Privacy notice

Section 1Who is responsible for your information

Deftly decides how and why your personal information is used. In data protection language, we are the controller.

We do not have a separate data protection officer. Privacy questions go to hello@deftly.uk and are handled by us directly.

Section 2If we called you out of the blue, this is where we got your details

Most people first hear from us because we phoned them. You have not given us your details, so it is only fair that we tell you where they came from.

We build a list of UK trade businesses from information that is already published:

• Public business listings, mainly Google's business listings, which include a business name, address, phone number, website address and public rating.
• Business websites and public directory pages, where a business has published its own contact details.

We do not buy marketing lists from data brokers, and we do not take your details from anyone you have dealt with.

Why we are allowed to do this

Our lawful basis is legitimate interests. Our interest is finding trade businesses that do not have a decent website and offering to build one. We think that is a reasonable thing to do with information a business has itself put in the public domain, and it has a low impact on you: one phone call, which you can end in ten seconds.

If you disagree, you can tell us to stop and we will. See telling us to stop below.

Phone calls and the Do Not Call registers

The Telephone Preference Service and the Corporate Telephone Preference Service are the UK's official do-not-call registers. We use an outside screening service to check numbers against both, and we are working towards every number on our list being screened before anyone rings it. Not every number has been through that check yet.

If we ring you and your number is registered on either, tell us and we will record it against your number so that nobody at Deftly rings it again.

If we have not spoken to you yet, the only way we contact you is by phone. Once we have spoken, or once you have asked us to get in touch, we may also email or text you about your website and your enquiry. We do not send cold marketing emails, texts or WhatsApp messages to businesses we have not spoken to.

We record sales calls. The recording is how we make sure your website says what you actually told us on the phone, rather than what someone scribbled down, and how we check our own calls stay polite and honest. Ask us and we will tell you what we hold from any call with you.

Section 3What we collect, why, and what allows us to

If you are a lead we have not signed up yet

What: business name, trade, address or area, phone number, website address if you have one, a public rating, recordings of sales calls, and notes from any call, including whether you asked us not to call again.

Why: to decide who to contact, to call you, and to keep track of who has said no.

Lawful basis: legitimate interests, as explained above. For keeping a do-not-contact record, legal obligation, because the rules on marketing calls require us to honour it.

If we build you a preview or you become a customer

What: your name, business name, email address, phone number, business address, the services you offer, your prices and opening hours if you give them, any qualifications or accreditations you tell us about, photographs you give us, customer reviews and testimonials you give us, and anything else you ask us to put on the site.

Why: to build and run your website. Some of this ends up published on your own site, which is the point of it.

Lawful basis: performing our contract with you. For the preview stage, before there is a contract, legitimate interests in showing you what we can do.

Payments

What: your name, email address, billing address, the last four digits of your card, and your payment history. We never see or hold your full card number. That goes straight to Stripe.

Why: to take your subscription payment and to keep proper accounts.

Lawful basis: performing our contract, and legal obligation for the tax and accounting records.

Your domain name

What: nothing, while we are looking after the domain for you. We buy it in Deftly's name with Deftly's own contact details, so your name and address are not given to the registrar or the registry and do not appear on the public domain record.

If you ask us to put the domain in your name: we then have to give the registrar and the registry your name, address, email address and phone number, because a domain has to be registered to a named owner with real contact details. See the domain terms.

Lawful basis: performing our contract with you, and legal obligation, since the registry requires accurate owner details.

Emails we send you

What: your email address, and the emails themselves.

Why: to send you your preview link, tell you your site is ready, send login codes, tell you about a payment or a problem, and tell you about changes to the service. These are service emails, not marketing.

Lawful basis: performing our contract. If we ever want to email you about something new we are selling, we will rely on your consent or on the rules that let a business email an existing customer about similar things, and every such email will have an unsubscribe link.

If you ask us to ring you back

You give us your business name and a number. We only use the number to ring you about your website, and we keep the request so we can see who we owe a call.

When you start typing your business name we send what you have typed to Google so it can suggest matching listings. It goes through our own server, so Google is not told your IP address or anything else about you. If you pick one of the suggestions we keep the business name and address it showed you, and Google's reference number for that listing.

Lawful basis: for ringing you, that you asked us to. For the business details from Google, legitimate interests, as explained above.

Visiting deftly.uk

What: the standard information a web server records, such as your IP address, the pages you asked for and the time. Our hosting provider handles this.

Why: to serve the site and to keep it secure.

Lawful basis: legitimate interests in running a working, secure website.

Section 4Artificial intelligence, and what gets sent where

Some Deftly websites are written with the help of an AI service. We would rather say so plainly than bury it.

When we build a site that way, the business details you give us are sent to Anthropic, the company behind the Claude AI assistant, so that it can write the words for your website. That includes things like your business name, your trade, the area you cover, the services you offer, your phone number, and any reviews or testimonials you have given us to use.

Two honest points about this:

• Not every site is built this way. Some are assembled from our own fixed templates using the details you gave us, with no AI service involved at all.
• What gets sent is your business information, the kind of thing that is going to be published on your website anyway. We do not send payment details, and we do not send anything about your customers.

Anthropic acts as our supplier here and processes that information on our instructions. If you would rather your details were not sent to an AI service at all, tell us before we build your site and we will build it from templates instead.

