Privacy notice

Section 1Who is responsible for your information

Deftly decides how and why your personal information is used. In data protection language, we are the controller.

We do not have a separate data protection officer. Privacy questions go to hello@deftly.uk and are handled by us directly.

Section 2If we called you out of the blue, this is where we got your details

Most people first hear from us because we phoned them. You have not given us your details, so it is only fair that we tell you where they came from.

We build a list of UK trade businesses from information that is already published:

• Public business listings, mainly Google's business listings, which include a business name, address, phone number, website address and public rating.
• Business websites and public directory pages, where a business has published its own contact details.

We do not buy marketing lists from data brokers, and we do not take your details from anyone you have dealt with.

Why we are allowed to do this

Our lawful basis is legitimate interests. Our interest is finding trade businesses that do not have a decent website and offering to build one. We think that is a reasonable thing to do with information a business has itself put in the public domain, and it has a low impact on you: one phone call, which you can end in ten seconds.

If you disagree, you can tell us to stop and we will. See telling us to stop below.

Phone calls and the Do Not Call registers

The Telephone Preference Service and the Corporate Telephone Preference Service are the UK's official do-not-call registers. An outside screening service checks numbers against both for us.

We screen in batches, ahead of calling, rather than at the moment we dial. Most of the numbers on our list have not been screened yet, and we do not call those until they have been: a number has to come back clear before anyone rings it. A screening result counts as current for 28 days, after which the number is checked again.

If a number is on either register we do not call it. If we ring you and you are registered, that is a mistake rather than our policy. Tell us and we will record it against your number so that nobody at Deftly rings it again.

We only contact you by phone at this stage. We do not send cold marketing emails, texts or WhatsApp messages to businesses we have not spoken to.

We do not currently record sales calls. If that ever changes we will update this notice and tell you at the start of the call.

Section 3What we collect, why, and what allows us to

If you are a lead we have not signed up yet

What: business name, trade, address or area, phone number, website address if you have one, a public rating, and notes from any call, including whether you asked us not to call again.

Why: to decide who to contact, to call you, and to keep track of who has said no.

Lawful basis: legitimate interests, as explained above. For keeping a do-not-contact record, legal obligation, because the rules on marketing calls require us to honour it.

If we build you a preview or you become a customer

What: your name, business name, email address, phone number, business address, the services you offer, your prices and opening hours if you give them, any qualifications or accreditations you tell us about, photographs you give us, customer reviews and testimonials you give us, and anything else you ask us to put on the site.

Why: to build and run your website. Some of this ends up published on your own site, which is the point of it.

Lawful basis: performing our contract with you. For the preview stage, before there is a contract, legitimate interests in showing you what we can do.

Payments

What: your name, email address, billing address, the last four digits of your card, and your payment history. We never see or hold your full card number. That goes straight to Stripe.

Why: to take your subscription payment and to keep proper accounts.

Lawful basis: performing our contract, and legal obligation for the tax and accounting records.

Your domain name

What: your name, address, email address and phone number, given to the domain registrar and to the domain registry.

Why: because a domain has to be registered to a named owner with real contact details. That is how we can put it in your name rather than ours. See the domain terms.

Lawful basis: performing our contract with you, and legal obligation, since the registry requires accurate owner details.

Emails we send you

What: your email address, and the emails themselves.

Why: to send you your preview link, tell you your site is ready, send login codes, tell you about a payment or a problem, and tell you about changes to the service. These are service emails, not marketing.

Lawful basis: performing our contract. If we ever want to email you about something new we are selling, we will rely on your consent or on the rules that let a business email an existing customer about similar things, and every such email will have an unsubscribe link.

Visiting deftly.uk

What: the standard information a web server records, such as your IP address, the pages you asked for and the time. Our hosting provider handles this.

Why: to serve the site and to keep it secure.

Lawful basis: legitimate interests in running a working, secure website.

Section 4Artificial intelligence, and what gets sent where

Some Deftly websites are written with the help of an AI service. We would rather say so plainly than bury it.

When we build a site that way, the business details you give us are sent to Anthropic, the company behind the Claude AI assistant, so that it can write the words for your website. That includes things like your business name, your trade, the area you cover, the services you offer, your phone number, and any reviews or testimonials you have given us to use.

Two honest points about this:

• Not every site is built this way. Some are assembled from our own fixed templates using the details you gave us, with no AI service involved at all.
• What gets sent is your business information, the kind of thing that is going to be published on your website anyway. We do not send payment details, and we do not send anything about your customers.

Anthropic acts as our supplier here and processes that information on our instructions. If you would rather your details were not sent to an AI service at all, tell us before we build your site and we will build it from templates instead.

Section 5Who else sees your information

We do not sell your information and we do not share it for anyone else's marketing. We do use suppliers to run the service. Each one only gets what it needs, and only to do a job for us. This is the full list.

