Privacy Policy

Who We Are

BoldCrafter is a trading name of IndevFlow LTD, a company registered in England and Wales under company number 16735566, whose registered office is 94 Regent Street, Nuneaton, England, CV11 4BL. We are a web design, development and digital marketing studio. We are the "data controller" for the personal information described in this policy, which means we decide why and how it is used.

Our registered office is given above. Our privacy email address and telephone number are in the contact panel further down this page.

A note on our contact details. Our email address and phone number on this page are deliberately scrambled, and only unscramble when you interact with them (slide or tap to reveal). This is an anti-spam measure. It stops automated harvesting software collecting our details and burying us in junk mail. It does not restrict you at all. The details are there for anyone who wants them, and you can reach us any time through our contact page.

We would rather explain all this in plain English than hide behind legal jargon, so that is how we have written it.

1. Scope and Your Agreement

This policy covers the personal information we collect through our website, our online forms, our AI assistant Nova, and the services we provide to clients and prospective clients.

It sits alongside two other documents so that we are not repeating the same rules in several places. Our Cookie Policy covers cookies and how to manage them, and our Terms of Service cover the contract between us when you buy our services.

We handle personal information in line with the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025. Where we offer services to people in the European Economic Area, we also handle their information in line with the EU GDPR.

Agreement:
By using our website and services, you confirm you have read this policy and understand how we handle personal information. Where we rely on your consent for something, we ask for it separately, and you can withdraw it at any time.

2. Information We Collect

We only collect what we actually need. Depending on how you deal with us, that may include:

Information you give us directly:

• Contact and enquiry forms: your name, email address, phone number, your message, and any files you choose to attach

• Bookings, project briefs and quote requests: your contact details, plus the project information you provide

• Client onboarding and intake forms: the business, project and account details we need to deliver the work, including any files you upload

• Support tickets: your messages and attachments

• Newsletter sign-up: your email address

• Blog comments: your name, email address and comment

• Job applications: your application details and CV

• Feedback and testimonials: your name and the feedback you submit

Information we collect automatically:

• Your IP address, browser type and device information

• Pages visited, referring pages and general usage patterns

• Hashed technical identifiers used to spot automated abuse, explained in section 5

• Cookies and similar technologies, explained in section 4

Payment information. Card payments are handled by our payment provider, Stripe. Your full card number never reaches our systems and we do not store card details. We keep records of invoices and transactions for accounting purposes.

3. Why We Use Your Information and Our Lawful Bases

Data protection law says we need a valid "lawful basis" for every use of personal information. Ours are:

• To perform a contract. Delivering the services you have engaged us for, managing your project, issuing invoices and providing support.

• Our legitimate interests. Responding to enquiries, running and improving our website and services, keeping our systems secure, preventing fraud and abuse, and operating Nova. We weigh these against your rights and only go ahead where our interest does not override them.

• Your consent. Sending marketing emails, publishing your feedback or testimonial, and setting non-essential cookies. You can withdraw consent at any time.

• Legal obligation. Keeping accounting and tax records, and responding to lawful requests from authorities.

We do not sell your personal information, and we do not hand it to third parties for their own marketing.

4. Cookies and Similar Technologies

We use strictly necessary cookies to make the site work, for example to keep you signed in, remember your cookie choices, and protect forms against cross-site request forgery. These do not require consent.

Any analytics or non-essential cookies are only set if you have agreed. You can change your choices at any time in our cookie settings, and you can block or delete cookies in your browser, though parts of the site may then stop working properly.

Where we run analytics, we may use Google Analytics to understand how the site is used and where it can be improved. Our consent settings start with analytics and advertising storage switched off, so nothing analytics related is set until you agree to it. If you agree, Google processes that data as our service provider, and Google may transfer it outside the UK, in which case the safeguards in section 8 apply. The full detail of each cookie category is in our Cookie Policy.

5. Security Monitoring and Fraud Prevention

To keep the site online and protect it from attack, spam and automated abuse, we run security monitoring. This protects your information as much as ours, so we want to be open about what it involves.

• We log IP addresses, browser identification strings, requested pages, and the outcome of security checks

• We create hashed (one-way scrambled) technical identifiers, so we can recognise repeat automated abuse without needing to identify you personally

• We use automated bot detection to block scanners, scrapers and malicious traffic, and our team may be alerted when a serious threat appears

• We check that email addresses submitted through our forms are properly formed and able to receive mail, which cuts down fraudulent and throwaway submissions

• Our site may be served through a content delivery and security network, which processes connection data to filter malicious traffic

Our lawful basis for this is our legitimate interest in network and information security. These decisions only affect access to our website. They do not produce legal effects concerning you.

