Privacy
What we keep about you, why, for how long, who else sees it and what you can ask us to do about it.
This notice covers tektura.org, our email, the client area and video calls. The sites we build and look after for clients have their own privacy notices (see “Sites we look after for clients”).
The short version
What we collect
You don’t have to give us anything. Without your name and an email address we can’t reply to you, and if you become a client we need your name and address to do the work and invoice you.
Cookies and what’s kept on your device
Apart from the robot check on two forms (see “Checking for robots”), the public pages don’t load anything from other companies: there are no outside analytics, fonts or tracking pixels, and no advertising. This is everything our site and the client area keep in your browser:
| What | Why | How long |
|---|---|---|
| Cloudflare’s robot cookie __cf_bm | Cloudflare, who host the site, use it to tell people from robots | 30 minutes after you last open a page |
| Cloudflare’s check cookie cf_clearance | Records that your browser passed, if Cloudflare checked it | 30 minutes |
| Sign-in cookie __Host-tk_c | Keeps you signed in to the client area | 30 days, or until you sign out |
| Sign-in code cookie __Secure-tk_cp | Holds your sign-in while you type the code we email you | 30 minutes |
| “Trust this device” cookie __Secure-tk_ct | Means you aren’t asked for that code again on this device, if you ticked it | 30 days |
| “Stop counting” tk-count-off | Remembers that you asked not to be counted (see “Your rights”) | Until you press “Start counting” or clear it |
| Visit code tk-count-id | A random number, so the pages you read in this tab count as one visit (see “Counting visits”) | Until you close the tab or press “Stop counting” |
| When the intro last played tk-intro-at, tk-intro | So the home page intro plays once a month at most | Until you clear it or press “Forget settings”, and the tab’s note until you close it |
| Your name in a video call tk-call-name | So you don’t have to type it again next time | Until you clear it or press “Forget settings” |
| Your place in a video call tk-call-… | So reloading the page puts you back in the call | Until you close the tab or leave the call |
| Chat or email view tk-msg-view | Remembers how you like to read messages in the client area | Until you clear it or press “Forget settings” |
| Copies of our pages, styles, fonts and pictures | So the site opens faster next time. They hold nothing about you | Until we update the site, or you clear them or press “Forget settings” |
None of these is sent to anyone else. “Until you clear it” means until you clear your browser’s site data for tektura.org. “Forget settings” is under “Your rights”. Our hosting provider also records ordinary server logs (the address a request came from, the page asked for, the time) for security and to keep the site running; they are not used to identify you.
Counting visits
A small script of our own counts visits, so we know which pages are read and how people find us. For each page it sends us the page, the site you came from, whether you’re on a phone, tablet or computer, the town your connection is in, how long the page was open and the tags of the link you followed, if it has them (short labels some links carry to say where they were shared, and which of our social posts they were in). It sets no cookie. To tell one visit’s pages from another’s, it keeps a random number in the tab until you close it (the visit code in the table above). We mix it with a secret that changes every day before we store it, and delete the day’s secret after a day. Nothing your browser sends by itself, such as its address or its name, goes into that code. So that one connection can’t flood the counter, we also keep a code made from your connection’s address and the site, for that day only: it goes the next morning, with the exact time of each page. After 30 days each page view is added into daily counts and deleted. When someone sends the contact form we count the enquiry and add to a tally of the pages read before it, without a visitor code or the time, so what you read can’t be matched to your name. If the visit began at a link in one of our social posts, we add one to that post’s count of enquiries in the same way, with only the day. The counts are kept for 400 days. You can stop being counted, enquiries included, with one button (see “Your rights”). The same script counts visits, the same way, on the sites we look after for our clients, and each of those has its own “Stop counting” button on its privacy page.
