Privacy notice

Who is responsible for your information

Dalaric Limited, registered in England and Wales, company number 06995683. Registered office: 4 South Terrace, South Street, Dorchester, Dorset, DT1 1DE. I am the data controller and the person you would be dealing with either way.

Questions about anything here go to info@dalaric.com.

Dalaric Limited is registered with the Information Commissioner's Office, reference ZA535738. That register is public, so you can check it rather than take my word for it.

What this site collects

Nothing about you personally until you fill in the form on the contact page. Visits are counted, as totals, and the section on counting visits says exactly what that involves and how to opt out. There is no tracking pixel, no advertising tag, no embedded video and no social widget on any page.

When you do submit the form, it sends me:

• Your name
• Your company, if you give one
• Your email address
• Your phone number, if you give one
• What you wrote about your situation
• How you found me, if you say

The form also carries two things that are about the form rather than about you: a hidden field that a person never sees and a real submission leaves empty, and a signed token that records how long the page had been open. Both exist to reject automated submissions and neither identifies anybody.

What happens to it

It is sent to me as an email and rests in my mailbox. If it turns into real work, I move it into a ticket, which is then the record. There is no database behind this site and nothing is written to one. If sending fails, the reason is logged and nothing about who sent it is.

Why I am allowed to hold it

Legitimate interests, which is Article 6(1)(f). You got in touch, you expect a reply, and the information is what you chose to type. The assessment behind that choice is written down, dated and internal rather than published, which is what the Information Commissioner expects of it.

Legitimate interests is the honest fit rather than the flattering one. The obvious alternative, steps taken before entering a contract, collapses for every enquiry that was only ever a question, and most of them are.

An enquiry is not marketing and does not put you on a list. You will not get a newsletter because you asked me something.

How long it is kept

An enquiry that does not become work is kept for twelve months from your last message, then deleted. That is long enough to recognise you if you come back, and to answer a complaint about how the enquiry itself was handled.

An enquiry that becomes work stops being an enquiry. It joins the record for that work and is kept for the length of the relationship plus six years from the final invoice. Six years is not a number I picked: it is the limitation period for a simple contract and it sits comfortably with what HMRC expects of business records.

At the end it is deleted from the mailbox, and from the ticket system if it went into one, rather than moved somewhere quieter. Copies of it persist in those providers' backups and age out on their cycles rather than on mine. That is true of every system of this kind, and a notice that implies otherwise is simply inaccurate.

The form for building your website

If we agree that I will build you a website, I send you a link to a form at start.dalaric.com. It is not on this site, it is not linked from anywhere, and nobody reaches it without a link I sent. It asks for what the website needs, and you can come back to it as often as you like, adding photographs, your logo and any documents as you go.

Depending on what you choose to fill in, it collects:

• Your business name, what you do, and what sort of business it is, with its registered name and company number if it has them
• Where you are based and the area you cover, your address, phone number and email address, and where enquiries from the website should go
• Your services, any prices and your opening hours
• Your website now, the address you want, the pages you picture and any sites you like
• Your registrations, qualifications and insurance, anything customers have said about you, and your social media links
• Anything else you choose to tell me
• Up to thirty photographs and a logo
• Up to ten documents, such as a price list or a leaflet, as PDF, Word, Excel or PowerPoint files

Some of that can be about other people: a customer you quote, someone in a photograph, or someone named in a document. Please only send what they are happy to see on your website.

The link is the key to your form. Anyone holding it can open the form, so keep the emails it arrives in to yourself. If you lose it, the form can email it to your address again. If you think someone else has it, tell me and I will delete that form and send you a fresh one.

Your photographs

Before a photograph is stored, it is made into a new copy, and everything your camera wrote into it is left behind: where it was taken, when, and on what. That happens on Cloudflare's servers whatever your phone does first, so it does not depend on your settings, and a photograph taken in an iPhone's own format is turned into an ordinary JPEG at the same time. Photographs are kept at up to 3,000 pixels along the longest side, which is plenty for a website. A logo is treated the same way, except a logo sent as an SVG file, which is kept exactly as you sent it. Only the new copy is kept.

