Privacy Policy
What we collect, why we need it, who helps us handle it, and your rights.
Last updated: 15 October 2026
1. Who we are
Smart Page Studio LTD (“we”, “us”) designs and builds websites, apps and automations for businesses. Smart Page Studio LTD is the data controller. That means we’re responsible for the personal information described in this policy. We’re registered in England under company number 17452733, and our registered office is 82a James Carter Road, Mildenhall, Bury St. Edmunds, England, IP28 7DE. You can contact us about anything in this policy at info@smartpagestudio.com.
2. What we collect and why
Most of what we hold is what you give us. For each kind, here’s why we need it and the legal basis we rely on under UK data protection law.
Enquiries and quote requests
From the contact form and the app quote form: your name, email address, business name and message. For app quotes, also your phone number (optional), your app idea, and the platform, device and website options you choose. Every enquiry from the site is kept in our enquiries inbox so we can reply and keep track of the conversation.
- Why
- To reply to you and prepare your quote.
- Legal basis
- Legitimate interests (answering people who contact us), and taking steps you ask for before a contract.
Your client account
Your name, email address and password — or, if you choose “Continue with Google”, the name and email address Google shares with us. Your password is held securely by our account provider — we never see it.
- Why
- To give you a client dashboard where you can follow your project and ask for help.
- Legal basis
- Contract.
Orders and project briefs
The package you choose and how you pay; the answers you give about your business and design, such as your business name, vision and colours; any files you send with your brief; and times you’re free for a call.
- Why
- To build and deliver what you’ve bought.
- Legal basis
- Contract.
Automation set-up
What you tell us about your business — services, prices, policies, opening hours and tone of voice — and any documents you upload.
- Why
- To set up your automation so it answers the way you would.
- Legal basis
- Contract.
Support and change requests
Your message and the account it came from. When something changes on your project, we email you a notification or a project update.
- Why
- To help you, make the changes you ask for, and keep you posted.
- Legal basis
- Contract.
Payments
You pay on Stripe’s checkout, or with Klarna or Clearpay if you choose to pay in instalments. We never see or store your card details — we only receive confirmation of what was paid.
- Why
- To take payment and keep financial records.
- Legal basis
- Contract, and our legal obligation to keep tax and accounting records.
Free tools
The business name generator uses the business type, style, keywords and location you enter. We don’t save it.
- Why
- To give you the result you asked for.
- Legal basis
- Legitimate interests (providing the tool you’re using).
Login security
Our login, account sign-up and post-purchase account forms, the free business name generator and website audit, and the order form when you attach files use Cloudflare Turnstile, which looks at information about your browser and device to tell people from bots. Turnstile may set its own cookies — see our cookie policy.
- Why
- To protect accounts from automated attacks.
- Legal basis
- Legitimate interests (keeping accounts secure).
Optional features
These only happen if you choose “Accept all” on the cookie banner: we send your IP address to ipapi.co to find your country, so prices can show in your currency; if you arrived from a link with a campaign tag, we record that campaign’s source and name — never who you are; and if you arrived through someone’s referral link, their code is remembered for 60 days so they can be thanked if you order.
- Why
- To show prices in your currency, to see which of our campaigns bring people to the site, and to credit referrals.
- Legal basis
- Consent. You can change your choice at any time on our cookie policy page.
Journal tools that email you a result
Some of our free Journal tools ask for an email address so we can send you the result. We keep the address you typed into the tool, and which tool you used.
- Why
- To send you the result you asked for, and to follow up if you’d like our help.
- Legal basis
- Taking steps you ask for before a contract, and legitimate interests (following up with people who have used a tool).
Referral programme
If you join our referral programme: your referral code, the visits and orders it brought in, and the bank account details you give us so we can pay your commission.
- Why
- To run the programme and pay you what you’ve earned.
- Legal basis
- Contract, and our legal obligation to keep tax records.
Our chat assistant runs entirely in your browser. What you type into it isn’t stored, and isn’t sent to us or anyone else.
3. Who we share it with
We don’t sell your information or use it for advertising. We share it only with the services that help us run the business, and only what each one needs:
- FormSubmit
- Delivers our website forms to our inbox. For project briefs it also emails you a confirmation.
- Microsoft (Outlook)
- Hosts our email inbox, where form messages arrive.
- Supabase
- Stores client accounts, orders, support requests, automation answers and uploaded documents, on servers in the EU.
- Netlify
- Hosts the website and runs our online tools.
- Stripe
- Takes payments. Klarna and Clearpay handle instalment payments if you choose them; they are responsible for that data themselves and may carry out their own checks.
- Groq
- Runs the AI behind the business name generator and some of our drafting tools, using only the text given to it.
