Privacy Policy

1. Who We Are

Aposlo Studios Ltd ("we," "us," "our") is a web design and digital services company registered in England and Wales. Our registered office is at 217 Long Lane, Halesowen, B62 9JT, United Kingdom.

If you have any questions about this privacy policy or how we handle your data, you can contact us at hello@aposlostudios.com.

Aposlo Studios Ltd is registered with the Information Commissioner's Office (registration number ZC274334).

2. What Data We Collect

We collect personal data in two ways.

When you give it to us, through our contact form or when you email, call or message us as an enquirer or a client. This includes:

• Your name
• Your email address
• Your phone number (if provided)
• Your message content

When we find a business that may want our services. We collect the contact details a business has published, from public sources such as Google Maps, Companies House and the business's own website. Many of the businesses we contact are sole traders or small companies, so these details can identify a person. Section 14 explains where they come from, how we use them and how to ask us to remove them.

We do not collect sensitive personal data, and we do not collect data from children under the age of 16.

3. How We Use Your Data

We use the personal data you provide to:

• Respond to your enquiry or message
• Provide you with information about our services
• Communicate with you about a project or subscription
• Improve our website and services
• Contact businesses to introduce our services (see section 14)

The legal basis for processing your data is your consent (provided when you submit the contact form) and our legitimate interest in responding to business enquiries. For businesses we contact first, our legal basis is legitimate interests, as explained in section 14.

4. Third-Party Services

We use a limited number of third-party services to operate our website. These services may process your data as described below:

• Resend — We use Resend to deliver contact form submissions. When you submit a form, your data is sent through Resend's email infrastructure to our inbox. Resend does not store your data permanently. See their privacy policy at resend.com/legal/privacy-policy.
• Vercel — Our website is hosted on Vercel's infrastructure. Vercel may collect technical data such as IP addresses and browser information for security and performance purposes. See their privacy policy at vercel.com/legal/privacy-policy.
• Google Analytics — We use Google Analytics to understand how visitors use our website. This collects anonymised data about page views, session duration, device type, and geographic location. We do not use Google Analytics to identify individual visitors. See Google's privacy policy at policies.google.com/privacy.
• Google Ads — We advertise on Google and use Google Ads conversion tracking to measure whether an ad click led to an enquiry on our website. Advertising cookies are only set if you consent via our cookie banner; without consent, Google receives only cookieless, aggregated signals. If you arrived from one of our adverts and accepted cookies, the phone number shown on this site may be a Google forwarding number that rings our normal phone. Google records that the call happened and how long it lasted, never what was said. We do not sell your personal data.
• Whop — We use the Whop Pixel to measure which of our adverts lead to visits and enquiries. It records the pages you view and uses device identifiers (including browser fingerprinting) to recognise returning visitors. It only loads if you accept cookies via our cookie banner. See Whop's privacy policy at whop.com/privacy.

5. Cookies

Our website uses cookies to improve your experience and to help us understand how the site is used. Cookies are small text files stored on your device by your browser.

We use the following types of cookies:

• Essential cookies — Required for the website to function properly. These cannot be disabled.
• Analytics cookies — Used by Google Analytics to collect anonymised usage data. These are only set if you consent via our cookie banner.
• Advertising cookies — Used by Google Ads and Whop to measure whether our ads lead to enquiries. These are only set if you consent via our cookie banner.

You can manage or disable cookies through your browser settings at any time. Disabling essential cookies may affect the functionality of the website.

Separately from cookies, when you tap our phone number or WhatsApp button, the site counts the tap: which button, which page, the time, and whether you came from one of our Google adverts. It sets no cookie, stores nothing on your device and keeps nothing that identifies you (no IP address and no details of your device), whatever you chose about cookies. We use the count to see how many people get in touch.

6. Data Retention

We retain personal data collected through contact form submissions for as long as necessary to respond to your enquiry and manage any resulting business relationship. If no business relationship is established, we will delete your data within 12 months of your initial enquiry. If you become a client, we will retain your data for the duration of our business relationship and for up to 6 years afterwards for legal and accounting purposes. How long we keep the details of businesses we contact first is set out in section 14.

7. Your Rights Under UK GDPR

Under the UK General Data Protection Regulation, you have the following rights:

• Right of access — You can request a copy of the personal data we hold about you.
• Right to rectification — You can ask us to correct any inaccurate or incomplete data.
• Right to erasure — You can ask us to delete your personal data where there is no compelling reason for us to continue processing it.
• Right to restrict processing — You can ask us to limit how we use your data.
• Right to data portability — You can request your data in a structured, commonly used format.
• Right to object — You can object to our processing of your data where we rely on legitimate interest.
• Right to withdraw consent — Where we rely on your consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at hello@aposlostudios.com. We will respond to your request within 30 days.

8. Data Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. Our website uses SSL encryption to secure data in transit. Access to personal data is limited to authorised personnel only.

9. International Transfers

Some of our third-party service providers (such as Vercel and Google) may process data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses or adequacy decisions, to protect your data in accordance with UK GDPR requirements.