If you email us, we keep the email and any attachments in our own system. We turn away email that is forged, phishing, unsolicited sales email or sent in floods, and email from senders we have marked as junk. The same goes for sales messages sent through the contact form. For those we keep the sender’s address, the subject, the first couple of lines, when it arrived and why it was turned away, for 30 days, so we can check nothing real was lost. For sales email we also keep the whole message for those 30 days, out of sight, in case it came from somebody who wanted to work with us; then it is deleted. To spot floods, we note each sender’s address and the time for a day. Email marked as spam is deleted after 30 days. Email with someone whose enquiry doesn’t become work is deleted after 12 months, along with the enquiry. Email about a client’s work is kept with their records, for as long as we work together and then until 5 years after the tax return for the year the work ended is due. Email with anyone else is deleted 12 months after the last message in the conversation, unless we’ve starred it or put it in a folder because we need it for our own records, such as a supplier’s invoice. The list of senders we’ve blocked or let through (an address, or a whole domain) is kept until one of us removes them.
The website check
When you check a website, we keep the site’s name, the time and a scrambled number made from your internet address that changes every day. That lets us limit how many checks each person runs. All three are deleted after a day. The result isn’t kept.
Checking for robots
On the contact form and the website check, once you start filling it in, a check from Cloudflare called Turnstile runs in your browser to tell people from automated programs. It sends Cloudflare technical details of your connection and browser, such as your internet address and the browser’s name and version, and uses them only to spot robots and to improve how it spots them. It is not used for advertising. You can read Cloudflare’s own terms in the Turnstile Privacy Addendum. Our own part of the check (how long the form was open, and a hidden box that people never see) keeps nothing extra. A message through the contact form that names three or more web addresses is held back for one of us to look at, the way sales messages are (see “Email”): we keep it whole for 30 days, and let it through if it’s a real enquiry.
If someone else gives us your details
Sometimes your details reach us from someone else: a friend names you in the contact form’s “Who?” box, someone copies you into an email, or a client adds you to their client area. We keep them with that person’s records, for the same time and for the same reasons, and you have the same rights as anyone else here.
The contact form
When you send the form, we keep what you typed (your name, email address and message, and anything optional you chose to give us: your organisation, how you heard about us and when would suit you for a call) and the time it was sent, in our own system, so we can reply and, if we work together, remember what you asked for. We also keep the internet address the form was sent from for a day, so that one address cannot flood us with messages. What you send is read only by Daniel Hutchins and Mollie Muzzlewhite, who works on Tektura with him. We also email ourselves a note of it so we see it straight away. If you choose a time for a call, we put it in our calendar with your name and email you the details. We do not add you to a list, and there is no newsletter.
If we don’t end up working together, after 12 months we remove everything that says who you are and what you wrote, and keep only when the enquiry came and roughly what it was for. If you told us we could get back in touch later, we keep your name and email until then, and remove them 12 months after that date at the latest. If we do, what you sent becomes part of your project’s records, which we keep until 5 years after the tax return for the year the work ended is due, because tax law asks us to keep the invoices and it is sensible to keep the context with them.
Our social media pages
We have pages on Facebook, Instagram and LinkedIn. If you follow, like, comment on or message them, Meta (for Facebook and Instagram) and LinkedIn handle your details under their own privacy notices. We see what you choose to show there: your profile name and picture, your comments, your answers to our stories and the messages you send us. We use them to reply to you and to see what people find useful. They stay on Facebook, Instagram or LinkedIn until you or we delete them. If a message leads to work, we keep what we need with that work’s records. If you answer a question or a poll on one of our stories, we only share your answer with your permission, or without anything that shows who you are.
Meta and LinkedIn also give us statistics about our pages, such as how many people saw a post and what kinds of people they were, as totals that don’t name anyone. For these statistics Meta and LinkedIn are joint controllers with us, under their own agreements with page owners, and they deal with requests about them. We don’t post photos or videos of people without their agreement, and for anyone under 18 we ask a parent or carer. To object, or to have something of yours taken down, email [email protected]. You can also change your settings with Meta or LinkedIn, or stop following us.
How long we keep things
Everything here is deleted or made anonymous automatically, backups each week and everything else by a job that runs every morning, apart from the last two. Client records are reviewed and deleted by hand once their time is up, and blocked or allowed senders stay until we remove them.
