Privacy & eligibility
Clear information about your request, your preview and your data. Updated 7 October 2026.
Who is responsible
Jacob Bradley operates this service as a sole trader trading as Jacob Bradley Web Development, based in Darlington, England, United Kingdom. ICO registration: ZC091100. For privacy questions or requests, email hello@jacobbradley.co.uk. This notice covers the free redesign service; the main business website has its own privacy policy.
What I collect
When you request a concept, I collect your first name, email address, website address and business domain. I store request status, correspondence and email delivery records. If you sign in, I store your verified email, account-to-project association and security session records. If you express interest in a concept, that response is recorded. Public website text, logos, photographs and navigation may be collected to prepare the design; this can include publicly displayed staff names or portraits. Do not provide passwords, private customer records, sensitive personal information or payment details.
Technical information and cookies
Security checks process IP addresses and browser/device information. Rate limiting stores hashed request identifiers. Hosting and security providers may also process access logs. There are no advertising cookies or analytics integrations in this service, and it does not use browser localStorage or sessionStorage for customer data. Essential sign-in cookies and Cloudflare Turnstile checks protect the service. Only necessary security/sign-in technologies are used; no optional tracking is enabled.
Cookie durations
Customer sign-in uses __Host-jb-customer-login for up to 15 minutes and __Host-jb-customer for up to 8 hours. Administrator sign-in uses __Host-jb-auth for up to 10 minutes and __Host-jb-session for up to 8 hours. These cookies are Secure, HttpOnly and SameSite=Lax. Signing out clears the relevant session cookie. Blocking essential cookies prevents sign-in. Turnstile is loaded on protected form screens and processes device/browser signals to distinguish genuine requests from abuse.
Why information is used
I use your details to review eligibility, prepare and deliver your concept, provide account access, respond to interest and manage correspondence about your request. The lawful basis is taking steps at your request before a potential service agreement where applicable, and legitimate interests in responding to business enquiries, preparing requested concepts and securing the service. Legal obligations apply where records must be retained by law. Your request is not a subscription to a marketing mailing list.
Storage and service providers
Request and account records are stored in Neon PostgreSQL. Source assets, design revisions and published preview files are stored in private Cloudflare R2 buckets. Vercel hosts the application; Resend delivers service emails; Cloudflare Turnstile provides abuse protection; Google authenticates administrators. OpenAI processes website content and selected images to assist with design generation and editing. These providers receive the information necessary for their role. Data is not sold. Providers may process data outside the UK; applicable contractual safeguards are required where international transfers take place.
AI-assisted preparation
Website material is sent to the OpenAI API to prepare a design concept, followed by human review before publication. Do not submit a website containing information you lack permission to share or reuse. Generation can make mistakes; concepts are illustrative and should be checked for factual accuracy, accessibility and rights before any future launch.
Preview access
Preview links are unlisted, not public directory entries. Anyone holding a valid shared link can view the concept until it expires or is revoked. Customer accounts are restricted to their associated projects. Do not forward a preview link to people you do not intend to give access. A preview does not modify your existing website.
How long information is kept
The retention period for free-service request details, correspondence held in this application, collected source assets and design files is 270 days after the last substantive request or project activity. Deletion is managed by Jacob; preview-link expiry alone does not delete stored files. Published links expire after 270 days from publication unless revoked sooner. Sign-in links expire after 15 minutes and sessions after 8 hours; expired login records are removed by scheduled maintenance after a further day, and expired sessions are removed by maintenance. Security rate-limit records expire after 2 hours. Provider logs, backups and records follow their separate retention schedules and may outlast removal from the live application. Records necessary for a legal claim or legal obligation may be held longer. If a request becomes a paid project, its agreed contract and retention terms apply.
Your rights and complaints
You may request access, correction, deletion, restriction or portability where applicable, and object to processing based on legitimate interests. Email hello@jacobbradley.co.uk; I may need to verify your identity. I normally respond within one month, subject to lawful extensions. You can also complain to the Information Commissioner’s Office at ico.org.uk.
Eligibility
You must represent the business and have authority to permit use of relevant website content, branding and images. Requests are reviewed individually. Illegal, fraudulent, abusive or otherwise prohibited websites are not eligible; see the terms of service for acceptable use.
Email Jacob · Privacy & eligibility · Terms of service
Main business privacy policy · Main business terms · Complain to the ICO