Privacy Policy

Who we're

GBTN is a web design studio. This policy covers gbtn.studio, the website you're on now.

We also send a small volume of business-to-business email from a separate domain, gbtnstudio.com. That's covered in full on how we source business contact information, including how to be removed from it permanently.

What the contact form collects

Four things, all of them typed by you: your name, your email address, a description of what you're building, and roughly when you want to start. Nothing else is asked for and nothing else is captured.

There's also a hidden field that must stay empty. It's a spam trap. Automated submitters fill in every input they find, so anything that fills that one is discarded. A person never sees it and never fills it.

What happens to a submission

It's checked for obvious problems, then forwarded straight to our inbox by Resend, our email delivery provider. That's the whole journey.

The site has no database and no CRM. Your submission isn't written to disk, not saved to a record, and not added to any list. The only copy that exists is the email sitting in our inbox, the same as if you had written to us directly.

To keep the form from being used to send bulk mail, the server counts submissions per IP address and stops after five in an hour. The count is a single number held in a key-value store against your IP address, and it deletes itself an hour after the first submission in the window. It records nothing about what you sent, only how many times. Until recently that count lived in memory on each server instance, which meant the real cap was five per instance rather than five; it's now one shared count, which is what this paragraph always said.

One honest exception: if our email provider is ever misconfigured, the server writes a warning into its own log containing your name, your address and the first eighty characters of your message, so that an enquiry can't be silently swallowed. It's a failure path, not the normal one, and it exists so that we notice rather than lose you.

Analytics and cookies

There are none. No Google Analytics, no Vercel Analytics, no Plausible, no Fathom, no advertising pixel, no cross-site tracking of any kind. We don't know how many people visited this page and we haven't built anything that would tell us.

The site sets no cookies. Not for tracking, not for advertising, not for preferences. There's no consent banner because there's nothing to consent to, and putting one up anyway would be theatre.

It also stores nothing on your device by any other route: no local storage, no session storage, no client-side database. This paragraph used to disclose one item: a timestamp under the name gbtn-curtain-full-at, written the first time you saw the opening animation so it wouldn't replay. The opening animation has been removed, and the timestamp with it. Verified by loading every page in a clean browser and reading back what was left behind: nothing, on any of them.

Because there's nothing to opt out of, there's nothing for a Global Privacy Control signal to switch off. We don't sell or share personal information, we don't run cross-context behavioural advertising, and we have no tracker to disable, so a GPC header changes nothing about how this site treats you. That's the honest answer rather than a compliance badge: the signal is respected by there being nothing for it to act on.

Who else touches it

Only the providers that make the site and our correspondence work, and only for that purpose:

Vercel hosts the site and, as part of running any web platform, keeps standard request logs. Resend delivers the form submission to us. Google Workspace is the mailbox behind info@gbtn.studio, so correspondence with us lives there. Cloudflare handles DNS for the domain.

All four are US-based companies. If you're writing from the EU or UK, that means your message reaches the United States, which is true of most email but worth saying rather than leaving you to work out.

We don't sell your information, we don't rent it, and we don't share it with anyone outside that list. There's no advertising network involved because there's no advertising.

How long we keep it

Because the site stores nothing, this is really a question about our inbox. We keep enquiry correspondence for as long as it is useful, which means long enough to answer you, to do the work, and to meet the ordinary accounting obligations that follow paid work. Then we delete it.

You can ask us to delete it sooner, and we'll, without asking why.

Your rights

You can ask what we hold about you, ask us to correct it, ask us to delete it, or object to us holding it at all. Email us and say which. There's no form to fill in and no account to log into.

We aim to answer within seven days. Where the law sets a longer deadline, a month under GDPR, treat seven days as what we're actually trying to do.

Security

The site is served over HTTPS only, with strict transport security set so a browser won't fall back to an unencrypted connection.

Beyond that: a strict content security policy issued fresh on every request, which blocks injected scripts; framing is refused outright, so the site can't be embedded and clickjacked; the referrer sent to other sites is trimmed to our domain and never includes the page you were on; and camera, microphone, geolocation and interest-based advertising APIs are switched off at the browser level.

None of that makes any system perfect. It does mean the obvious routes are closed.

Changes to this policy

If we change it, the date at the top changes with it. If a change is material, meaning we start collecting something we didn't collect before, it will be stated plainly here rather than buried.