Privacy policy.

SiteSmith Labs is run by Harry Irwin in the UK. This policy explains what personal information I collect when you use this website or the client portal, why, and what rights you have. If anything here is unclear, email [email protected].

Who's responsible for your data

SiteSmith Labs (Harry Irwin) is the data controller for the personal information described here. Contact: [email protected].

What I collect

• Account details: your name, email address, and optionally your business name, phone number, address and VAT number.
• Your password: stored only as a one-way encrypted hash. Nobody, including me, can read it.
• Project information: quote requests, briefs, deadlines, prices, progress updates, invoices, messages between us, files you upload, reviews you choose to leave, and the websites I look after for you.
• Documents and signatures: files shared with you (contracts, quotes, invoices), and when you sign one, your signature, typed name, the date and time, your IP address and browser details, kept as a record of the agreement.
• Security records: the time, IP address and browser of login attempts, used to protect accounts from password guessing and to show you your own recent sign-ins.
• Emails you send me.

The public pages of this site don't use analytics, advertising or tracking of any kind.

Why I use it, and the legal basis

• To quote for and deliver your website, run your portal account and send you updates you've asked for. This is necessary for our contract, or for steps you ask me to take before one.
• To keep accounts and the portal secure. This is in my legitimate interests, and yours.
• To keep business and tax records such as invoices and signed agreements, as the law requires.

I never sell your information or use it for marketing without asking you first.

Cookies

The client and staff portals use a single essential cookie (ssl_session) to keep you logged in. It's deleted when you close your browser or log out. The portals also remember a couple of display choices, such as light or dark mode, in your browser's own storage; these never leave your device. No other cookies are set, so there's no cookie banner.

Who else handles it

• Cybrancee hosts this website, the database and your documents on servers in the UK or EU.
• Nobody else serves the site's fonts or code: they're hosted alongside the site, so your browser doesn't connect to any third party while you browse.
• My email provider, for messages between us.

How long I keep it

Your account and project information are kept while you're a client and for up to 2 years after our last project, unless you ask me to delete them sooner. Invoices and signed agreements are kept for 6 years to meet UK tax and legal requirements. Failed login records are deleted within 24 hours, and successful sign-ins after 30 days.

Your rights

You can ask to see the information I hold about you, correct it, delete it, restrict or object to how it's used, or get a copy to take elsewhere. You can update most of your details yourself under Account in the portal, and download a copy of everything I hold about you from there in one click. For anything else, email [email protected] and I'll reply within a month.

If you're unhappy with how I've handled your information, you can complain to the Information Commissioner's Office at ico.org.uk.

Keeping it safe

The site runs over HTTPS, passwords are hashed, documents can only be opened by you and me, and repeated failed logins are blocked. No system is perfectly secure, but I'll tell you promptly if something ever goes wrong that affects your data.

Changes

If this policy changes, the new version will be posted here with a new date. Significant changes will be emailed to clients.