1. Who I am
In this policy, "I", "me" and "MonthlySite" mean the business behind monthlysite.co.uk. MonthlySite is a trading name of Transform Sites, run by Charlie. For UK data protection law, I'm the "controller" of the personal details described here.
You can reach me about anything in this policy at hello@monthlysite.co.uk. I reply within one working day.
This policy covers this website, the instant website preview, the contact form, the emails I send and the service I provide to customers. The websites I build for customers have their own privacy notices, which cover the people who visit them (see section 9).
2. What I collect and why
The law asks me to say what I collect, what I use it for, and the "lawful basis" for each use. Here it is.
| What | When | Why | Lawful basis |
|---|---|---|---|
| Your business name, trade, town, style and colour choices, phone number and short description | When you build a free preview | To show you your preview, and to build your website if you go ahead | Legitimate interests (giving you the preview you asked for). If you buy, contract |
| Your email address | When you save your preview or contact me | To send you your preview link and reply to you | Legitimate interests, or steps you asked for before a contract |
| Whether you ticked the marketing box | Preview and contact forms | To send occasional tips and offers, only if you ticked it | Consent |
| That you asked me to check your preview | When you press "Ask Charlie to check it" in the preview | To look at your preview and email you what I'd change | Legitimate interests (a reply you asked for) |
| Your name, phone, business and message | When you use the contact form | To reply to you | Legitimate interests |
| Which step of the preview you reached, the plan you looked at, and how you found the site (for example, the ad you clicked; you can switch this part off on the cookies page) | When you use the preview | To follow up sensibly and understand what is and isn't working | Legitimate interests |
| Name, email, billing address, plan and payment status | When you pay through Stripe | To take payments and keep proper records | Contract, and legal obligation (tax records) |
| Your logo, photos, text, prices and opening hours | When you send them to me as a customer | To build and update your website | Contract |
| Technical details such as your IP address, browser and the pages you asked for | Every visit | To deliver the site securely and stop abuse | Legitimate interests |
I never see your full card details. Stripe handles them.
Where I rely on "legitimate interests", I've checked that what I do is something you'd reasonably expect and doesn't override your rights. You can object at any time (see section 7).
3. Your preview and your logo
The instant website preview runs in your browser. To let you pick up where you left off, it remembers your progress in your browser's local storage (see the cookies page). If you add a logo, it's used to draw your preview on your device and isn't uploaded to me.
When you enter your email address, your business details and your progress through the preview are sent to me, so I can email you your preview link and help if you get stuck.
The site also notes in your browser how you first found it: the campaign tags or ad click code on the link you arrived from, or the website that linked to you. Only the first one is kept. It's sent with your preview details so I can see which adverts and links are worth paying for. You can delete that note and switch it off on the cookies page, and the preview works the same either way.
4. The emails I send
- Service emails, like your preview link, replies to your questions, and account or billing emails if you're a customer. You get these because they're part of what you asked for.
- Marketing emails, like tips and offers. These only go to people who ticked the box, and every one has an unsubscribe link. Unticking or unsubscribing never affects your preview or your website.
I use MailerLite to send emails. Like most email tools, it can tell me whether an email was opened and which links were clicked, which helps me stop sending things that aren't useful.
5. Who helps me
A few trusted services help me run MonthlySite. They only use your details to provide their service to me, under contracts that require them to protect it.
| Service | What it does | Where |
|---|---|---|
| Cloudflare | Hosts this website and customers' websites, runs the preview and contact form functions, and protects against attacks | Worldwide network (US company) |
| MailerLite | Stores contact details and sends emails | EU |
| Stripe | Takes payments and manages subscriptions | EU and US |
| Plausible Analytics (if switched on) | Would count visits without cookies or personal data. It isn't running at the moment | EU |
| Domain registrars and registries (for example Nominet for .uk names) | When I register a domain in your name, your name and contact details go to the registrar and registry, as their rules require | UK and elsewhere, depending on the domain |
I don't sell your details, and I don't share them with anyone else unless the law requires it (for example a valid request from HMRC or the police).
6. Transfers outside the UK
Some of these services store or process data outside the UK, for example in the EU or the US. When they do, the transfer is protected in one of the ways UK law allows: a UK "adequacy" decision (which covers the EU and EEA), the UK Extension to the EU-US Data Privacy Framework, or the International Data Transfer Agreement or Addendum approved by the Information Commissioner's Office.
7. Your rights
You can ask me to:
- tell you what details I hold about you and give you a copy
- correct anything that's wrong
- delete your details
- stop or limit what I do with them
- stop marketing emails, at any time, for any reason
- give you your details in a format you can take elsewhere
Where I rely on your consent, you can withdraw it whenever you like. Where I rely on legitimate interests, you can object. Some rights have limits, for example I have to keep invoices for tax, and I'll tell you if one applies.
Just email hello@monthlysite.co.uk. It's free, and I'll reply within one month. I may need to check it's really you before I share or delete anything.
8. How long I keep things
| What | How long |
|---|---|
| Preview details, if you don't go ahead | 12 months after you last used the preview or emailed me, then deleted |
| Contact form messages | 12 months after our last conversation, unless you become a customer |
| Marketing consent | Until you unsubscribe. After that I keep a note that you unsubscribed, so you don't hear from me again |
| Customer and billing records | While you're a customer, then 6 years, because the law requires it for tax |
| Your website's content (text, photos, logo) | While you're a customer, then 90 days after your plan ends so you can ask for a copy, then deleted |
| Technical logs | A short time, as set by Cloudflare, for security |
9. Websites I host for customers
If you're a customer, your website may collect details from your own customers, for example through its contact form. For those details, you're the controller and I'm your "processor": I look after them on your behalf, under the data processing terms in the Terms of service.
Your website should have its own privacy notice for your customers. I can add a simple one when I build your site.
10. Keeping it safe
This site and every website I host use HTTPS. Access to your details is limited to me, and the services I use are chosen for their security. No system is perfect, so if something ever went wrong that put your details at risk, I'd tell you, and the Information Commissioner's Office where the law requires it.
11. Complaints
If you're unhappy with how I've handled your details, please tell me first at hello@monthlysite.co.uk and I'll do my best to put it right.
You also have the right to complain to the UK regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Children
MonthlySite is a service for businesses. It isn't aimed at anyone under 18, and I don't knowingly collect details from children.
13. Changes to this policy
If I change how I use your details, I'll update this page and the date at the top. If a change affects customers in a significant way, I'll email them before it applies.