Last updated: 9 October 2026
This policy explains what personal information Slab Seven collects, why we collect it, how we look after it and what rights you have. We keep data collection to a minimum and only ask for what we need to reply to you or to work with you.
Who we are
Slab Seven is a website design and copywriting business run by Paul Croft, a sole trader based in Bristol, UK. For the purposes of UK data protection law, Paul Croft is the data controller for the personal information described in this policy.
If you have any questions about this policy or your information, email: privacy@slabseven.studio
The short version
We don’t use Google Analytics, advertising trackers or marketing cookies. We use Plausible, a privacy-focused analytics tool that doesn’t use cookies or collect personal information. The only personal information we hold is what you choose to give us, usually when you get in touch or become a client. We don’t sell your information and we never will.
Information we collect
When you contact us
If you use the contact form, we collect your name, email address, website address and your message. If you email us directly, we collect your email address and anything you include in your email.
When you become a client
If we work together, we’ll collect the information needed to run the project and get paid. This includes your contact details, business details, billing information and anything you share during the project, such as questionnaire answers, website content and login details for your hosting or website. We only ask for access we need and we recommend you change any shared passwords once the project ends.
When you visit the website
When you visit slabseven.studio, our hosting and security providers process technical information such as your IP address, browser type and the pages you request. This is needed to deliver the website to you and protect it from attacks and spam. We don’t use this information to identify you.
Analytics
We use Plausible Analytics to understand how people use the website, such as which pages are visited and where visitors come from. Plausible doesn’t use cookies, doesn’t track you across other websites and doesn’t collect personal information. Your IP address is never stored. Plausible uses it briefly to count unique visitors with a code that changes every day, so individual visitors can’t be identified or followed over time. All data is processed in the EU.
You can read more in Plausible’s own data policy at plausible.io/data-policy
Cookies
We don’t use cookies for analytics, advertising or tracking, so you won’t see a cookie banner on this website.
Our hosting and security providers may set strictly necessary cookies that help protect the website from malicious traffic. These don’t identify you and are exempt from consent rules because the website can’t work securely without them.
How we use your information
UK data protection law requires a lawful basis for each way we use personal information. These are the bases we rely on.
To reply to your enquiry. We use your details to answer your message and, if you ask, to discuss a project. Our lawful basis is legitimate interests, or taking steps at your request before entering into a contract.
To deliver a project. We use your information to plan, carry out and support the work you’ve hired us for. Our lawful basis is performance of a contract.
To run the business. We keep invoices and financial records because the law requires it. Our lawful basis is legal obligation.
To improve the website. We use anonymous Plausible data to see which content is useful. As this data contains no personal information, no lawful basis is needed.
We won’t add you to a mailing list or send you marketing emails unless you’ve asked us to.
Who we share your information with
We use a small number of trusted providers to run the business. They only process your information on our instructions and are required to keep it secure.
- Rocket.net hosts the website.
- Cloudflare manages our domains and helps protect the website from attacks.
- Google Workspace provides our business email and file storage.
- Brevo sends emails generated by the website, such as contact form notifications.
- Plausible Analytics provides privacy-friendly website statistics.
If a project needs specialist design or development, we may bring in a trusted freelancer. We’ll tell you beforehand and only share what they need to do the work.
We may also share information where the law requires it, for example with HMRC.
International transfers
Some of our providers, including Google, Cloudflare and Rocket.net, are based in the United States or process data outside the UK. Where this happens, we rely on the safeguards recognised under UK law, such as the UK–US Data Bridge or the International Data Transfer Addendum, to make sure your information receives the same level of protection.
How long we keep your information
Enquiries that don’t lead to a project are kept for up to two years, then deleted.
Client records, including contracts, invoices and project correspondence, are kept for six years after the project ends. This covers our legal obligations for tax and accounting.
Website access details you share during a project are deleted once the project ends, unless we’re providing ongoing support.
How we keep your information secure
We use reputable providers, strong unique passwords and two-factor authentication on the accounts that hold client information. Access is limited to Paul and, where needed, a freelancer working on your project. No system is completely secure, but we take reasonable steps to protect what you share with us.
Your rights
Under UK data protection law, you have the right to:
- ask for a copy of the personal information we hold about you
- ask us to correct information that’s wrong or incomplete
- ask us to delete your information
- ask us to limit how we use your information
- object to us using your information where we rely on legitimate interests
- ask us to transfer your information to another organisation in a usable format
Some rights only apply in certain circumstances. For example, we can’t delete invoices we’re legally required to keep.
Complaints
If you’re unhappy with how we’ve handled your information, please contact us first so we can try to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator. You can contact them at ico.org.uk or on 0303 123 1113.
Links to other websites
This website links to other websites, such as client projects. We’re not responsible for how other websites handle your information, so check their privacy policies when you visit them.
Changes to this policy
We’ll update this policy if our tools or practices change. The date at the top shows when it was last revised.
Contact
Paul Croft
Slab Seven
Bristol, United Kingdom
privacy@slabseven.studio