Privacy policy
This policy describes what KustomSite collects through kustomsite.com, why, who processes it on our behalf, how long it is kept, and what you can ask us to do about it. It describes the system as actually built rather than in general terms.
Last updated 20 September 2026
Draft Not reviewed by counsel
LEGAL / 01
01
What we collect when you fill in a form
The enquiry form collects your first name, business name, email address, your industry, whether you already have a website, and its address if you do. A phone number is optional. We also record the page you submitted from and the advertising parameters in the link that brought you here, so we can tell which adverts generate genuine enquiries.
If you become a customer, the onboarding questionnaire collects information about your business that is needed to build your website — your services, service area, opening hours, competitors and similar — along with any files you upload, such as your logo and photographs. Photographs are stripped of embedded location data on upload.
02
What we collect automatically
We set a first-party identifier in a cookie so we can tell a returning visitor from a new one and connect an enquiry back to the advert or search that produced it. We record page views and interactions in our own database, along with coarse location (country and region), device type and screen size.
This first-party analytics data is not shared with advertising networks, is not used to build a profile of you across other websites, and is used to understand how this site performs. We rely on legitimate interests for it.
03
Advertising and third-party tracking
With your consent, we load the Meta (Facebook) pixel and Google Analytics, and we send conversion events to Meta and Google from our server. Where we send your email address or phone number for advertising measurement, it is irreversibly hashed first — the advertising network never receives it in readable form.
You can decline this when the banner appears, and nothing about the site changes if you do. If your browser sends a Global Privacy Control signal, we treat that as a decline automatically and do not ask.
04
Who processes data for us
We use a small number of providers, each only for the purpose listed: Vercel and Railway (hosting), Neon (database), Cloudflare (DNS, bot protection and file storage), Resend (email delivery), Stripe (payments — card details go directly to Stripe and never reach our systems), Cal.com (appointment booking), OpenAI (assisting with website planning from your questionnaire answers), Sentry (error monitoring, with personal data removed before transmission), and optionally Twilio (notifying us of a new enquiry).
05
Payments
Card payments are processed by Stripe. We never see, handle or store your card number, expiry date or security code. We keep a record of the amount, the currency, the status and Stripe’s reference so we can reconcile your project.
06
How long we keep it
Enquiries that do not become projects are kept for 36 months from your last contact with us, then anonymised. Detailed analytics events are kept for 14 months; aggregate totals are kept indefinitely because they contain no personal data. Project files are kept for the life of the project plus 12 months. Records we are required to keep for tax or accounting purposes are kept for as long as the law requires.
07
Email we send you
After an enquiry we send a confirmation and, if we have not managed to reach you, a small number of follow-up emails. These stop automatically as soon as you reply, book a call, or ask us to stop. Every one carries a one-click unsubscribe link. Transactional messages — receipts, and the private link to your questionnaire — are not marketing and continue while your project is active.
08
Text messages
We do not send marketing or follow-up text messages. If that changes, it will require your express written consent, collected separately with a checkbox that is never pre-ticked, and you will be able to stop them by replying STOP.
09
Your rights
You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to stop using it for a particular purpose, or withdraw a consent you previously gave. Contact us at the contact form and we will respond within 30 days. Depending on where you live you may also have the right to complain to a data protection authority.
10
Children
This is a service for businesses. We do not knowingly collect personal data from anyone under 16. If you believe we have, tell us and we will delete it.
11
Changes
If we change this policy we will update the date at the top. If a change materially affects how we use data you have already given us, we will tell you directly.