Your documents

A document is kept exactly as you sent it. There is no way to make a clean copy of one the way there is for a photograph, so whatever the file carries comes with it. A Word, Excel or PowerPoint file can hold the name of whoever wrote it, when it was written and changed, comments, and earlier wording kept as tracked changes. If you would rather I did not see those, save the document as a PDF, or remove them in Office first, before you send it. Files with macros in them, and the older .doc, .xls and .ppt files, are refused, because they can carry programs that run when they are opened.

Where it is kept

• Your answers are kept in the database on Dalaric's own server, which DigitalOcean runs in London.
• Your photographs, logo and documents are kept in Cloudflare's storage, which I have asked to keep them in Western Europe. Cloudflare treats that as a preference rather than a promise, so the table below describes it like the rest of Cloudflare.
• The emails about your form, the link and the note saying your details arrived, are sent through Postmark. When you finish, I get an email saying so, which lands in the same mailbox as an enquiry.
• The server's log records each request it receives, including the address it came from, and keeps that for fourteen days.

The form stores nothing on your device: no cookie, no local storage and no session storage. The link carries everything it needs.

Why I am allowed to hold it

Steps taken at your request before a contract, which is Article 6(1)(b). Nobody gets this form without having asked me for a website, so the basis that does not fit an enquiry is the honest fit here.

How long it is kept

One hundred and eighty days from the last time you saved anything, finishing included. Then your answers, photographs, logo and documents are deleted together, automatically, without anyone having to remember. Cloudflare's storage also deletes any file a year after it was uploaded, as a second lock in case the first ever fails.

A copy of the database is taken each time the server's software is updated, so that a failed update can be undone. Those copies are kept on the same server for thirty days and then deleted. DigitalOcean also takes a copy of the whole server once a week, in case the server itself is lost, and keeps each one for twenty eight days. Put together, your answers can outlast their deletion by up to fifty eight days: thirty in the server's own copies, and twenty eight more if a weekly copy of the server happens to catch one of those on its last day. Nobody reads either kind unless something has gone wrong.

If the website goes ahead, what I take from the form to build it becomes part of the record for that work, and is kept the way the section above says. You can ask me to delete everything sooner, whether or not the website goes ahead, and one step removes your answers and every file together.

Your account at my.dalaric.com

If you are a client, I can open you an account at my.dalaric.com, where you sign in to see what you have with me, what it costs and when it renews, and to send me a message. It is not on this site, and nobody has one until I open it for them.

What it shows you

What the account shows comes from my record of your work: your name or your business's name, your contact email address, phone number and postal address, your websites, domains and email, and what each one costs. That record is kept in a private repository on GitHub, and the account's server keeps a copy of it so it can show it to you. When the record changes, the copy follows within a few minutes.

What signing in keeps

• The address you sign in with.
• Your password, if you set one, kept only as a scrambled version that cannot be turned back into the password.
• Your passkeys, if you add any. A passkey leaves only its public half with me, which is no use to anybody without the device that holds the other half. Beside it I keep a rough name for the kind of device, such as "an iPhone", and when it was last used.
• The key for an authenticator app, if you set one up, kept encrypted.
• The codes and links I email you, kept only as scrambled versions, never as the code itself. A code works for fifteen minutes. A link to reset your password works for an hour, a link to confirm a new address for a day, and the first link that opens your account for seven days.
• The devices you have asked me to remember, as a scrambled copy of the cookie described below, with when each was first and last used.
• While you are signed in, the server keeps your session, which includes the address your connection came from and the identifier your browser sends saying what it is. A session is deleted once it has been idle for two hours, the next time the server tidies up.
• A note of each change to how you sign in, such as adding a passkey or changing your password: which account, what kind of change and when. It holds no address, no device and nothing you typed. Ordinary sign ins are not noted.
• A count of recent tries, so that somebody guessing at your account is made to wait. The count is kept against a scrambled form of your address, your account or the address your connection came from, and it runs out after somewhere between a minute and a day, depending on what is being counted.

