Source: https://www.envy-creative.com/privacy-policy

# Privacy Policy.

How I collect, use and protect personal information.

Last updated 4 November 2026 UK GDPR & Data Protection Act 2018

## On this page

1. [About this policy](https://www.envy-creative.com/privacy-policy#privacy-section-1)

2. [The short version](https://www.envy-creative.com/privacy-policy#privacy-section-2)

3. [Website visitors, cookies and Google Analytics](https://www.envy-creative.com/privacy-policy#privacy-section-3)

4. [Free SEO report requests](https://www.envy-creative.com/privacy-policy#privacy-section-4)

5. [Enquiries and the contact form](https://www.envy-creative.com/privacy-policy#privacy-section-5)

6. [Clients and the client portal](https://www.envy-creative.com/privacy-policy#privacy-section-6)

7. [Website reports for clients](https://www.envy-creative.com/privacy-policy#privacy-section-7)

8. [Who I share information with](https://www.envy-creative.com/privacy-policy#privacy-section-8)

9. [Keeping information secure](https://www.envy-creative.com/privacy-policy#privacy-section-9)

10. [Your rights](https://www.envy-creative.com/privacy-policy#privacy-section-10)

11. [Changes to this policy](https://www.envy-creative.com/privacy-policy#privacy-section-11)

### Jump to a section

1. [About this policy](https://www.envy-creative.com/privacy-policy#privacy-section-1)

2. [The short version](https://www.envy-creative.com/privacy-policy#privacy-section-2)

3. [Website visitors, cookies and Google Analytics](https://www.envy-creative.com/privacy-policy#privacy-section-3)

4. [Free SEO report requests](https://www.envy-creative.com/privacy-policy#privacy-section-4)

5. [Enquiries and the contact form](https://www.envy-creative.com/privacy-policy#privacy-section-5)

6. [Clients and the client portal](https://www.envy-creative.com/privacy-policy#privacy-section-6)

7. [Website reports for clients](https://www.envy-creative.com/privacy-policy#privacy-section-7)

8. [Who I share information with](https://www.envy-creative.com/privacy-policy#privacy-section-8)

9. [Keeping information secure](https://www.envy-creative.com/privacy-policy#privacy-section-9)

10. [Your rights](https://www.envy-creative.com/privacy-policy#privacy-section-10)

11. [Changes to this policy](https://www.envy-creative.com/privacy-policy#privacy-section-11)

## About this policy

This policy explains how **Stephen Davis, a sole trader trading as Envy Creative** (“I”, “me”, “my”), collects, uses and protects personal information. I am the data controller for the information described here, unless I say otherwise.

Address: **22 Tower Hill, Clitheroe, Lancashire, BB7 1PD, United Kingdom**. Email: [hello@envy-creative.com](mailto:hello@envy-creative.com). Telephone: [07835 694973](tel:+447835694973).

It covers this website, the free SEO report, enquiries, the client portal and the services I provide to clients. Cookies are explained in more detail in my [cookie policy](https://www.envy-creative.com/cookies).

## The short version

- Google Analytics only runs on this website if you accept analytics cookies.

- If you request a free SEO report, I use your name, email address and website to run the check, email you the report and follow up about the results. I don’t add you to a marketing list, and the request is deleted automatically after 90 days.

- If you’re a client, I keep your business and contact details in my admin system so I can manage projects, send invoices and keep the records the law requires.

- If I report on your website’s Google Analytics, I only read summary statistics, not details about individual visitors.

- I never sell personal information.

## Website visitors, cookies and Google Analytics

Essential cookies keep this website secure, make forms work and remember your cookie choices. These don’t need your consent.

**Google Analytics 4** loads only if you accept analytics cookies. It tells me how the website is used, for example which pages are visited, how people arrived (such as from a search engine), the type of browser and device used, and approximate location (country or city). I use this to improve the website. I’ve turned off Google signals and advertising personalisation, and web addresses are sent to Google without any query strings.

- **Lawful basis:** your consent. You can change or withdraw it at any time using the  link at the bottom of every page.

- **Retention:** Google Analytics data is kept for the retention period set in my Google Analytics account, which is no more than 14 months. I keep a record of your cookie choices (a random ID, your choices, the policy version and the date, but no IP address) for 180 days.

Like most websites, the servers that host this site may keep standard technical logs, including IP addresses and browser details, for security and troubleshooting.

The full list of cookies, what each one does and how long it lasts is in my [cookie policy](https://www.envy-creative.com/cookies).

## Free SEO report requests

When you request a free SEO report, I collect:

- your name and email address;

- the website address you want checked;

- the date and time you gave consent;

- a scrambled (hashed) version of your IP address and website domain, used to prevent misuse and limit repeat requests. These can’t be turned back into the original details.

I use this information to check the homepage of your website, email the report to you and contact you about the results. To run the check, I send **only the website address** to DataForSEO, a third-party SEO data provider. It runs the on-page and Lighthouse performance checks. Your name and email address are not sent to them. The form is protected by Google reCAPTCHA (see “Enquiries and the contact form” below).

- **Lawful basis:** your consent, given by ticking the box on the form. You can withdraw it at any time by emailing me.

- **No marketing list:** I won’t add you to a mailing list or send you marketing emails because you requested a report.

