Privacy policy

• If you send us the contact form, we use what you write to reply to you.
• If you came from one of our ads, your enquiry also tells us which ad and search brought you, so we know which ads work.
• With your consent (in Europe, including the UK, EEA and Switzerland, and in Canada) or unless you opt out (elsewhere), Google Ads measures whether an ad led to an enquiry. We later tell Google which enquiries became serious conversations or clients.
• Our website analytics counts visits without cookies. It stores an identifier in your browser and records sessions only if you accept statistics cookies. Our second visit-statistics tool, Ahrefs, runs only with that consent too.
• We don't sell your data, and we don't use it for remarketing or to build advertising audiences.

Your name, work email, company name, the stage your product is at, the outcome you're after (each with an optional "Other" answer), an optional budget range, and anything you write in your message.

The form also contains a hidden field that people never see and only spam bots fill in; we use it to filter out spam.

The form also carries information from the ad link:

• the campaign tags in the link (utm_source, utm_medium, utm_campaign, utm_term, utm_content), which show the campaign, the ad group and the search keyword;
• the click identifier the ad platform added (Google: gclid, gbraid or wbraid; Microsoft: msclkid), only if you accepted advertising cookies, or, where we don't show a cookie banner, unless you switched them off;
• the page you sent the form from;
• a reference number for your enquiry;
• whether you accepted advertising cookies when you sent it.

To get from the ad link to the form, these details are carried in the addresses of the pages you open on the Website; our code doesn't store them on your device. They reach us together with your enquiry.

• Website analytics (PostHog):
  • what it collects: the pages you view, clicks and scrolling, the page or campaign that brought you, your browser and device type, and an approximate location (country and city) derived from your IP address;
  • without your consent to statistics cookies: no cookies, nothing stored on your device, no session recordings. PostHog's servers tell one day's visits apart with a code that resets every day, so visits on different days can't be linked;
  • with your consent to statistics cookies: PostHog keeps a random identifier in your browser (see the Cookie policy), so your visits can be linked over time, and records sessions of how pages are used (mouse movement, clicks, scrolling). Anything typed into form fields is masked in your browser and never recorded;
  • ad click identifiers (gclid, gbraid, wbraid, msclkid) are removed from analytics data in your browser unless you accepted advertising cookies.
• Visit statistics (Ahrefs Web Analytics), only with your consent to statistics cookies (where we don't show a cookie banner, unless you switch them off): the address of each page you view (including any campaign tags and click identifiers in it), the referring site, the page title, your browser language and screen size, and the addresses of links you click. Without that consent, nothing is sent to Ahrefs. Ahrefs uses no cookies and stores nothing on your device.
• Error monitoring (Sentry): when something on the Website breaks, a technical report of the error, including your browser, the page, and your IP address.
• Google Ads measurement:
  • When it runs:
    • in Europe (including the UK, EEA and Switzerland) and in Canada, only if you accept advertising cookies;
    • elsewhere, unless you switch it off in "Cookie settings".
  • What it records: that you arrived from one of our ads, and whether you then sent an enquiry. Google sets cookies for this (see the Cookie policy).
  • When you send the form: after the form is sent successfully, the Google tag also sends Google a scrambled (hashed) version of your email address, so that Google can match the enquiry to the ad click, and the reference number of your enquiry. This is called "enhanced conversions".

While you fill in the contact form, a draft is kept in your browser's session storage, so a reload doesn't lose what you typed. It's deleted when you send the form, and your browser removes it when you close the tab. We also store the time you last sent the form in your browser's local storage, so the same browser can't send it again within 5 minutes. This is spam protection. Neither is sent to us.

If we talk further, we record how the enquiry developed: for example, whether it became a qualified conversation or a client engagement.

We don't knowingly collect sensitive data (such as health, financial or biometric information) through the Website. Please don't include it in your message.

We don't use your data for remarketing, for ad personalization, or to build advertising audiences. We don't make decisions about you by automated means alone.

• What Google receives:
  • the cookies and click identifier described above;
  • after you send the form, and only if advertising cookies are on, a hashed version of your email address and the reference number of your enquiry. "Hashed" means it's turned into a one-way code (SHA-256) in your browser before it's sent.
• Our weekly upload: we send Google the hashed email and click identifier of enquiries that became qualified conversations or clients, so Google can learn which searches bring real clients. We do this only within 90 days of the ad click, and only for enquiries sent while advertising cookies were on (you accepted them or, where we don't show a cookie banner, didn't switch them off).
• Google's role:
  • For enhanced conversions and our uploads, Google acts as our processor under the Google Ads Data Processing Terms.
  • For its ad cookies and the running of its ad services, Google is an independent controller. See Google's privacy policy and how Google uses information from sites that use its services.
• Your choices:
  • Use "Cookie settings" at the bottom of every page to change your choice at any time.
  • You can also manage Google ads through My Ad Center.

These providers process the data to provide their service to us, under their terms and, where they offer one, a data processing agreement. Google's own uses as a controller are explained in Google Ads in more detail. We may also disclose data where the law requires it, to protect our rights or property, or to investigate misuse of the Website.

We do not sell your personal data.

PostHog, Sentry and our hosting (DigitalOcean) process data in the EU (Germany), which the UK and Switzerland recognise as providing adequate protection. Some providers process data outside the UK, the EEA and Switzerland:

• EmailJS, in the US: under the EU Standard Contractual Clauses, with the UK Addendum and the Swiss addendum;
• Google, including in the US: under Google's data processing terms and the transfer safeguards they set out;
• Cloudflare and the code-library networks (unpkg, cdnjs, jsDelivr): a request may be handled in the network location nearest to you, which can be outside the UK and the EEA.

You can ask us for details.

UK and EEA: you can ask us to:

• give you a copy of your data;
• correct it;
• delete it;
• restrict how we use it;
• send it to you in a portable format;
• stop using it where we rely on legitimate interests.

You can withdraw consent at any time, through "Cookie settings" or by writing to us; this doesn't affect what we did before. You can complain to the Information Commissioner's Office (ico.org.uk) or, in the EEA, to your local data protection authority. We'd appreciate the chance to resolve a concern first.

Switzerland: you have the same rights under the Swiss Federal Act on Data Protection, and you can complain to the Federal Data Protection and Information Commissioner (FDPIC).

Canada (including Quebec): you can ask to access or correct your personal information, and withdraw consent. In Canada, statistics and advertising cookies stay off unless you turn them on. You can complain to the Office of the Privacy Commissioner of Canada or, in Quebec, to the Commission d'accès à l'information.

United States: you can ask what personal information we hold about you and ask us to delete it. We don't sell personal information, and we don't use it for targeted advertising. We won't treat you differently for using these rights.

To use any of these rights, write to [email protected]. We reply within one month.

We protect personal data with appropriate technical and organizational measures. No transmission over the internet is completely secure, so we can't guarantee absolute security.

The Website is for businesses and professionals. It isn't directed at anyone under 18, and we don't knowingly collect their data.

We update this policy when our practices change. The "Updated" date at the top shows the latest version.

Hue & Machine LTD, 5th Floor, 167-169 Great Portland Street, London W1W 5PF, United Kingdom
Email: [email protected]