• Stripe: takes your card payments and handles refunds.
• Vercel: hosts deftly.uk, our own systems, and your website. Also stores the photographs on your site.
• Supabase: the database holding our customer and contact records.
• Neon: the database holding the content of the websites we build.
• Resend: sends our automated emails, such as your preview link and your login codes.
• Google: provides our own email mailboxes, through Google Workspace, so any email between us and you sits there. Google's business listings are also one of the public sources we use to find trade businesses, as described above. Our website loads its typefaces from Google Fonts, which means Google receives the IP address of anyone visiting deftly.uk.
• Name.com: the domain registrar we use to register your domain in your name.
• Nominet: the UK registry that runs .uk domain names. Owner details for a .uk domain are held by Nominet, and some of them appear on the public WHOIS record for the domain.
• Anthropic: writes website copy from your business details, where a site is built that way. See section 4.
• TPSCheck: checks phone numbers against the Telephone Preference Service and Corporate Telephone Preference Service registers, in batches, ahead of calling.

We may also share information where the law requires it, for example with HMRC, a regulator, or a court, and with our accountant or professional advisers where they need it.

Section 6Information going outside the UK

Several of the suppliers above are based in the United States, including Stripe, Vercel, Supabase, Neon, Resend, Google, Name.com and Anthropic. That means some of your information is stored or handled outside the UK.

UK law allows this as long as the information is properly protected. We rely on the standard safeguards these suppliers publish for UK and European customers: the UK Addendum to the standard contractual clauses, or the UK extension to the EU to US Data Privacy Framework where the supplier is certified under it.

If you want to see the safeguards for a particular supplier, email us and we will point you at them.

Section 7How long we keep things

Your preview link

Works for 7 days from when we send it

A preview you never took up

Deleted completely 60 days after the link expires

Details of a business we called that said no

[[HARRY: pick a period. 12 months is normal and defensible.]]

Your phone number on the do-not-contact list

Kept indefinitely, so we never call you again

Your website content after you cancel

[[HARRY: same number as on the domain terms page. 90 days suggested.]]

Payment and accounting records

6 years, as UK tax law requires

Emails between us

[[HARRY: pick a period for the hello@deftly.uk mailbox. 3 years is reasonable.]]

On previews, to be precise: if we build you a preview and you never go ahead, the link stops working after 7 days, and the preview site and everything in it is deleted for good 60 days after that. So a preview nobody claims is gone completely within about ten weeks.

When a retention period ends we delete the information, or where deleting is not practical, we put it beyond ordinary use.

Section 8Your rights

You can ask us to do any of the following, free of charge. Email hello@deftly.uk and we will respond within one month.

• See what we hold. Ask for a copy of the personal information we have about you.
• Correct it. Tell us if anything is wrong or out of date and we will fix it.
• Delete it. Ask us to erase it. We can usually do this, though we have to keep payment records for six years and we have to keep your number on the do-not-contact list if you have asked us not to call.
• Restrict what we do with it. Ask us to pause using it while something is being sorted out.
• Take it with you. Ask for the information you gave us in a common file format so you can hand it to someone else.
• Tell us to stop. Object to us using your information on the basis of legitimate interests, including our cold calling. If you object to marketing, we stop. No arguments, no conditions.
• Withdraw consent at any time, where we relied on your consent for something.

We may need to check you are who you say you are before we act, particularly for a request to see or delete everything we hold.

Section 9Automated decisions

We do not make any decision about you purely by computer that has a legal or similarly significant effect on you. Software helps us decide which businesses to call and helps write website copy, but a person decides who we approach and a person handles anything to do with your account.

Section 10Cookies

We do not use advertising cookies, tracking cookies, analytics tools, or pixels from social networks. There is no cookie banner on this site because there is nothing to ask you to agree to.

The only cookies involved are the strictly necessary ones: the small files that keep you logged in to your account area and that let a card payment complete. Those do not need your consent under UK rules, and they are not used to track you around the internet.

Our website does load its typefaces from Google Fonts, so Google receives your IP address when you visit deftly.uk. That is not a cookie and we do not use it for anything, but you should know it happens.

Section 11Keeping your information safe

Our systems require a login, information is encrypted when it travels across the internet, and access to customer records is limited to the people who need it. The contact details we give to the domain registrar are encrypted where we store them.

We are not going to claim any certification or security standard we do not hold. If we ever suffer a breach that puts your rights at risk, we will tell you and we will tell the Information Commissioner, as the law requires.

Section 12Children

Our service is for businesses. It is not for under-18s and we do not knowingly collect information about children.

Section 13If you want to complain

Please tell us first: hello@deftly.uk. We would rather put it right ourselves.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at any time.

Section 14Changes to this notice

We will update this page when what we do changes, for example if we add a new supplier or start recording calls. The date at the top always shows when it last changed. If a change matters to you, we will email you about it.