Legal
Privacy Policy
We hate privacy-policy legalese as much as you do. So here's the honest version: what actually happens to your data when you get in touch, in words a human can read.
Last updated: 23 August 2026
The short version
If you contact us — through the form, by email, or by phone — we collect only what we need to reply to you and, if it goes somewhere, to run the work. We store it on our own server in the UK/EU. We don't sell it, we don't rent it, we don't feed it into ad networks, and we don't sign you up to anything. A handful of trusted suppliers help us run the plumbing (spam-blocking, email, voicemail, website hosting) and nothing more. You can ask us to show you what we hold or delete it at any time, and we'll do it.
The longer version, because you deserve the detail:
Who we are
This site is run by Automancer Ltd, a company registered in England and Wales (company no. 17060907). We're the "data controller" — the ones responsible for your data and the ones you hold accountable for it. The sole director is Waseem Ilyas. We're registered with the UK's data protection regulator, the Information Commissioner's Office (ICO), under registration number ZC180569.
Automancer Ltd
62 Beckfield Road, Bingley, BD16 1QS
Questions about your data? Email waseem@automancer.uk — it reaches Waseem directly.
What we collect, and why
When you fill in the contact form
The form asks for, and we store:
- Your name and email — so we know who you are and can reply.
- Your business name and team size (optional) — context, so the reply is useful.
- What you wrote — the message itself, about what you're trying to fix.
- Your IP address — recorded with the submission, purely to spot and block spam and abuse. It isn't used to profile or track you.
- An anti-bot token — a one-time token from the security check on the form (see "Cookies and the security check" below), used only to confirm you're a person.
When you hit send, the form posts straight to our own server (at api.automancer.uk) and lands in our own database. There's no third-party form service in the middle — no Formspree, no Typeform, no Google Forms. We then send ourselves an email notification so we don't miss you. That's the entire journey.
When you email us
If you email waseem@automancer.uk, we keep the email and anything you send with it, for as long as we need it to help you. Our email runs on Google Workspace (more on that below).
When you call us
Calls to our published number are forwarded to us. If you leave a voicemail, it may be recorded and automatically transcribed into text so we can pick it up reliably and get back to you. We keep the recording and transcript only for as long as we need to respond and handle your enquiry. The voicemail and transcription is handled for us by Vonage (see below).
When you just browse the site
Almost nothing. This site is static — there's no analytics, no tracking pixels, no advertising tags, no "people who viewed this also viewed" machinery. Our fonts are served from our own site, so your browser doesn't call out to Google or anyone else to load them. Two things we can't avoid. First, the site is hosted on GitHub Pages, and like any web host, GitHub's servers keep standard technical logs (including visitor IP addresses) to serve the pages and keep the service secure. Second, we run error monitoring (Sentry) so we find out when a page breaks. It stays quiet unless something actually goes wrong: if a script on the page throws an error, it sends us the technical details of that error — what broke, where, and which browser it happened in. We've turned off the settings that would attach personal data such as your IP address, and it does no performance tracking and no session recording. Neither of these is us watching you — it's the site staying up, and us noticing when it doesn't.
Our lawful bases
Under UK GDPR we need a lawful reason to process your data. Ours are:
- Legitimate interests — the main one. When you get in touch, it's in both our interests for us to read your message, reply, and take the conversation forward. We also have a legitimate interest in keeping the form and our systems free of spam and abuse.
- Contract — if we go on to work together, we process what's needed to deliver the work, quote, invoice, and keep proper records.
- Legal obligation — some records (e.g. tax and accounting) we're required by law to keep.
- Consent — where we ever genuinely need it, we'll ask for it plainly, and you can withdraw it just as easily. We don't do marketing emails, so this rarely comes up.
Where your data lives
Enquiries you send through the form live in our own database, on our own server — a VPS hosted in the UK/EU (with OVH). It's not sitting in some third-party marketing platform. A few suppliers (below) process specific slices of data on our behalf; where any of them operate outside the UK/EU, that transfer is covered by the appropriate safeguards (such as the UK's International Data Transfer Agreement or adequacy decisions).
Who else touches your data (our processors)
We keep this list short on purpose. These are suppliers that process data for us, under contract, only to do the job we've hired them for. We never sell your data, and we never share it for anyone else's marketing.
- Cloudflare (Turnstile) — the "security check" on the contact form. It tells spam-bots apart from people so our inbox doesn't drown. Used purely for security and anti-fraud.
- Vonage — handles call forwarding, and records and transcribes voicemails so we can respond to them.
- Google Workspace — our email. If you email us, or we email you, it passes through Google's Workspace service (business plan, not the ad-funded consumer one).
- GitHub (Pages) — hosts and serves this website. Its servers hold standard technical access logs, as any web host does.
- Sentry — error monitoring. When a script on the site fails in your browser, Sentry receives the technical details of that failure so we can fix it. We've turned off the settings that would attach personal data such as your IP address by default, along with performance tracking and session replay, and the data is processed on Sentry's EU (Germany) infrastructure. An error message or URL could still incidentally contain something personal if you typed it into the page yourself.
Cookies and the security check
We don't use tracking or analytics cookies, so there's no cookie banner — because none of the browser storage we use requires consent. We checked this empirically: outside the contact-page security check described below, loading the site sets no cookies and stores nothing in your browser.
The one exception is the security check (Cloudflare Turnstile) on the contact page. When we measured it, Turnstile set no cookie. While it is actively defending the form, it writes a small value named cf.turnstile.u to localStorage under Cloudflare's challenges.cloudflare.com origin, not ours. PECR applies to this kind of browser storage as well as to cookies. We rely on its strictly necessary exception because the storage supports the security check needed to protect the contact-form service you ask to use, and we do not use it for tracking. That is why we do not ask for consent. Turnstile only runs on the contact page.
How long we keep it
We keep enquiry data for as long as it's relevant to a potential or actual engagement — long enough to have the conversation, do the work, and keep the records we're legally required to keep. When it's no longer needed, we delete it. And if you ask us to delete your data sooner, we will (unless the law requires us to hold onto a specific record).
Your rights
Under UK GDPR, you have the right to:
- Access — ask for a copy of the data we hold about you.
- Rectification — have anything wrong or out of date corrected.
- Erasure — ask us to delete your data ("the right to be forgotten").
- Restriction — ask us to pause processing while something's sorted out.
- Objection — object to processing we base on legitimate interests.
- Portability — get your data in a portable format, where that applies.
- Withdraw consent — where we relied on it, at any time.
To exercise any of these, just email waseem@automancer.uk. No special form, no hoops. We'll respond within one month, and there's normally no charge.
Complaints
You have the right to complain to us about how we've handled your data. Email waseem@automancer.uk and say you're making a complaint — there's no form and no hoops, a plain email is enough. We'll acknowledge it within 30 days and respond without undue delay.
We'd rather you came to us first so we can put things right, but you don't have to. You can also complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk — and you can do that whether or not you've raised it with us.
Work we don't take on
For everyone's protection, we steer clear of certain high-risk engagements — for example, work heavy on patient data, or highly confidential government/military systems — unless it's explicitly agreed and set up properly first.
Changes to this policy
If we change how we handle data, we'll update this page and the "last updated" date at the top. For anything significant, we won't bury it.