To help you, I may look at your account as you see it. I cannot change anything while I do, and each time is noted with the other security notes.

The emails it sends

The codes and links that let you sign in are emailed through Postmark. Until each is sent, your address and the code are kept sealed, so that the server that answers your browser cannot read them back; once Postmark has it, the sealed copy is blanked, and what is left says only that a message of that kind went to that account, and when, until it is deleted after ninety days. A message you send me from the account goes through Postmark the same way and reaches my mailbox as an email, carrying your account name and sign in address so I can reply. If it turns into real work, I move it into a ticket and tell you so. It is not kept by the account itself.

What it stores on your device

One cookie, and a second only if you ask for it. Both are set by my.dalaric.com itself, both readable only by it, and both sent only over an encrypted connection. Nothing else, and no other company's script is loaded on any account page.

• One keeps you signed in. It holds a random identifier for your session and goes when you close your browser.
• One remembers your device, if you tick the box asking it to when you sign in with a code I have emailed you. A remembered device needs only your password, rather than a code every time. It holds a random value and lasts a year. The box starts unticked, so leave it that way on a computer you share. Signing out removes it.

Why I am allowed to hold it

Performance of our contract, which is Article 6(1)(b), for the account itself and for signing you in. The account is part of the service I provide to you, and it cannot show you what is yours without knowing it is you.

Legitimate interests, which is Article 6(1)(f), for the count of recent tries, the notes of changes to how you sign in, the note that an account was closed, and the server's log. They are there to keep accounts safe from people who are not you, and some of them are about people who are not clients at all, such as somebody guessing at an account, so a contract cannot be the basis for them. You can object, but I cannot run accounts safely without them.

How long it is kept

Your sign in address, password, passkeys and authenticator key are kept for as long as your account is open. Everything else goes by itself, checked every night:

• A code or link is deleted thirty days after it stops working. The month is only so that a link opened late can say it has been used, rather than that it never existed.
• A device you signed in from is deleted when its cookie's year is up, or sooner if you sign out on it.
• A session is deleted once it has been idle for two hours.
• A note of a change to how you sign in is deleted after twelve months.
• What is left of an email the account sent, or a message you sent me from it, is deleted after ninety days. That is long enough to trace a code that never arrived.
• A count of recent tries is deleted once it has run out, which is a day at most.

When our work together ends, I close your account. That deletes it, and with it your address, password, passkeys, authenticator key, codes, links and remembered devices, and ends any session. One note that it was closed is kept, and goes after twelve months like the others.

Your record of work is not part of the account, and is kept as an enquiry that becomes work is, above: for the length of our relationship plus six years from the final invoice.

The database is copied in the same way as for the form for building your website, so anything deleted can outlast its deletion by up to fifty eight days in those copies. The server's log keeps the address each request came from for fourteen days.

Who else sees it

Four companies touch an enquiry between your keyboard and my mailbox, a fifth runs the server behind the form for building your website and your account, a sixth keeps my record of a client's work, and two more are used only for letters to businesses that have not contacted me. These are all eight. The law would let me describe them by category. Naming them costs nothing I value and a page arguing that nothing here is hidden cannot then hide its own supply chain.

Yes, some of it leaves the UK. That is unavoidable for a business this size and it is not a problem in itself, provided each transfer has a lawful route and that route is stated. Every position below was read from that supplier's own current document rather than remembered, and each row says when.

One thing worth knowing about addresses. The support system answers on support.dalaric.com. It carries my name and it is not my software. A Dalaric address does not mean a Dalaric system, and you should not have to guess which is which.

The two third parties on this site

Both are Cloudflare. One is the check on the contact form and the other counts visits.

The check on the contact form

The contact page carries a Cloudflare Turnstile widget, which is what establishes that a form submission came from a person. It appears on that one page and is not present anywhere else.