- Flood counts, the visit counter’s code for a connection, the website check, sign-in attempts and the internet address an enquiry came from1 day
- Email turned away as junk, sales or phishing (the note, and whole sales emails), email marked as spam, a number left for us to ring you on in a video call, our email provider’s delivery reports and each page view counted (after that, only daily counts)30 days
- The browser name kept with a client area sign-in, and with “Trust this device”Up to 30 days
- Enquiries that don’t become work and the email about them (then only the date and roughly what it was for), email with people who are neither clients nor enquirers, unless we keep it for our records, and guests’ names from video calls12 months
- Weekly backups of our whole system, on Cloudflare and our office computer, which copies them to Microsoft OneDrive. Anything deleted stays in them until they go; if we restore one, we delete it againUp to 12 months
- Daily visit counts, a note of each email our system sends (who to, the subject and when) and addresses that bounced400 days
- The log of changes to records, and of sign-ins and what is opened and downloaded in the client area. Deleting a client or a person takes what they were out of it6 years
- Client records, invoices, quotes, email and what was agreed: until 5 years after the tax return for the year the work ended is dueUp to 7 years
- Senders we’ve blocked or let through (an address, or a whole domain)Until we remove them
Our database host also keeps a rolling history of up to 30 days so a mistake can be undone, and OneDrive keeps deleted backups in its recycle bin for up to 30 days more. Any copy we download by hand is deleted once it has been checked.
The bars are drawn to a stretched scale, so a day is still visible next to 6 years.
Why we’re allowed to
Data protection law says we need a reason, called a lawful basis, for each thing we do with your details. These are ours.
| What we do | Our reason |
|---|---|
| Replying to your enquiry or email, and booking calls | Legitimate interests (replying to people who contact us), or steps you asked for before a contract |
| Getting back in touch later, if you turned down a quote because of the timing and told us we could | Consent (you told us when we could). You can change your mind at any time, see “Your rights” |
| Doing the work, invoicing and the client area | Contract, where you are the client yourself; where you act for a band, charity, club or business, legitimate interests (working with the people our client puts us in touch with) |
| Keeping a record of sign-ins, what was opened and what was agreed, and the history of changes | Legitimate interests (showing what happened and what was agreed if there’s ever a question) |
| Video calls | Legitimate interests (talking to you the way you chose), or steps you asked for before a contract |
| Keeping invoices and accounts | Legal obligation (tax law) |
| Counting visits | Legitimate interests (knowing which pages are useful). No cookie is set, and you can opt out with one button, see “Your rights” |
| The website check | Legitimate interests (running a free tool fairly) |
| Keeping out robots, floods and unwanted email (junk, sales and phishing) | Legitimate interests (security, and keeping our inbox usable) |
| Email with people who aren’t clients, such as suppliers | Legitimate interests (running the business) |
| Backups | Legitimate interests (not losing records if something goes wrong) |
| Our social media pages and their statistics | Legitimate interests (telling people about our work and replying to them) |
| Sharing your answers, words or photos in our posts | Consent (you can ask us to take them down at any time) |
Some of this is automatic: the checks that keep robots, junk, sales and phishing email out decide by themselves what is turned away. They only decide whether a message reaches us, which has no legal or similar effect on you. If you think something you sent was turned away, email us from another address or use the contact form, and one of us will look.
Who else sees it
We don’t sell or share your details for anyone’s marketing. These organisations handle some of them for us, and only for the purposes shown. Cloudflare and Resend work for us under written agreements and may not use your details for anything of their own, with one exception: for the robot check, Cloudflare also uses what it collects to improve how it spots robots, under its own terms (see “Checking for robots”). Microsoft keeps our backup copies in OneDrive, under its own service terms, and GitHub, part of Microsoft, keeps the code of the sites we build, which holds no personal details beyond what those sites publish. Starling Bank and HMRC use what reaches them under their own rules, as a bank and as the tax office.
