Legal

Privacy policy

This explains what I do with the details you send me when you ask about a website, and what you can ask me to do about it.

Last updated 28 October 2026

Who I am

Stapled. is run by Matthew Stapley, a sole trader trading as Stapled. I'm the person responsible for your information (the "controller" under UK data protection law).

For anything to do with your information, email me at stapledweb@gmail.com, or write to the business address on the business details page.

What I collect

I only collect what you choose to send me.

Emails you send me

You can ask about a website or any of my services by email. I'll have whatever you include, usually your name, email address, business name, what the business does and where, a link to your current website or social media page, and what you'd like help with. A phone number is only needed if you'd like me to call you.

Adverts on Facebook and Instagram

My adverts on Facebook and Instagram link to this website. Clicking one doesn't send me any details about you: you only reach me if you then get in touch by email. Meta, which runs Facebook and Instagram, uses information about your activity on its platforms, including how you interact with adverts, under its own privacy policy. This website doesn't use Meta's tracking pixel, so Meta doesn't receive information about what you do here.

If you become a client

I'll also have your quote and acceptance, our correspondence, the content you give me for your website, and records of your payments.

How I use it, and why I'm allowed to

UK data protection law requires a "lawful basis" for each use of your information. Here's what I do and the basis I rely on.

Replying to your enquiry and discussing your project
Legitimate interests You've asked me to get in touch, and I have a legitimate interest in replying and talking to you about the work. If you're asking as an individual about buying a website, this is also a step you've asked me to take before we enter into a contract.
Preparing a homepage preview, if I've offered one
Legitimate interests For some enquiries I offer a quick homepage preview. If you'd like one, I use your business details, and any website or social link you give me, to put it together.
Building and looking after your website, if you become a client
Contract I use your details to do the work we've agreed and to take payment for it.
Keeping business and tax records
Legal obligation I keep records of payments and invoices because the law requires it.

You don't have to give me any of this information, and there's no legal requirement to. Without a way to contact you, though, I can't reply. I don't make any decisions about you by automated means.

Marketing

I only use enquiry details to reply to you, discuss your project and, if I've offered one and you'd like it, prepare a homepage preview. You don't need to agree to marketing to make an enquiry. I won't add you to a newsletter or promotional campaign, and I won't upload your details to Meta or anyone else to target you with adverts.

If that ever changes, I'll ask for your agreement separately first, and you'll be able to change your mind at any time, free of charge.

Who handles your information

I don't sell your information or share it with anyone for their own marketing. These services handle it on the way through:

  • Google provides the Gmail account where your emails arrive and where I keep our conversations.
  • GitHub hosts this website (GitHub Pages). Like any web host, it processes technical information such as your IP address so it can deliver the pages to you. The client websites I currently host are also on GitHub Pages, so if you're a client I host, your website's files and the content you've given me for it are stored with GitHub too.
  • Backblaze stores the weekly backups of the client websites I host, in its data centre in Amsterdam. So if you're a client I host, copies of your website's code and files are stored with Backblaze too.
  • Dropbox briefly held a few earlier backup copies of those websites in October 2026, before I moved backups to Backblaze. I deleted them on 23 October 2026. Dropbox keeps deleted files recoverable for 30 days before removing them permanently, so they'll be gone from Dropbox by 22 November 2026. No new backups go to Dropbox.
  • My bank processes any payments you make to me by bank transfer.

I don't currently use a payment provider, customer database or spreadsheet service for your details. If I start using one, or host a client's website somewhere other than GitHub, I'll update this policy first.

I may also share information if the law requires me to, for example with HMRC or in response to a valid legal request.

Information sent outside the UK

Backblaze stores backups in the European Economic Area, which UK law recognises as providing adequate protection. Google, GitHub and Dropbox are based in, or store information in, the United States and other countries outside the UK. They each describe in their own privacy information the safeguards they rely on for this, such as UK adequacy regulations (including the UK–US "data bridge") or approved contract terms. Email me if you'd like more detail.

How long I keep it

  • Enquiries that don't lead to work: up to 12 months after we were last in meaningful contact. Then I delete them from my email, unless there's a recorded reason to keep one longer, such as an unresolved complaint or you asking me to.
  • Client records (your quote and acceptance, our correspondence and project files): 6 years after our work together ends, which is the usual time limit for claims about a contract.
  • Your website's files (if you were a client): once hosting has ended and the handover is complete, I keep a recovery copy for 30 days, then delete it. Backup copies are removed automatically after about 8 weeks (weekly copies) or about 6 months (monthly copies), and permanently deleted within a further 30 days.
  • Accounting records (payments and invoices): as long as HMRC requires. For a sole trader, that's at least 5 years after the 31 January Self Assessment deadline for the tax year they relate to.

Cookies and tracking

This website doesn't set cookies, doesn't store anything in your browser, and doesn't use analytics, advertising pixels or other tracking tools. Everything on its pages, fonts included, is served from this site's own hosting. That's why there's no cookie banner: there's nothing to agree to.

Email links open your own email app. This site also links to other websites, such as Instagram. Once you follow a link, that site's own privacy policy applies.

Your rights

You have the right to:

  • ask for a copy of the information I hold about you
  • ask me to correct anything that's wrong or incomplete
  • ask me to delete your information
  • ask me to limit how I use it
  • ask me to send information you gave me to you or another organisation, where that applies

Your right to object

Because I rely on legitimate interests, you can object to me using your information at any time. You can always object to marketing, and I'll stop.

To use any of these rights, email stapledweb@gmail.com. It's free, and I'll reply within one month. I may need to confirm who you are first.

Complaints

If you're unhappy with how I've handled your information, please email me at stapledweb@gmail.com first. I'll acknowledge your complaint within 30 days, look into it, and let you know the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. The ICO will usually ask you to raise it with me first.

Changes to this policy

If I change how I handle your information, I'll update this page and the date at the top.