Loading it means your browser makes a request to Cloudflare, which necessarily means Cloudflare receives your IP address, as any server does when you connect to it. Checked on the running site: it stores nothing on your device. No cookie, no local storage, no session storage. The cookies page sets out how to confirm that yourself.

Cloudflare wears two hats here and only one of them is mine. As my supplier it runs the check on my instructions. It also uses the same signals to improve the check for everybody who uses it, and that second part is its own decision made for its own reasons, not something I asked for or can switch off. Describing Cloudflare only as a supplier would quietly leave that out.

What the check collects, in Cloudflare's own words: your IP address, a fingerprint of how your browser negotiates its connection, the identifier your browser sends saying what it is, and the key for this site and the address it was loaded from.

Cloudflare publishes no retention period for any of it. So there is no figure here, rather than a figure I cannot show you the source of. Read from its Turnstile privacy addendum, last updated 18 June 2025, and its general privacy documentation is at cloudflare.com/privacypolicy if you would rather check than take my word.

Counting visits

Every page counts visits with Cloudflare Web Analytics. What I see are totals: how many visits each page had, which sites sent people here, roughly which countries they came from, which browsers and kinds of device they used, and how quickly pages loaded. I do not see who you are, and Cloudflare says the product "does not collect or use your visitors' personal data".

To do that, your browser loads a small script from Cloudflare and sends it a short report when the page has loaded and again when you leave. Cloudflare receives your IP address, as with any connection, and it does not record anything after a question mark in a page address. It keeps the detailed reports for seven days and then reduces them to a sample of around one in ten. Nothing is stored on your device, which is why there is still no banner.

Why: knowing which pages are read and which are slow is how the site gets better, and the law allows counting of this kind for statistics provided you are told about it and can say no simply and for free. Both are on this page.

How to say no. If your browser sends Global Privacy Control or Do Not Track, the counting script is never loaded. Firefox sends Global Privacy Control if you tick it under Privacy and Security in its settings, and Brave sends it already. Chrome and Edge can send Do Not Track from their privacy settings. Safari offers neither, so there a content blocker that blocks cloudflareinsights.com does the same job, and so does turning JavaScript off. None of this stores anything on your device, and none of it changes how the rest of the site works.

Read from Cloudflare's Web Analytics documentation and product page on 4 October 2026. Cloudflare's own privacy policy is at cloudflare.com/privacypolicy.

Other ways you might contact me

Email, phone, WhatsApp and a booked video call all reach me, and each carries whatever you choose to put in it. Anything that turns into real work is moved into a ticket so that it is written down, and you are told when that happens.

WhatsApp

WhatsApp is Meta's service and not mine. What you write is encrypted on its way, but Meta still holds the fact that we spoke, when, and the numbers involved. None of that is under my control or covered by any agreement between you and me. I use WhatsApp Business, where the company I contract with is WhatsApp Ireland Limited and I am the one responsible for what is done with your information. Read from their business terms on 2 September 2026.

So do not send me anything confidential over WhatsApp. Use the support address instead: it raises a ticket, the ticket is the record, and having a record is the whole point.

Booking a call

The booking page is Zoho Bookings, at dalaric.zohobookings.eu. It takes your name and email address, whether you would rather I phoned, and your phone number, your company and whatever you write in the box if you choose to give them. The booking is kept by Zoho in Europe, as the table above sets out. The page sets three cookies of Zoho's own, and the cookies page lists them.

An advisory session is paid by card when you book it, on a payment page from Zoho that passes your card to Stripe, or to PayPal if you choose that instead. I see that you paid and how much, never the card.

The call itself is on Microsoft Teams, or the phone if you would rather.

If I write to you first

Sometimes I write by post to a business that has not contacted me, because it looks as though it could use a website: it has none, or the one it has has stopped doing its job. If you have had a letter from me, this is the section about you.