7. Who We Share Your Information With

We share personal information only where we need to, and only with organisations that are contractually bound to protect it and to use it solely on our instructions. Those are:

• Our AI service provider, so Nova can generate replies

• Stripe, our payment provider, to process card payments securely

• Our email and hosting providers, to run our website and send email

• Our content delivery and security provider, to keep the site fast and protected

• Google, where you have consented to analytics cookies, so we can measure how the site is used

• Professional advisers such as accountants and solicitors, where genuinely needed

• Authorities or other parties, where the law requires it or where we need to bring or defend a legal claim

8. International Data Transfers

Some of our providers, including our AI service provider, may process information outside the UK or European Economic Area. Where that happens we make sure an appropriate safeguard is in place, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or Standard Contractual Clauses. That way the protection travelling with your information is not materially lower than it would be here.

9. How Long We Keep Your Information

We keep personal information only as long as we need it, then delete it or reduce it to anonymous statistics. As a general guide:

• Nova operational records: up to 30 days

• Security and access logs: a short rolling period, then purged, unless needed for an active investigation

• Enquiries that do not turn into projects: a reasonable period in case you come back to us, then deleted

• Client project records: for the life of our relationship and a reasonable period afterwards

• Invoices, payments and accounting records: six years, to meet UK tax and accounting requirements

• Newsletter subscriptions: until you unsubscribe

If we need to keep something longer to bring or defend a legal claim, or to comply with a legal obligation, we keep only what is necessary for that purpose.

10. Your Data Protection Rights

Depending on where you live and the circumstances, you have these rights over your personal information:

• Access. Ask for a copy of the personal information we hold about you.

• Rectification. Ask us to correct information that is wrong or incomplete.

• Erasure. Ask us to delete your information where there is no good reason for us to keep it.

• Restriction. Ask us to pause how we use your information while a concern is sorted out.

• Portability. Ask for your information in a portable format, or that we send it to another provider.

• Objection. Object to processing based on our legitimate interests, and object to direct marketing at any time.

• Withdraw consent. Where we rely on consent, withdraw it at any time without affecting what we did beforehand.

Using these rights is free. To do so, use the privacy contact details in the panel below, or our contact page. We may need to confirm who you are first, so that we do not hand your information to someone else. We aim to reply within one month, and we will tell you if we need longer because the request is complicated.

11. How to Raise a Concern or Complain

If you are unhappy with how we have handled your personal information, please tell us first and give us the chance to put it right. You can reach us using the privacy contact details in the panel below, or through our contact page.

In line with the Data (Use and Access) Act 2025, we will acknowledge your complaint within 30 days and respond without undue delay.

You can also complain directly to the Information Commissioner's Office, the UK supervisory authority, at any time. The ICO can be reached at ico.org.uk or on 0303 123 1113. If you are in the EEA, you can complain to your local supervisory authority instead.

12. Automated Decision-Making and Profiling

We do not make decisions that produce legal effects or similarly significant effects for you based only on automated processing.

We do use automated systems in limited ways. Our security systems assess traffic automatically and may block access to our website, and Nova generates its replies automatically. Neither decides anything about your legal rights, your money, or your access to our services, and you can always ask a person to review the outcome.

13. Children's Privacy

Our website and services are aimed at businesses and adults. They are not directed at children, and we do not knowingly collect personal information from children under 16. Where we do offer anything likely to be used by children, we take their needs into account as required by the Data (Use and Access) Act 2025 and the ICO's Age Appropriate Design Code.

If you think a child has given us personal information, please contact us and we will delete it.

14. How We Protect Your Information

We use appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure or destruction. These include:

• Encryption of data in transit and, where appropriate, at rest

• Encrypted storage of sensitive credentials and integration keys

• Access controls, authentication, and the principle of least privilege

• Regular updates, security assessments and monitoring

• Automated protection against bots, scanners and abusive traffic

• Incident detection, alerting and response procedures

We also design with privacy in mind from the start, considering it when a feature is first designed rather than bolting it on afterwards.

Even so, no method of sending information over the internet or storing it electronically is completely secure. We work hard to protect your information, but we cannot guarantee absolute security, and you send information to us at your own risk. If a breach happens that is likely to put your rights and freedoms at risk, we will notify the ICO and, where required, you.

15. Feedback and Testimonials

16. Changes to This Policy

We review this policy and update it when our services, our providers, or the law change. The "last updated" date at the top of this page always shows the current version.

Where a change makes a real difference to how we use your personal information, we will take reasonable steps to bring it to your attention. If you keep using our website and services after an update, that means you accept the revised policy.

17. Related Policies

Two other documents work with this one, and each covers its own ground so nothing is duplicated:

• Cookie Policy: what each cookie category does, which ones need consent, and how to change your choices.

• Terms of Service: the contract between us, covering services, payment, intellectual property, liability and governing law.