Privacy

This site runs Google Analytics. It sets two first-party cookies and tells Google which pages you opened, which page sent you here, roughly where you are from your IP address, and what browser and device you used. Google states that GA4 does not retain IP addresses once it has derived that location from them.

This site also runs Microsoft Clarity, and that is the one worth reading closely, because it does more than count. Clarity replays the session: how the pointer moved, how far down each page was scrolled, what was clicked or tapped, and which pages were opened in what order. What Microsoft receives is a reconstruction of this page and of what happened on it — not a recording of your screen, not your camera or microphone, and nothing outside this browser tab. It sets two first-party cookies, and it is told roughly the same broad things Google is: country from your IP address, browser, and device.

Why a studio this size records anything at all: it is the only honest way to learn that the pricing section gets abandoned halfway down, or that a button people keep clicking twice looks broken to them. There is no login on this site, no basket and no form, so there is nothing here for you to type that it could capture.

There is also Google Tag Manager on the page, which is a different sort of thing from the others and worth keeping separate from them. It measures nothing at all by itself. It is a container: a small script that loads whatever we have configured for it, so that what this site measures can be changed without rebuilding and redeploying the site. It is empty today, and while it is empty it collects nothing and sets no cookies of its own. What it does mean is that this page can gain a script without a code change, which is why the promise at the end of the cookies page matters more than it used to. One small part of it, a hidden frame, loads even for visitors who have switched JavaScript off entirely; blocking the domain stops that too.

Cloudflare, which hosts and serves this site, runs its own analytics from the page as well. That one sets no cookies and writes nothing to your device — it counts page views, referrers, countries, and how quickly pages actually loaded.

One consequence of Clarity being a Microsoft product is worth naming rather than leaving for you to find. On load it exchanges an identifier with Microsoft's own domains — the cookie called MUID, set on bing.com by Microsoft and not by us. We run no ads, we never see that identifier, and nothing about you comes back to us through it, but it belongs to Microsoft's advertising side rather than to this site, and it is the one thing on this page that reaches past it. Blocking third-party cookies stops it, as does any content blocker.

What has not changed: we run no advertising or marketing pixels of our own, and nothing is sold or handed to data brokers. The fonts are still served from this domain rather than a font CDN, and every image and video is local.

There is no consent banner. The honest reason is that we would rather not put one between you and the page, and that what these tools measure is how the pages are read rather than who is reading them. Session replay is the part of that worth stating plainly instead of filing quietly under analytics, which is why it has a paragraph of its own above. That is a choice rather than a rule, and you can override it: any content blocker stops all four, Google publishes an opt-out extension at tools.google.com/dlpage/gaoptout, and nothing on this site needs any of those scripts to work.

Our hosting provider keeps standard server logs, which typically include IP address, browser type and the pages requested. Those are used to keep the site running and secure, and are not combined with anything else or used to profile you.

Everything we hold about you, you sent us. When you message on WhatsApp or by email we keep that conversation, your name and contact details, and whatever you tell us about your business so we can quote and build.

During a project we also hold the material you send for the site — text, photographs, menus, logos, prices, and any account access you choose to share with us.

We do not buy contact lists, and we do not collect anything about you from anywhere else.

To answer you, to quote, to build and launch your site, and to support it afterwards if you are on Care. That is the whole list.

We do not sell your information, rent it, or share it for anyone else's marketing. We will not add you to a mailing list you did not ask for.

A small number of suppliers necessarily process some of it: Cloudflare, which hosts and serves the site and runs the cookieless analytics on it; Google and Microsoft, which receive the analytics and the session replays described above; the domain registrar; our email provider; and WhatsApp if that is how you contact us. Each holds only what it needs to do its job.

Where your own domain and hosting are registered in your name, those accounts are yours and the provider's terms apply to you directly.

[[ Name the specific hosting, registrar and email providers here before launch. ]]

Project files and correspondence are kept while we work together and for a reasonable period afterwards, so we can pick a project back up or answer a question about what was built.

Ask us to delete what we hold and we will, other than anything we are required to keep for tax or legal reasons.

You can ask what we hold, ask for a copy, ask us to correct it, or ask us to delete it. Send the request to hello@theaurenstudio.com and we will deal with it without charging you for it.

We handle personal data in line with the data protection law that applies to us. If you believe we have got something wrong, tell us first — we would rather fix it than have you escalate it, but you are entitled to complain to the relevant authority either way.

Questions about any of this go to hello@theaurenstudio.com and get a reply from a person, not a ticket queue.