If you complain to me directly I have to acknowledge it within thirty days. If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk, and you do not need to come to me first.
Terms, and the small print
Every price is published on the pricing page and every other fact about the business is on facts. Terms are 50% to book and 50% on launch, and I send written terms with every quote before you commit to anything.
If any of this is wrong, out of date, or unclear, tell me and I will fix it. This page was last changed on 5 August 2026. It is not a legal document drafted by a solicitor; it is an honest description of what the site does, written by the person who built it.
This page, measured in your browser
Your deviceReal numbers from your device and connection, not a screenshot of a score I chose. Nothing is sent anywhere. The measurement happens in your browser and stays there. If one of these ever reads amber on my own site, you will see it, which is rather the point. I audit these for £650.