Privacy notice.

In short

• We collect what you send us through the Start a project form, your client onboarding link and email. We use it to reply, prepare a quote and deliver your project.
• This website has no analytics, advertising or tracking cookies.
• If your request doesn't become a project, we delete it 12 months after the last activity on it.
• We don't sell your information.
• You can ask to see, correct or delete your information at any time by emailing saul@lodestoneenterprise.co.uk.

Who we are

Lodestone Enterprise Ltd is the controller of your personal information. That means we decide how it's used, and we're responsible for it under UK data protection law: the UK GDPR and the Data Protection Act 2018.

Company

Lodestone Enterprise Ltd

Registered

England and Wales, company no. 17265873

Registered office

33 Falcon Drive, Didcot, OX11 6HT, United Kingdom

Email

saul@lodestoneenterprise.co.uk

ICO registration

ZC170884

We deal with privacy questions by email.

When you ask about a project

When you fill in the Start a project form, we collect:

• your name and email address
• your phone number and role, if you give them
• your business name, what it does, and any website or social links you add
• what you need, your goals and your timing
• what you already have, such as a logo or a domain, and any file links you share
• anything else you write

We also record when you sent it, how long the form took to fill in (a spam check) and a scrambled version of your IP address, explained under Keeping our forms safe.

We use this to reply to you, arrange a call and put together a quote. The tick box on the form confirms you've read this notice. It isn't the legal basis we rely on. The legal basis we rely on is the one set out under Our lawful bases.

Your name, email address, business name, the services you're interested in and a description of what you need are required, because we can't reply properly without them. Everything else is optional.

Please don't send health details or other sensitive information about yourself or anyone else. The form doesn't need it.

Keeping our forms safe

We use Cloudflare Turnstile to check that a person is sending the Start a project form. Turnstile runs a check in your browser and sends Cloudflare technical signals, such as your IP address, browser details and the website you're on. Turnstile doesn't read what you type into the form. Cloudflare uses these signals to detect and block bots for us. It also uses them to improve Turnstile's bot detection, which it does for its own purposes under its Turnstile privacy policy. Turnstile may store something in your browser that's strictly necessary for the check to work.

We also keep a scrambled version of your IP address. It's a one-way hash, so we can't turn it back into your address. We store it with your request, and in counters that limit how many requests one connection can send. We delete the counters within two days. Onboarding links use the same kind of counter to block repeated guesses.

Saving your progress

The Start a project form saves your answers in your own browser, using its local storage, so a refresh or a closed tab doesn't lose them. They stay on your device, and we can't see them until you press Send request. The form clears them when you send it, and you can clear them yourself at any time with Start again.

Client onboarding pages use local storage only to remember which step you reached. Your onboarding answers save to our database as you go.

Notifications

When a project request arrives, I get a short Telegram message with your first name, your business name and the services you picked. When a client sends their onboarding form, the message gives the business name and the number of files. When research on a business finishes, it gives the business name.

These messages never include email addresses, phone numbers or anything you wrote in the form. The full details stay in our database.

Researching your business

Before a call, we may use Claude, an AI tool made by Anthropic, to gather publicly available information about your business and your professional role. It looks at sources such as your website, your business's social media pages, public listings and the Companies House register.

To do that, we give Claude your business name, what you told us the business does, the links you shared, the services you picked, what you wrote about your needs, goals and timing, and your name and role. If you wrote from a business email address, we also give it the part after the @, which usually points to your website.

We never send it your email address or phone number, and we don't research your personal life, home or family. The result is a short brief that lists its sources. I read it before relying on it, and we don't use it to make automatic decisions about you.

You can object to this at any time by emailing saul@lodestoneenterprise.co.uk, and we'll stop.

If you become a client

If we work together, we send you a private onboarding link. There you can answer questions about your project and upload files such as photos, videos, logos and documents.

• The link is unique to your project and expires. Anyone who has it can open it, so please keep it private. We can switch it off at any time.
• Your answers go into our database and your files into private file storage, both run by Cloudflare. Files have no public web address. I download them through our admin area, which only I can sign in to.
• We use what you send to deliver your project, under our contract with you.
• If you give us details about other people, such as staff names or contact details, please let them know you're sharing them with us.
• Please don't send passwords or card details. When we need access to an account, we'll ask you to invite us, so you stay in control.

We send invoices by email, and we keep quotes, invoices and payment records for our accounts.

Email and this website

If you email us, we use what you send to reply and, if you ask, to prepare a quote. Our email runs on Google Workspace.

When you visit this website, Cloudflare, which hosts it, processes technical details such as your IP address and browser type to deliver the pages and protect the site from attacks. Our fonts are stored on this website, so loading a page sends nothing to Google or any other font service.

We don't use analytics tools, so we don't track how you move around the site.

Cookies and local storage

This website doesn't use analytics, advertising or tracking cookies. It stores three things on your device, and each one is strictly necessary for something you've asked for:

• Turnstile may store a small security item, such as a cookie, on the Start a project page when it runs its bot check.
• Local storage keeps your Start a project answers until you send the form.
• Local storage on your onboarding page remembers which step you reached.

Because each one is strictly necessary, we don't ask for consent and don't show a cookie banner. You can clear cookies and local storage in your browser settings at any time.

Our lawful bases

UK data protection law lets us use your information only where we have a lawful basis. These are ours:

Where we rely on legitimate interests, we've weighed them against your rights, and you can object at any time.

Who else handles it

We use these providers to run the business, so your information passes through them:

Cloudflare and Google Workspace handle information on our behalf and follow our instructions. Some providers also decide for themselves how they use what they receive, under their own terms and privacy policies: Cloudflare when it improves Turnstile, Telegram for the notifications, and Anthropic for what we send Claude.

We may also share information with professional advisers, such as an accountant or solicitor, and with HMRC or other authorities when the law requires it. We don't sell your information or share it for anyone else's marketing.

Outside the UK

Our database is set up to keep its data in the European Union. Cloudflare, Google, Telegram and Anthropic may still handle some information in other countries, including the United States. Where a provider handles information on our behalf outside the UK, we rely on UK adequacy regulations or on safeguards UK law accepts, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Providers that use information for their own purposes explain in their own privacy policies how they protect it when it leaves the UK.

How long we keep it

You can ask us to delete information sooner. If we can't, for example because the law makes us keep an invoice, we'll tell you why.

Your rights

You have the right to:

• ask for a copy of the information we hold about you
• ask us to correct it if it's wrong
• ask us to delete it
• ask us to limit how we use it
• object to how we use it, including the research described above
• get the information you gave us in a format you can reuse

Email saul@lodestoneenterprise.co.uk to use any of these rights. We acknowledge complaints within 30 days and reply to requests within one month, which is the time the law allows, and we may ask you to confirm who you are first.

Complaints

If you're unhappy with how we've handled your information, please tell us first so we can put it right.

You can also complain to the Information Commissioner's Office (ICO), the UK regulator: online at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.

Changes to this notice

We update this notice when the way we handle information changes, and we change the date at the top when we do.