- **Retention:** report requests, including the report itself, are deleted automatically after 90 days. If you become a client or we continue talking, the client and enquiry sections below apply instead.

## Enquiries and the contact form

When you contact me through the website, by email or by phone, I receive the details you provide, such as your name, email address, phone number, the service you’re interested in and your message. Contact form messages are emailed to me, and you’re sent an automatic confirmation email.

The contact form and SEO report form use **Google reCAPTCHA Enterprise** to block spam and abuse. reCAPTCHA analyses device and browser information for this purpose. Google’s [privacy policy](https://policies.google.com/privacy) and [Cloud privacy notice](https://cloud.google.com/terms/cloud-privacy-notice) apply.

- **Lawful basis:** my legitimate interests in replying to enquiries and protecting the website, or taking steps at your request before we enter into a contract.

- **Retention:** enquiries that don’t lead to work are deleted within 2 years of our last contact.

## Clients and the client portal

If you’re a client, I keep the information needed to run your projects and my business in my secure admin system and client portal. This includes:

- **Business and contact details:** business name, contact names, email addresses (including any you ask me to copy invoices to), phone number, registered or business address and website.

- **Project records:** proposals, project files, tasks, messages and comments, time records and notes about the work.

- **Financial records:** quotes, invoices, payments and agreed rates. When an invoice link is opened, the date, time and IP address are recorded so I can confirm the invoice was received.

- **Portal accounts:** your name, email address and password. Passwords are stored in encrypted (hashed) form. Signed-in sessions record your IP address and browser for security.

- **Email records:** a log of emails sent from the system (recipients, subject, date and attachment names) so I can show what was sent and when.

- **Lawful basis:** performing our contract; my legal obligations, such as keeping accounting and tax records; and my legitimate interests in running my business and handling any disputes.

- **Retention:** while we work together, then for 6 years after the end of the tax year in which our last project or invoice was completed. This covers HMRC record-keeping rules and the time limit for legal claims. After that, records are deleted or anonymised.

## Website reports for clients

If you’re a client and ask me to report on your website, I connect to your Google Analytics 4 property using **read-only access** that you grant. I can view your statistics, but I can’t change your Google Analytics account or its settings.

I use this access to produce regular website reports, usually monthly. They are emailed as a PDF to the people you nominate and are available in the client portal. The reports use **summary statistics only**, such as:

- number of visitors, new visitors, sessions and page views;

- engagement rate and average visit length;

- traffic sources, referring websites and popular pages;

- visitor countries and trends over time.

These figures don’t identify individual visitors to your website. Where I also provide SEO monitoring, I record search ranking and website check results for your website using DataForSEO.

- **Your role:** you remain the controller of your website’s analytics data. I process it on your behalf, only to provide the reports you’ve asked for. A data processing agreement applies where needed, as set out in my [terms and conditions](https://www.envy-creative.com/terms).

- **Report recipients:** I keep the names and email addresses of the people you ask me to send reports to. You can change these at any time.

- **Retention:** stored reports are deleted automatically after 2 years, and SEO monitoring history after 12 months. You can stop reporting at any time by telling me or by removing my access in Google Analytics.

The same applies to any other work on your website, such as development, hosting or support. If I can access personal data about your customers, I do so only on your instructions, as your processor. Your own website’s privacy policy should explain how you handle your customers’ data.

## Who I share information with

I only share personal information where it’s needed for the purposes above, with:

- **my hosting and email providers**, which run this website, its database and my email;

- **Google**, for Google Analytics (with your consent), reCAPTCHA and client analytics reporting;

- **DataForSEO**, which receives website addresses to run SEO checks;

- **my accountant, bank and payment providers**, and HMRC where required;

- **trusted subcontractors** who help with a project, under confidentiality obligations;

- **professional advisers, courts or authorities**, where the law requires it or to protect my legal rights.

Some of these providers, including Google, may process information outside the UK. When this happens, the transfer is protected by safeguards recognised under UK law, such as UK adequacy regulations or approved contract terms.

## Keeping information secure

I use reasonable technical and organisational measures to protect personal information. These include encrypted connections (HTTPS), password-protected and access-controlled systems, hashed passwords, and limiting access to people who need it. No system is completely secure, but I’ll act promptly and meet my legal obligations if a data breach occurs.

## Your rights

Under UK data protection law, you have the right to:

- ask for a copy of the personal information I hold about you;

- ask me to correct inaccurate or incomplete information;

- ask me to delete your information;

- object to, or ask me to restrict, how I use it;

- ask for your information in a portable format;

- withdraw consent at any time, where I rely on consent.

Some rights apply only in certain circumstances. For example, I may need to keep invoices for tax purposes. To make a request, email [hello@envy-creative.com](mailto:hello@envy-creative.com). I’ll respond within one month.

If you’re unhappy with how I’ve handled your information, please contact me first. You can also complain to the [Information Commissioner’s Office (ICO)](https://ico.org.uk/make-a-complaint/).

## Changes to this policy

I may update this policy from time to time, for example if I start using a new service. The “last updated” date at the top shows when it last changed. Where a change significantly affects how I use your information, I’ll let clients know directly.

## Questions about your information?

If you’d like to see, correct or delete the information I hold about you, or have any questions about this policy, just get in touch.

 [Email hello@envy-creative.com](mailto:hello@envy-creative.com)