| Who | What for | Where |
|---|---|---|
| Cloudflare | Hosts the site, the system your enquiry and project are kept in, our incoming email, file storage and video calls, and runs the robot check on two forms. | The system your details are kept in, and the stored files, are in Western Europe. The site is served from Cloudflare’s network around the world, and Cloudflare is a US company. Covered by the UK Extension to the EU-US Data Privacy Framework and the UK’s approved contract terms. |
| Resend | Sends the email that goes out from us: replies, notes of new enquiries, sign-in links and invoices. | Our email is sent from Ireland, and Resend is a US company. Covered by the UK Extension to the EU-US Data Privacy Framework and the UK’s approved contract terms. |
| Microsoft | Keeps the weekly backup copy of our system in OneDrive (see “How long we keep things”). | United Kingdom and elsewhere. Covered by the UK Extension to the EU-US Data Privacy Framework. |
| GitHub (part of Microsoft) | Keeps the code of the sites we build and the words and pictures they publish. No enquiry, client or visitor records are kept there. | United States. Covered by the UK Extension to the EU-US Data Privacy Framework. |
| Starling Bank | Our bank. It handles payments you make to us, and we bring those payments into our records to match them to invoices. | United Kingdom. |
| HM Revenue & Customs | Our accounts, where tax law requires it. | United Kingdom. |
If you are a client
If you use your client area, we keep a record of when you signed in, and the internet address and browser you signed in from while you are signed in, so we can see that nobody else has. We also log what you open and download there, for 6 years. When you accept a document there, we keep when, and from which address, as the record of what was agreed.
Video calls
If we speak on a video call through our site, the sound and picture go straight between our devices where your network allows it. Where it doesn’t, Cloudflare passes them on. We don’t record calls. We keep a note of when the call happened and who joined, and remove a guest’s name a year after the call. If you ask us to ring you instead, we keep the number for 30 days. Notes we take during a call are kept with the project’s records.
Sites we look after for clients
When we build or look after a website for a client, that client decides what their site collects and why, and their own privacy notice applies. We handle those details only on their instructions, under a written agreement that data protection law requires. If you have a question about a client’s site, ask them first; if you ask us, we will pass it on. The companies that handle those details for us (our sub-processors) are Cloudflare (hosting, storage and email), Resend (sending email), GitHub, part of Microsoft (the code and published content of the site), and Microsoft (our backup copies, in OneDrive). We give clients 30 days’ notice before adding another.
Keeping it safe
Everything travels encrypted. The staff and client areas need a sign-in, anyone signing in on a new device needs a second step and every change to a record is logged; the log is kept for 6 years. Only the people who work at Tektura can see enquiries and client records.
Your rights
You can ask us what we hold about you and for a copy, or for it in a form you can take elsewhere. You can ask us to correct it, delete it, stop using it or limit how we use it. When we delete your details, we keep only the invoices and accounts that tax law asks us to keep, for as long as it asks (see “How long we keep things”), and we tell you which. Where we rely on legitimate interests, you can object, and we will stop unless we have a strong reason to carry on. Email [email protected]. We will do it within a month, and usually the same day. There is no charge.
To stop your visits being counted, press “Stop counting”. This browser remembers the choice for tektura.org until you clear its site data. On a client’s site, use the “Stop counting” button on that site’s own privacy page. We also count nothing from a browser that asks sites not to track it (Global Privacy Control or Do Not Track) or has JavaScript turned off.
To have this browser forget the things our site keeps in it to work (when the intro last played, your name for video calls, how you read messages in the client area and the saved copies of our pages), press “Forget settings”. They are saved again the next time you use those parts of the site.
If you turned down a quote because of the timing, we only get back in touch later if you told us we could, around the time you gave. If you change your mind, reply to any email from us or email [email protected], and we won’t.
Complaints
- Tell us. Email [email protected] with “Data complaint” in the subject, or use the contact form.
- We acknowledge it within 30 days, usually within a working day, look into it straight away and keep you updated.
- We tell you the outcome and what we have done.
- If you are still unhappy, you can complain to the Information Commission (still known as the ICO).
Who we are
Tektura is a trading name of Daniel Hutchins. He is the controller for the details described here. Contact: [email protected], or by post at 58 Garfield, Langford, Biggleswade, Bedfordshire SG18 9NG.
Children
This site is for adults arranging work for themselves or an organisation. We don’t knowingly collect details from children.
Changes to this notice
When we change how we use your details, we update this page and the date below. If a change affects you as a client, we tell you by email first.
Version 2, last updated 26 October 2026.