10. Data We Handle on Behalf of Our Clients

Where we build and host a website for a client, any personal data submitted by that website's own visitors and customers — such as names, email addresses, enquiries, and order details — belongs to the client. In that context the client is the data controller and Aposlo Studios Ltd acts only as a data processor on the client's behalf.

We host this data solely to run the website. We do not use it for our own purposes, and we do not sell or share it. We do not process or store any card or payment details — payments taken through a client's website are handled entirely by that client's own payment provider, and we are not the payment processor or merchant of record. We apply appropriate technical and organisational security measures, and use trusted sub-processors to deliver our services, including our hosting provider (Vercel) and our form and analytics providers.

Each client website may have its own privacy policy governing that website's visitors. This policy covers aposlostudios.com and our relationship with our clients. If you are a customer of a website we host and wish to exercise your data rights, please contact the business that operates that website (the data controller); we will support that business in responding to your request.

11. Portfolio & Marketing

We may feature websites we have designed or built in our portfolio and on our social media channels. This showcases the website and the client's brand only — we do not share our clients' customer data. If you would prefer that we did not feature your website, please let us know in writing and we will remove it.

12. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). You can contact the ICO at ico.org.uk or by calling 0303 123 1113.

13. Outbound Marketing Calls

We sometimes telephone UK businesses whose contact details are publicly listed, for example on a Google Business Profile, to introduce our services. Before we call, we screen every number against the Telephone Preference Service (TPS) and the Corporate Telephone Preference Service (CTPS), and we do not call registered numbers.

These calls are handled by an AI assistant. It will tell you it is an AI if you ask. Calls are recorded and transcribed so we have an accurate record of what was discussed, and recordings are retained for 12 months.

Our lawful basis for this processing is legitimate interests: promoting our services to businesses likely to benefit from them, balanced against keeping calls brief, infrequent, and easy to stop.

If you would prefer not to be called again, simply say so during the call and we will remove you immediately and permanently. You can also email hello@aposlostudios.com. You have the right to object to this processing at any time, and to request a copy of any recording we hold about you.

14. Businesses We Contact by Email and Text

We look for UK trade and small businesses that may want a new or better website, and we contact some of them by email or text to introduce our services. If we have contacted you this way, this section explains where we found your details, what we do with them and how to stop us.

Where your details come from

• Google Maps: the business name, address, phone number, website, type of business and reviews shown on its Google Business Profile.
• Companies House: whether the business is a limited company, its company number and registered office, and the name of a current director. We only use a director's first name, to greet them.
• The business's own website: the email address and other contact details it publishes there. We only use an address the business has published; we never guess one. We also note how the website works (for example, whether it is easy to use on a phone) so that what we say is relevant.
• Public social media posts: public posts in local Facebook groups and under Instagram hashtags in which a business talks about its work or asks about websites. We then look the business up on Google Maps as above.

What we send

• Emails to businesses, including sole traders. Every email says how to tell us you are not interested.
• Texts to limited companies only.
• If you do not reply, we may send a short follow-up. We stop as soon as you ask us to.

Our lawful basis is legitimate interests: telling businesses about a service that is likely to be useful to them. We balance this by using only contact details the business has made public, keeping our messages short and stopping straight away when asked.

Who handles your details

We store these details in our own database (Supabase, hosted in Ireland). Emails are sent through Google Workspace and texts through Twilio. We use Apify to collect public social media posts, and AI services from Anthropic, OpenAI and Google to help us write and check our messages. These providers act only on our instructions. We do not sell or share your details with anyone else.

How long we keep them

If nothing comes of our contact and we have not been in touch for 12 months, we automatically erase the names, phone numbers, email addresses, notes and messages we hold. We keep only the business name, its type of work and its town.

How to be removed

• Reply to our email or text and tell us you are not interested. Any wording will do.
• Reply STOP to any of our texts.
• Or email hello@aposlostudios.com and ask us to remove you.

We stop contacting you straight away and add you to our do-not-contact list. That list keeps only what we need to make sure we never contact you again, such as the email address or phone number. If you would also like us to erase everything else we hold about you, say so and we will. You can also ask for a copy of what we hold (see section 7).

15. Calls to Our Receptionist

When we cannot answer a call to our business number, 07749 832852, it is passed to Lucy, our AI receptionist. She tells you at the start of the call that she is a virtual assistant and that calls are recorded. She answers questions about our services and prices, takes your name, business details and phone number, and can book a call-back with us.

The call is recorded and transcribed by our voice provider, ElevenLabs, so we have an accurate record of what you asked for. Recordings and transcripts are kept for 90 days. The details you give us (your name, business, number and what you would like) are kept as an enquiry, in the same way as a message through our contact form, and we may look up your business's public listing and website to prepare for the call-back.

Our lawful basis is legitimate interests: answering your call and getting back to you about what you asked for. You can ask us for a copy of a recording, or ask us to delete it, at any time by emailing hello@aposlostudios.com.

16. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated "last updated" date. We encourage you to review this policy periodically.

17. Contact Us

If you have any questions about this privacy policy, please contact us:

• Email: hello@aposlostudios.com
• Company: Aposlo Studios Ltd
• Registered office: 217 Long Lane, Halesowen, B62 9JT, UK