Legal
Privacy & Cookies
What we collect, why we collect it, and what gets stored on your device. Written to be read, not to be survived.
Last updated: 13 October 2026
Before you publish this: the sections marked below need your real details — your legal entity name, registered address and your ICO registration position. This notice was drafted to match how the site actually behaves, but it is not legal advice and has not been reviewed by a solicitor. If you handle anything sensitive, have it checked.
Who we are
mycustomAI (“we”, “us”) operates mycustomai.co.uk. We are the data controller for personal data collected through this site.
To complete: your registered company name, company number, registered office address and country of registration. If you trade as a sole trader, your trading name and a contact address. UK company law requires these on your website if you are a registered company.
For anything about your data, contact hello@mycustomai.co.uk.
The short version
- We use no analytics, no tracking and no advertising.
- The site sets no cookies at all.
- The site makes no third-party requests — fonts and everything else are served from our own domain, so no outside company sees your visit.
- The only thing stored on your device is an optional draft of the enquiry form, and only if you tick the box asking for it.
- We only ever contact you about the enquiry you sent. No marketing lists.
What we collect
When you send an enquiry
The contact form collects what you type into it:
| Data | Why | Required? |
|---|---|---|
| Your name | So we know who we are replying to | Yes |
| Email address | So we can reply | Yes |
| Company | Context for the enquiry | No |
| What you need | Routing the enquiry | Yes |
| Your message | Understanding the project | Yes |
Please do not include special category data (health, ethnicity, religion, biometrics, political opinions, sex life or sexual orientation, trade union membership) or anyone else's personal data in your message. We do not need it.
When you simply visit
Our hosting provider records standard server log data — your IP address, the page requested, the time, and your browser's user-agent string. This happens for every website you visit and is needed to serve pages and defend against abuse. We do not use it to build a profile of you and we do not combine it with anything else.
Our lawful bases
- Replying to your enquiry
- Article 6(1)(b) UK GDPR — taking steps at your request before entering a contract. Where no contract follows, Article 6(1)(f) legitimate interests: responding to someone who asked us a question.
- Server logs and site security
- Article 6(1)(f) legitimate interests — keeping the site available, working and not being abused.
- Saving a draft on your device
- Your consent, under the Privacy and Electronic Communications Regulations (PECR). It is off unless you tick the box, and you can withdraw it at any time by unticking it or clearing the draft.
What is stored on your device
This site sets no cookies. There is one optional item of browser storage:
| Name | Type | Purpose | Lasts |
|---|---|---|---|
mycustomai:enquiry:v1 |
Local storage | Keeps a draft of the enquiry you are writing, so a reload or a stray back button does not lose it | 7 days, or until you clear it |
It is stored only if you tick “Save a draft on this device” on the form. It never leaves your browser — it is not sent to us, not shared, and not readable by anyone else. Untick the box, use the “Clear it” link on the form, or clear your browser's site data, and it is gone immediately.
You can change this at any time from cookie settings, which is also linked in the footer of every page. Withdrawing is one click, exactly like giving it.
Because this site sets no cookies and loads nothing from third parties, the consent request covers only that single optional item. We ask once, record your answer for a year, then ask again.
Who else sees your data
We do not sell personal data, and we do not share it for marketing. We use these providers:
| Provider | What for | Where |
|---|---|---|
| Netlify | Website hosting and server logs | United States |
| Microsoft (365) | Our email — so enquiries you send land in our inbox | EU/US |
Both act as our processors: they handle data on our instructions and may not use it for their own purposes. Where data reaches the United States, the transfer relies on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or an equivalent approved safeguard, under each provider's data processing terms.
We may also disclose data where the law requires it, or to establish or defend a legal claim.
How long we keep it
- Enquiries that do not become projects — kept for up to 24 months, then deleted, so we have context if you come back to us.
- Enquiries that become projects — kept for the duration of the work and for 6 years afterwards, to meet UK tax and accounting requirements and to cover the limitation period for contract claims.
- Server logs — retained by our host for their standard period and then deleted automatically.
Check these suit you. The periods above are sensible defaults, not legal requirements of a fixed length. Shorten them if you would rather hold less.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Rectify it if it is wrong or incomplete
- Erase it (the “right to be forgotten”), where it applies
- Restrict how we use it
- Object to processing based on legitimate interests
- Portability — receive your data in a machine-readable form
- Withdraw consent at any time, where we relied on consent
Email hello@mycustomai.co.uk and we will respond within one month. Exercising these rights is free, and we will not treat you differently for it.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office, the UK regulator: ico.org.uk/make-a-complaint, or 0303 123 1113. We would rather you came to us first so we can put it right.
Security
The site is served over HTTPS only — HTTP requests are redirected and HSTS is enabled, so your connection is encrypted. We apply standard protective response headers, keep the site's dependencies current, and limit who can access enquiry emails to those who need to answer them.
Children
This site offers services to businesses and is not directed at children. We do not knowingly collect data from anyone under 13. If you believe we have, tell us and we will delete it.
Changes
If this notice changes materially we will update the date at the top. Material changes affecting how we use data you have already given us will be notified to you directly where we can.