Privacy policy
Last updated 2 October 2026. What we collect, why, and what you can ask us to do with it.
Who's responsible
DuckByte, run by Alex Thomas in the UK, is the data controller for the personal data described here. Contact: hi@duckbyte.co.
For data inside a site or app we build and run for you (for example your customers' bookings), you are the controller and we process it on your behalf.
What we collect and why
Enquiries: your name, email, company, budget and message, so we can reply and quote. Basis: legitimate interests.
Accounts and projects: your email, login details, project brief, messages, files you upload and billing status, so we can deliver what you've bought. Basis: contract.
Payments: handled by Stripe. We see your payment status and the last digits of your card, never the full card number. Basis: contract.
Build-log updates: your email if you subscribe. Basis: consent, which you can withdraw anytime by replying.
Business outreach: if we contact you at work, we use your business name, work email, job title and public company information. Basis: legitimate interests. Reply "no" and we'll stop.
Analytics: we use Umami, which is cookieless and doesn't build personal profiles or track you across sites.
Who we share it with
Only the providers we need to run the service: Supabase (database, login and file storage), Vercel (hosting), Stripe (payments), Resend and Zoho (email), Google Gemini (AI generation of your site or content from the brief you give us), and our own build server. Each is bound by its own data protection terms. We never sell your data.
Some providers are outside the UK. Where they are, transfers are covered by recognised safeguards such as the UK International Data Transfer Addendum or adequacy regulations.
How long we keep it
Enquiries and outreach records: up to 24 months, unless you become a client. Client and billing records: for as long as you're a client, plus 6 years for tax purposes. You can ask us to delete anything we don't legally need to keep.
Your rights
Under UK GDPR you can ask to see, correct, export or delete your data, object to how we use it, or withdraw consent. Email hi@duckbyte.co and we'll respond within a month. If you're unhappy, you can complain to the Information Commissioner's Office (ico.org.uk).
Security
Data is encrypted in transit, access is restricted to what's needed, client data is separated with row-level security, and admin actions are limited to DuckByte.