Privacy Policy

Who we are

GBTN is a web design studio. This policy covers gbtn.studio — the website you are on now.

We also send a small volume of business-to-business email from a separate domain, gbtnstudio.com. That is covered in full on how we source business contact information, including how to be removed from it permanently.

What the contact form collects

Four things, all of them typed by you: your name, your email address, a description of what you are building, and roughly when you want to start. Nothing else is asked for and nothing else is captured.

There is also a hidden field that must stay empty. It is a spam trap — automated submitters fill in every input they find, so anything that fills that one is discarded. A person never sees it and never fills it.

What happens to a submission

It is checked for obvious problems, then forwarded straight to our inbox by Resend, our email delivery provider. That is the whole journey.

The site has no database and no CRM. Your submission is not written to disk, not saved to a record, and not added to any list. The only copy that exists is the email sitting in our inbox — the same as if you had written to us directly.

To keep the form from being used to send bulk mail, the server counts submissions per IP address and stops after five in an hour. The count is a single number held in a key-value store against your IP address, and it deletes itself an hour after the first submission in the window. It records nothing about what you sent — only how many times. Until recently that count lived in memory on each server instance, which meant the real cap was five per instance rather than five; it is now one shared count, which is what this paragraph always said.

One honest exception: if our email provider is ever misconfigured, the server writes a warning into its own log containing your name, your address and the first eighty characters of your message, so that an enquiry cannot be silently swallowed. It is a failure path, not the normal one, and it exists so that we notice rather than lose you.

Analytics and cookies

There are none. No Google Analytics, no Vercel Analytics, no Plausible, no Fathom, no advertising pixel, no cross-site tracking of any kind. We do not know how many people visited this page and we have not built anything that would tell us.

The site sets no cookies. Not for tracking, not for advertising, not for preferences. There is no consent banner because there is nothing to consent to, and putting one up anyway would be theatre.

It also stores nothing on your device by any other route: no local storage, no session storage, no client-side database. This paragraph used to disclose one item — a timestamp under the name gbtn-curtain-full-at, written the first time you saw the opening animation so it would not replay. The opening animation has been removed, and the timestamp with it. Verified by loading every page in a clean browser and reading back what was left behind: nothing, on any of them.

Because there is nothing to opt out of, there is nothing for a Global Privacy Control signal to switch off. We do not sell or share personal information, we do not run cross-context behavioural advertising, and we have no tracker to disable — so a GPC header changes nothing about how this site treats you. That is the honest answer rather than a compliance badge: the signal is respected by there being nothing for it to act on.

Who else touches it

Only the providers that make the site and our correspondence work, and only for that purpose:

Vercel hosts the site and, as part of running any web platform, keeps standard request logs. Resend delivers the form submission to us. Google Workspace is the mailbox behind info@gbtn.studio, so correspondence with us lives there. Cloudflare handles DNS for the domain.

All four are US-based companies. If you are writing from the EU or UK, that means your message reaches the United States — which is true of most email, but worth saying rather than leaving you to work out.

We do not sell your information, we do not rent it, and we do not share it with anyone outside that list. There is no advertising network involved because there is no advertising.

How long we keep it

Because the site stores nothing, this is really a question about our inbox. We keep enquiry correspondence for as long as it is useful — to answer you, to do the work, and to meet the ordinary accounting obligations that follow paid work — and then we delete it.

You can ask us to delete it sooner, and we will, without asking why.

Your rights

You can ask what we hold about you, ask us to correct it, ask us to delete it, or object to us holding it at all. Email us and say which. There is no form to fill in and no account to log into.

We aim to answer within seven days. Where the law sets a longer deadline — a month, under GDPR — treat seven days as what we are actually trying to do.

Security

The site is served over HTTPS only, with strict transport security set so a browser will not fall back to an unencrypted connection.

Beyond that: a strict content security policy issued fresh on every request, which blocks injected scripts; framing is refused outright, so the site cannot be embedded and clickjacked; the referrer sent to other sites is trimmed to our domain and never includes the page you were on; and camera, microphone, geolocation and interest-based advertising APIs are switched off at the browser level.

None of that makes any system perfect. It does mean the obvious routes are closed.

Changes to this policy

If we change it, the date at the top changes with it. If a change is material — if we start collecting something we did not collect before — it will be stated plainly here rather than buried.