Privacy notice

1.1Analytics. We run our own analytics on ajbury.com and dashboards.ajbury.com. It is cookieless: no cookies, no local storage, nothing is written to your device, and no consent banner is needed. It records pages viewed, clicks, scroll depth, referring links, coarse device and browser type, and the country your connection appears to come from. Sessions are identified by a salted server-side hash that is not linked to your name.

1.2Session replay. To see where pages confuse people we record how the page was used (mouse movement, scrolling, clicks, and what appeared on screen). Text you type into form fields is masked in these recordings. Recordings are kept for no longer than 12 months.

1.3Chat. The BuryAI chat on the site sends what you type to our own relay and to an AI model provider to produce an answer. Transcripts are kept alongside the session so we can improve the answers and follow up if you ask us to. Do not type card numbers, passwords or sensitive personal information into it.

1.4Contact and booking forms. What you enter (name, email, company, message, and a chosen time if you book one) is stored in our private enquiry system and used to reply to you. If you tag an enquiry with a link we sent you, we record which link it was so we know what worked.

1.5Checkout and website plans. Website plans are paid through Stripe. Stripe collects and holds your card details; we never see them. We receive your name, email, billing address where your wallet supplies one, business name, the plan you chose and the subscription status. The answers you give in the onboarding brief, including unfinished drafts, are stored so we can build your site and so you can carry on from any device. When you first pay we create an account for you at login.ajbury.com, our client desk; it holds your plan, build stage, brief and support tickets.

1.6Service emails. After you buy a website plan we send the emails needed to run it: payment confirmation and monthly receipts, payment problems and retry notices, requests to authenticate a payment, onboarding reminders until your brief is complete, sign-in and password links for login.ajbury.com, build progress, and cancellation, refund and plan-ended notices. They come from noreply@ajbury.com and replies reach alex@ajbury.com. They contain no tracking pixels or tracked links. Reminders can be stopped with the link in each one; receipts and payment notices cannot, because they are part of running your plan. We never send marketing to plan customers. Links in these emails carry a short code that identifies your plan; our website removes it from the page address before analytics run, and it is not recorded.

2.1What we collect. For companies we think we can help, we hold the registered name, company number, registered office, trade and incorporation date (from the Companies House public register), what we could see of the company's website, and a business email address for a director or a general mailbox on the company's own domain, found on the company's website or through an email-finding service. Where an address names a person, that name and work address are personal data. We may also note public information such as a job advert or a grant or contract award that made the company relevant.

2.2Who we write to. Only limited companies and LLPs, at addresses on their own domain. We do not send marketing to personal email accounts, sole traders or partnerships. We never make cold telephone calls: that is a written policy of the company.

2.3Why we may do this. Our lawful basis is legitimate interests: telling a business about a relevant service, in a way that is easy to refuse. We have recorded an assessment of this balance and review it every six months. The Privacy and Electronic Communications Regulations allow business-to-business email of this kind provided the sender is identified and an opt-out is honoured, which every email carries.

2.4How to stop it. Reply with anything like "no thanks" or "unsubscribe", or email alex@ajbury.com. We add the address, its domain and the company to a permanent suppression list within one working day, and we do not write again. A request to stop is treated as an objection and is not weighed against our interests.

2.5Proposal pages. Occasionally we prepare an unindexed example page showing what a company's website could look like, using only public facts and our own imagery. Such a page states that it was prepared by AJ Bury as a proposal, claims no affiliation, and is taken down within 24 hours of a request.

3.1We keep the contact details, correspondence, contracts, invoices and payment records needed to deliver our services and run the company (lawful bases: performance of a contract, our legal obligations such as tax and accounting, and legitimate interests in managing the relationship).

3.2Where we build or host a platform for a client, the client is the controller of the personal data inside it and we act on their instructions as a processor, under our Terms of Business.

4.1Our systems run on DigitalOcean (hosting), Supabase (databases), GitHub (private repositories, including the enquiry log) and Google Workspace (email). Payments are processed by Stripe. Chat answers are generated by third-party AI model providers under their business terms. We also keep an operational log of our outreach activity in our internal tooling (which companies were contacted, when, and what happened) so that opt-outs and follow-ups are handled correctly. Service emails for website plans are sent through Resend (Plus Five Five, Inc., United States), which holds the recipient address, delivery status and, for a short period, the email content. Our client desk (login.ajbury.com) runs on DigitalOcean and Supabase and holds the log of the service emails we have sent you; our internal CRM holds a copy of the log entries, never the content.

4.2These providers may store data outside the UK, including in the European Economic Area and the United States. Where that happens we rely on the UK's adequacy decisions or the International Data Transfer Agreement and standard contractual clauses with those providers.

4.3We do not sell personal data and we do not share it with anyone for their own marketing.

5.1Details of a business we contacted that never replied are deleted 12 months after our last message. Suppression records (the fact that an address asked us not to write) are kept indefinitely so the request is never forgotten. Records of what happened in outreach are kept for 24 months and then reduced to counts with names removed.

5.2Enquiries and chat transcripts are kept for 24 months from the last contact. Session recordings are kept for no longer than 12 months. Aggregated analytics (page counts by day) are kept indefinitely and contain no personal data.

5.3Client, contract and payment records are kept for six years after the relationship ends, as required for tax and to defend legal claims.

5.4The log of service emails sent about a website plan (recipient, subject, template, delivery status) is kept for 24 months after the plan ends, and the text of each email is removed from the log 90 days after it was sent. If you ask us to delete your data under our Terms (clause 8.4) we delete these entries too, keeping only the payment records clause 5.3 requires.

6.1You can ask what personal data we hold about you, ask us to correct or delete it, object to our use of it (including any marketing), or ask us to restrict it or hand it over in a portable form. Email alex@ajbury.com. We answer within one month and do not charge.

6.2Complaints. If you are unhappy with how we have handled your data, email alex@ajbury.com with "data protection complaint" in the subject. We acknowledge within five working days, look into it, and reply with what we found and what we have done within 30 days. If you are still unhappy you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

7.1We update this page when our systems or practices change and show the version and date at the top. Substantial changes affecting people we are already in contact with are notified by email.