Where your details came from

Only from places your business has made public: its Google Maps listing, its own website, and for a limited company, Companies House. From those I take the business name, the name of whoever runs it if that is shown, the postal address, the phone number and opening hours, what the business does, and the address of its website if it has one.

I use them to write the letter and to make the picture of a home page that comes with it. The picture shows nothing your listing does not already show.

Why I am allowed to

Legitimate interests, Article 6(1)(f), the same basis as an enquiry. The law accepts that telling a business about something it may want can be a legitimate interest, and a letter is the least intrusive way to do it: you can read it or bin it, and nothing happens either way. As with enquiries, the assessment behind that is written down, dated and internal.

It is only ever a letter. I do not email, text, ring or message a business that has not been in touch with me first.

How long it is kept

• The picture, and my note of why I wrote, are deleted six months after the letter if you do not reply.
• The business name, its postal address and the date I wrote stay on a list of businesses I have already written to, for as long as I send letters at all. That list is what stops me writing to you twice. You can ask me to delete your line on it, but then nothing would stop me writing to you again by mistake, so I will check that is what you want first.
• If you reply, it becomes an enquiry, and what this notice says about keeping an enquiry takes over.

The list and the pictures are kept on my own computer, with a backup copy held by Tresorit, which is in the table above.

Saying no

Tell me to stop and I will, and you do not need a reason. For marketing that right is absolute, which is not true of most of the rights below. Email info@dalaric.com or write to the registered office. If you simply do nothing, I will not write again either.

Your rights

Under UK data protection law you can ask me to give you a copy of what I hold about you, correct it if it is wrong, delete it, restrict what I do with it, hand it over in a portable form, or object to my handling it at all. Ask at info@dalaric.com and you will get an answer rather than a form to fill in.

If you think I have handled your information badly, you can complain to the Information Commissioner's Office at ico.org.uk. You are entitled to do that whether or not you raise it with me first, though I would rather you gave me the chance to put it right.

I acknowledge a request within five working days and answer it in full within a month, which is the limit the law sets. That limit can be extended by a further two months where a request is genuinely complicated, and if that ever applies to yours I will tell you inside the first month and say why.

I am not going to promise seventy two hours on a public page. One holiday would make it false, and a commitment I can always keep is worth more than a faster one I cannot.

Client systems, which are a separate matter

When I work on your infrastructure I may have access to systems holding your customers' information. That relationship is governed by the agreement covering that work rather than by this notice, which is about the information you send me through this site.

Where that work means handling information about your customers, a data processing agreement forms part of the agreement for it as standard, rather than being something to ask for, negotiate or pay extra for. The law requires it in writing and it protects you rather than me, so there is nothing to argue about.

Changes

The version you are reading took effect on the day this site was published, and the list below says what has changed since then, most recent first. This site is kept in version control, so that history exists whether or not the list does; the list is only there to save you reading a repository.

If something changes what actually happens to your information, I will email clients about it. A corrected typo does not get an email. Saying where that line falls is what makes the promise worth anything.

• 24 October 2026. A section on your account at my.dalaric.com: what it shows, what signing in keeps, the cookies it sets and the emails it sends. GitHub added to the table, because it keeps the record the account shows, and Postmark and DigitalOcean's rows now say what they do for the account.
• 20 October 2026. Corrected: an enquiry from the contact form rests in my mailbox, and goes into a ticket only if it turns into real work. The page said every enquiry became a ticket, which was not what happened. Nothing about what is kept, or for how long, has changed.
• 6 October 2026. A section for businesses I write to before they have contacted me, and Anthropic and Tresorit added to the table, for those letters only.
• 5 October 2026. The form for building your website takes documents as well as photographs, and the section says what a document carries with it. Photographs in an iPhone's own format are turned into ordinary JPEGs.
• 5 October 2026. A section on the form for building your website: what it collects, where it is kept and for how long. DigitalOcean added to the table, because it runs the server behind the form.
• 2 September 2026. The ten open questions on this notice were settled, and every supplier position in it was read from that supplier's own current document rather than assumed.