Privacy policy

Who we are

Widdy Marketing (“we”, “us”) is run by Freddie Widdrington and based in York, United Kingdom. We are responsible for the personal information you share with us. You can contact us about privacy at freddie@widdymarketing.com.

What we collect

• Details you give us in the contact form: your name, business name, email address, phone number and message, and whether you chose to receive marketing emails.
• Anything you send us by email, phone or WhatsApp.
• If you accept a proposal from us: the name you type, the date and time, your IP address and browser, and a copy of exactly what you accepted, so we both have a record of the agreement. Card and bank details are entered on Stripe's secure page and never reach us.
• If you have an account on our client portal: your name, email address, role, when you sign in and the devices you use, and a coded (hashed) version of your IP address, so we can keep your account secure. Your password is stored only as a one-way coded (hashed) version, so nobody, including us, can read it. When you choose a password, a short, anonymous fragment of its hash is checked against the Have I Been Pwned list of passwords leaked in other data breaches; the password itself never leaves our system. If you turn on two-step verification, its key is stored encrypted. If you turn on notifications on a device, we store the technical address your browser gives us for sending them to that device; turning notifications off deletes it.
• If you accept analytics cookies, information about how you use this website (see Cookies below).
• Basic technical information our hosting provider records automatically, such as your IP address and browser, to keep the website secure and running.

How we use it, and why we are allowed to

• To reply to your enquiry, prepare a quote and talk to you about your project. We rely on our legitimate interest in responding to people who contact us, and on taking steps at your request before entering into a contract.
• To deliver and support work you ask us to carry out, under our contract with you.
• To protect the website and our inbox from spam and misuse, under our legitimate interest in keeping our systems secure.
• To send you occasional tips, news and offers by email, only if you ticked the box on our contact form. This is based on your consent.
• To understand how the website is used so we can improve it, only if you accept analytics cookies. This is based on your consent.

We do not sell your information, and we never use it for automated decisions about you.

Marketing emails

Ticking the marketing box is optional and does not affect your enquiry. We keep a record of when you opted in and the wording you agreed to. You can unsubscribe at any time using the link in any marketing email, or by emailing freddie@widdymarketing.com, and we will stop straight away.

Who we share it with

We use a small number of trusted providers who process data on our behalf, under contracts that protect it:

• Vercel, to host this website.
• Supabase, to store enquiries securely in our management system.
• Resend, to deliver emails.
• Stripe, to take payments and run monthly plans.
• Google, for our business email and, if you accept analytics cookies, Google Analytics.

We use Anthropic's Claude AI to help draft our own marketing content, such as social media posts and write-ups of client projects we have permission to feature. We do not send your enquiry or contact details to it, and Anthropic does not use what we send to train its models.

If you message us on WhatsApp, your messages are handled by WhatsApp (part of Meta) under its own privacy policy, and we use them only to reply to you.

Some of these providers may process data outside the UK, for example in the United States. Where they do, the transfer is covered by UK adequacy regulations (such as the UK-US data bridge) or the UK's approved contract clauses.

How long we keep it

• Messages flagged as spam: deleted automatically after 30 days.
• Enquiries that do not lead to work with us: deleted automatically after 2 years.
• Clients: for as long as we work together, then for up to 6 years for legal and accounting reasons.
• Marketing consent records: for as long as you are subscribed, and a short record after you unsubscribe so we never email you again by mistake.

You can ask us to delete your information sooner at any time.

Your rights

You can ask to see, correct or delete the personal information we hold about you, ask us to limit or stop using it, object to how we use it, ask for a copy to take elsewhere, and withdraw any consent you have given. Email freddie@widdymarketing.com and we will respond within one month. If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk.

We work with clients around the world. Wherever you are, you have these same rights and we handle your information to the same standard. If you live in the European Union, you can also contact the data protection authority in your country.