Section 5Who else sees your information

We do not sell your information and we do not share it for anyone else's marketing. We do use suppliers to run the service. Each one only gets what it needs, and only to do a job for us. This is the full list.

• Stripe: takes your card payments and handles refunds.
• Vercel: hosts deftly.uk, our own systems, and your website. Also stores the photographs on your site.
• Supabase: the database holding our customer and contact records.
• Neon: the database holding the content of the websites we build.
• Resend: sends our automated emails, such as your preview link and your login codes.
• Google: provides our own email mailboxes, through Google Workspace, so any email between us and you sits there. Google's business listings are also one of the public sources we use to find trade businesses, as described above. One secondary page of our website still loads its typefaces from Google Fonts, which means Google receives the IP address of anyone who visits that page. If you ask us to ring you back, Google also receives the business name you type into that form, so it can suggest matching listings.
• Name.com: the domain registrar we buy your domain from. It receives your details only if you ask us to put the domain in your name.
• Nominet: the UK registry that runs .uk domain names. Owner details for a .uk domain are held by Nominet, and some of them appear on the public WHOIS record for the domain. While we hold the domain those are our details, not yours.
• Anthropic: writes website copy from your business details, where a site is built that way. See section 4.
• TPSCheck: checks phone numbers against the Telephone Preference Service and Corporate Telephone Preference Service registers, in batches, ahead of calling.

We may also share information where the law requires it, for example with HMRC, a regulator, or a court, and with our accountant or professional advisers where they need it.

Section 6Information going outside the UK

Several of the suppliers above are based in the United States, including Stripe, Vercel, Supabase, Neon, Resend, Google, Name.com and Anthropic. That means some of your information is stored or handled outside the UK.

UK law allows this as long as the information is properly protected. We rely on the standard safeguards these suppliers publish for UK and European customers: the UK Addendum to the standard contractual clauses, or the UK extension to the EU to US Data Privacy Framework where the supplier is certified under it.

If you want to see the safeguards for a particular supplier, email us and we will point you at them.

Section 7How long we keep things

Your preview link

Works for 7 days from when we send it

A preview you never took up

Deleted completely 60 days after the link expires

Details of a business we called that said no

12 months, then deleted

Your phone number on the do-not-contact list

Kept indefinitely, so we never call you again

Your website content after you cancel

90 days after your subscription ends, then deleted

Payment and accounting records

6 years, as UK tax law requires

Emails between us

3 years

On previews, to be precise: if we build you a preview and you never go ahead, the link stops working after 7 days, and the preview site and everything in it is deleted for good 60 days after that. So a preview nobody claims is gone completely within about ten weeks.

When a retention period ends we delete the information, or where deleting is not practical, we put it beyond ordinary use.

Section 8Your rights

You can ask us to do any of the following, free of charge. Email hello@deftly.uk and we will respond within one month.

• See what we hold. Ask for a copy of the personal information we have about you.
• Correct it. Tell us if anything is wrong or out of date and we will fix it.
• Delete it. Ask us to erase it. We can usually do this, though we have to keep payment records for six years and we have to keep your number on the do-not-contact list if you have asked us not to call.
• Restrict what we do with it. Ask us to pause using it while something is being sorted out.
• Take it with you. Ask for the information you gave us in a common file format so you can hand it to someone else.
• Tell us to stop. Object to us using your information on the basis of legitimate interests, including our cold calling. If you object to marketing, we stop. No arguments, no conditions.
• Withdraw consent at any time, where we relied on your consent for something.

We may need to check you are who you say you are before we act, particularly for a request to see or delete everything we hold.

Section 9Automated decisions

We do not make any decision about you purely by computer that has a legal or similarly significant effect on you. Software helps us decide which businesses to call and helps write website copy, but a person decides who we approach and a person handles anything to do with your account.

Section 10Cookies

We do count how many people visit this website, using analytics software we run on our own servers rather than a service like Google Analytics. It records the page visited, roughly where in the world the visit came from, and which site sent you, and nothing that identifies you personally. It sets no cookies, it follows nobody between websites, and the figures stay with us rather than being handed to an advertising company.

We do not use advertising cookies, tracking cookies, or pixels from social networks. There is no cookie banner on this site because there is nothing to ask you to agree to.

The only cookies involved are the strictly necessary ones: the small files that keep you logged in to your account area and that let a card payment complete. Those do not need your consent under UK rules, and they are not used to track you around the internet.

Our main pages serve their typefaces from our own website. One secondary page still loads its typefaces from Google Fonts, which means Google receives your IP address if you visit it. That is not a cookie and we do not use it for anything, but you should know it happens.

Section 11Keeping your information safe

Our systems require a login, information is encrypted when it travels across the internet, and access to customer records is limited to the people who need it. Any contact details we hold for a domain transfer are encrypted where we store them.

We are not going to claim any certification or security standard we do not hold. If we ever suffer a breach that puts your rights at risk, we will tell you and we will tell the Information Commissioner, as the law requires.

Section 12Children

Our service is for businesses. It is not for under-18s and we do not knowingly collect information about children.

Section 13If you want to complain

Please tell us first: hello@deftly.uk. We would rather put it right ourselves.

You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at any time.

Section 14Changes to this notice

We will update this page when what we do changes, for example if we add a new supplier or start recording calls. The date at the top always shows when it last changed. If a change matters to you, we will email you about it.