Privacy notice

This notice explains what personal information Codexio Design Studios (“we”, “us”) collects when you visit codexio.co.uk, use our free tools, sign up for or use the Codexio Dash, or buy a plan from us; why; who we share it with; how long we keep it; and your rights. We are the controller of this information under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Who we are

Codexio Design Studios, United Kingdom. You can reach us at any time through our contact form: we don't publish an email address or phone number, so every message is answered from one place.

When you browse codexio.co.uk

We measure how our own website is used with our own analytics, Codexio Dash (the same product we offer clients). It runs on our servers; no advertising or third-party analytics company receives it, and it sets no cookies.

• What's recorded: the pages you view and when, how long you stay and how far you scroll, the page or search engine that sent you (including any campaign tags in the link), your device type, browser and operating system, screen width, the country your connection comes from (worked out by Cloudflare; we don't store your IP address), where on a page you click or tap (position and the label of the button or link, never anything you type), page-speed measurements, and any errors the page hits.
• How visits are linked: a random ID is kept in your browser's local storage so repeat visits count as one visitor. It contains nothing about you.
• Why: to see which pages help people and which don't, to fix problems, and to know which of our marketing works. Our lawful basis is our legitimate interest in running and improving our website; we've kept it to what's needed for that.

Turning analytics off stops all measurement in this browser and deletes the random ID. We also treat browsers that send Global Privacy Control as opted out. The contact form keeps working either way.

Our website is served through Cloudflare, which protects it from attacks and keeps it fast; to do that it processes your IP address and the technical details of each request. Cloudflare also gives us basic visit counts (Cloudflare Web Analytics), which use no cookies and no identifier for you.

When you contact us

When you send our contact form we collect your name, email address and anything else you choose to give us (phone number, organisation, website, budget, project details), together with the page you sent it from and how you found us. We use it to reply, to prepare a proposal if you ask for one, and to follow up on it. Our lawful basis is taking steps at your request before entering into a contract, and our legitimate interest in answering people who contact us.

When you use our free tools

Our free checks (AI readiness, page speed, SEO, email security, SSL, security headers, search preview) need the web address or domain you enter. We fetch and test that public site and keep the address and the result, so we can show reports and prevent abuse. We use your IP address briefly, in memory, to limit how often the tools can be run; it isn't stored with the result.

When you sign up for the Codexio Dash

The sign-up form at dash.codexio.co.uk saves what you type as you go (your website, name, business name and email; never your password) so you don't lose your progress and can pick up where you left off. We also record the page and link that brought you there.

If you give us your email address and then don't finish, we may contact you once to ask if you'd like help finishing. Our lawful basis is our legitimate interest in helping people complete a sign-up they started. If you'd rather we didn't, tell us through the contact form and we'll delete it. Unfinished sign-ups are deleted after 90 days.

When you have a Codexio Dash account

We keep your name, email address, business name, your website's address, a securely hashed version of your password (we can never see the password itself), when you last signed in, your plan and its history, the terms you accepted and when, your settings, and anything you or your team add (notes, goals, team members). We use it to provide the Dash and the plan you chose, to keep your account secure, and to send you account emails: confirming your address, password resets and security notices. Our lawful basis is the contract between us.

Your Dash also holds data about the visitors to your website. For that data you're the controller and we act on your instructions as your processor: see our data processing terms.

When you pay us

We keep records of what you've bought, what's due and what you've paid, and invoices, because we have to by law (tax and accounting). If you pay by card online, the payment is taken by Stripe: your card details go straight to Stripe and never reach us. We receive only a payment reference and basic card details, such as the last four digits.

Who we share it with

We don't sell your information, and we don't use it for automated decisions that affect you. The only organisations that process it for us are:

• Cloudflare: website delivery and security (all pages and the Dash).
• Our email delivery provider: sending account emails (confirmations, password resets, security notices).
• Stripe: card payments, if you pay online.

Our websites and the Dash run on our own servers in the United Kingdom. Cloudflare and Stripe operate worldwide; where your information is processed outside the UK they protect it with safeguards recognised under UK law (such as the UK International Data Transfer Addendum or the UK–US data bridge). We may also share information where the law requires it, or with professional advisers under confidentiality.

How long we keep it

• Website analytics (pages, visits, events): 400 days. Click positions: 120 days.
• Contact form messages and sign-up follow-ups: as long as we need them to reply and follow up. We review and delete those that didn't lead to work at least every 24 months.
• Unfinished sign-up forms: 90 days.
• Dash accounts: while your account is open. When it closes we delete your account and your website's data within 90 days, apart from what we must keep by law.
• Payment and invoice records: 6 years after the end of the financial year they relate to (UK tax law).
• Email links for confirming an address or resetting a password: they expire within 7 days and an hour respectively, and are deleted 30 days later.

How we protect it

Everything travels over HTTPS. Passwords are stored as salted scrypt hashes, and changing yours signs out every other session. Access to the Dash's data is limited to the people who need it. Our servers are monitored around the clock and backed up within our own cluster.

Your rights

You can ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it (including the analytics described above, at any time), and to receive it in a portable format. Send us a message through our contact form; we'll reply within one month. If you're a visitor to one of our clients' websites, they control that data: contact them first, and we'll help them answer you.

If you're unhappy with how we've handled your information, please tell us. You can also complain to the Information Commissioner's Office at ico.org.uk.

Changes

We'll update this notice when what we do changes, and change the date at the top. If a change matters to Dash account holders, we'll tell them in the Dash or by email first.