- Anthropic
- Runs Claude, the AI assistant our owners use internally to work on business documents and notes, which can include documents you send us. It also drafts replies to enquiries and marketing suggestions, which an owner reads and edits before anything is sent, and drafts our emails to businesses (section 5). It never talks to you directly.
- Signs you in to the client portal if you choose “Continue with Google” (we receive your name and email address from Google). Serves the fonts on our colour palette tool — but only after you accept optional cookies, which lets Google see your IP address. Also tests the speed of client websites we look after (PageSpeed Insights).
- Cloudflare
- Runs the bot check (Turnstile) on our login, account sign-up and thank-you pages, the free business name generator and website audit, and the order form when you attach files, and checks whether suggested domain names are available (domain names only).
- Companies House
- Checks whether suggested business names are already registered (names only — none of your details).
- ipapi.co and open.er-api.com
- Work out your country and exchange rate for the optional currency feature. Only ipapi.co receives your IP address.
- Resend
- Sends the emails you ask for — the confirmation that your enquiry arrived, and our reply to it — and the emails from your client portal: notifications, project updates, invitations and password resets.
- Our business email provider
- Sends and receives our emails to businesses from a separate outreach mailbox, as described in section 5.
- Telegram
- Delivers alerts from our marketing assistant to the owners’ phones. An alert may include the business name and the source of an enquiry, so the owners can respond quickly.
We may also share information where the law requires it.
4. Transfers outside the UK
Several of these providers are based in, or process data in, the United States: Stripe, Netlify, Resend, Groq, Anthropic, Cloudflare, Google and Telegram. Where a provider is certified under the UK Extension to the EU–US Data Privacy Framework (the UK–US “data bridge”), we rely on the UK’s adequacy decision for that transfer. Where it isn’t, we rely on the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, which the Information Commissioner has approved for transfers from the UK.
5. Businesses we contact
We sometimes email limited companies we think our services could help. We find them on the public Companies House register (company name, number, registered office and trade), then look at the company’s own website and check it the way a customer or Google would: speed, mobile layout, security and search basics. If we write to you, we use the business email address published on your website, and we send you those results on a private page. We only ever email limited companies, LLPs and PLCs — never sole traders or partnerships — and every email is read and approved by a person before it is sent. Our legal basis is our legitimate interest in telling businesses about services that could help them.
If you’d rather not hear from us, use the unsubscribe link in the email, reply “unsubscribe” or “no thanks”, or email info@smartpagestudio.com, and we’ll stop straight away. We send at most one email and two short follow-ups, and stop the moment you reply. We keep your email address, domain and company number on a do-not-contact list only so we never contact you again.
6. How long we keep it
- Website enquiries and quote requests that don’t lead to work: deleted 12 months after our last contact.
- Client accounts, orders, briefs and support history: kept while you’re a client, then for up to 6 years for tax and accounting.
- Documents uploaded for an automation: kept while the automation is running, and deleted within 3 months after it ends.
- Businesses we contact: deleted within 6 months unless you reply or we start working together, in which case it becomes part of your enquiry or client record (see section 5). The do-not-contact list is kept permanently, so we never contact you again.
- Form answers saved in your browser: these stay on your own device until you send the form — see our cookie policy.
- Email addresses typed into our free Journal tools: 12 months.
- Our own page-view statistics (which campaign brought a visit — never who you are, and no cookies): 13 months.
- Referral programme payout details: 6 years after the last payout, for tax records.
You can ask us to delete your information sooner — see your rights below.
7. Your rights
Under UK data protection law you can:
- See the personal information we hold about you, and get a copy.
- Have anything wrong corrected.
- Have your information deleted.
- Ask us to limit how we use it, or object to us using it — and stop marketing at any time.
- Receive information you gave us in a format you can take elsewhere.
- Withdraw consent you’ve given, such as for the optional features.
To use any of these rights, email us. We’ll reply within one month. If you’re unhappy with how we’ve handled your information, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113 — though we’d appreciate the chance to put it right first.
8. Keeping it safe
Accounts and records are protected by access controls, so clients see only their own. Documents you upload are kept in private storage, and shared with our team only through time-limited links. Everything travels over encrypted (HTTPS) connections. No system is completely secure, so please use a strong password you don’t use anywhere else.
9. Cookies and browser storage
What we store in your browser, and how to change your choice, is explained in our cookie policy.
Our own fonts are self-hosted on every page, so viewing the site doesn’t send a font request to Google. The only exception is the colour palette tool (/journal/palette), which loads its sample fonts from Google Fonts — and only after you accept optional cookies. When it does, your browser contacts Google, and Google can see your IP address.
10. Everything else
Our services are for businesses and aren’t aimed at children. We don’t make decisions about you by automated means alone. If we change this policy, we’ll update this page and the date at the top.
Questions or requests
To ask about your information or use any of your rights, email us and we’ll get back to you within one month.
Email us about your data