Alvex Studio ("we", "us") is committed to protecting your privacy. This policy explains what data we collect, why, and what we do with it. No legal waffle — just the facts.

Who we are

Alvex Studio is a web design business based in the North of England, operated by Alex. Our website is alvexstudio.co.uk, you can contact us at hello@alvexstudio.co.uk, and our postal address is 4 Ledson Road, Manchester, M23 9GB.

What data we collect

We collect data in three ways:

1. When you fill in our contact form

We collect your name, business details, project brief, selected services, and preferred timeline. This data is sent to us via Formspree and delivered to our email inbox. We use it solely to respond to your enquiry and prepare a quote.

2. When you browse our website (if you accept cookies)

If you click "Accept" on our cookie banner, we load Google Analytics 4 (GA4). This collects anonymised data about how you use the site — pages visited, time on page, device type, and general location (city level, not exact address). We use this to understand which pages are useful and improve the site.

If you click "Decline", no analytics cookies are set and no browsing data is collected. The site works exactly the same either way.

3. When we approach your business about our services

If we contact your company without you having enquired first, we hold a small amount of information about the business: the registered company name and number, the registered address and town, the SIC codes on your registration, a published business email address, and, where you have a website, its address, its public Google PageSpeed score, screenshots of its public pages and a mock-up we make from those details. If you reply to us, we hold your reply as ordinary business correspondence. This is explained in full in the section on direct marketing below.

Cookies we use

  • alvex-cookies — stores your cookie preference (accept/decline). This is a functional cookie stored in your browser's localStorage. It does not track you.
  • Google Analytics cookies (_ga, _ga_*) — only set if you accept cookies. These are analytics cookies that help us understand site traffic. Data is anonymised and not shared with third parties for advertising.
  • alvex-loaded — stores whether you've seen the loading animation this session. Functional only, stored in sessionStorage, cleared when you close your browser.

What we do with your data

  • Respond to your enquiry and provide a quote
  • Understand how people use our website (anonymised analytics only)
  • Introduce ourselves by email to limited companies and LLPs we have not worked with before, as set out below

Direct marketing to businesses

We sometimes introduce ourselves by email to businesses we have not worked with before. This section explains exactly who we contact, where the information comes from, and how to stop it. If you have received an email from us and want to know why, this is the answer.

Who we contact

Limited companies and limited liability partnerships only. Under the Privacy and Electronic Communications Regulations these are "corporate subscribers", and the rules on unsolicited marketing email are different from those that apply to individuals. We do not send this kind of email to sole traders, to most partnerships, or to any personal email address, because those are treated as individual subscribers and would require consent we do not have. We take the company's status from the public register rather than assuming it.

Where the information comes from

  • The Companies House public register - company name, company number, registered address, incorporation date and SIC codes. This is public data published by the UK government.
  • Your own published business contact details - a business email address published on your website. We do not buy lists, we do not use data brokers, and we do not guess at addresses.
  • Your public website - its address, screenshots of pages that are already publicly visible, and its score from Google's public PageSpeed Insights tool. Screenshots are held privately and used only inside the email we send you. They are never published, never posted on social media and never uploaded to this website.

How we put the email together

Before we write to a company, our own software carries out a few steps automatically. Each one only touches information that is already public:

  • We load your public website and take screenshots of it. The pages are opened the same way any visitor would open them, and pictures of what is on screen are saved. One or more of those screenshots is attached to the email so you can see exactly what we are talking about. They are held privately, used only in that email, and never published anywhere.
  • We make a mock-up to sit next to that screenshot. We choose one of six sector website templates and personalise it with your business name, your town and your trade, recoloured with an accent colour taken from your logo where we found one. All four of those come from your own public website. The result is rendered as an image and attached to the email. It is an illustration of what a site we built for you could look like, not a description of your business, and nothing in it is a claim about you or what you do. It is stored privately with the screenshots and never published anywhere.
  • We measure the site with Google PageSpeed Insights. This is a public Google tool, so running the test means the address of your website is sent to Google. Nothing else about you or your business is sent, and what comes back is a performance score that we quote in the email.
  • We use an AI service to help draft the wording. The company name, the website address and the public measurements described above are sent to Anthropic's Claude API, which returns a draft of the email. Nothing else about your business is sent to it.

Our lawful basis

We rely on legitimate interests under Article 6(1)(f) of the UK GDPR. Our interest is in finding businesses that may need a website and telling them what we do. We have carried out and documented a Legitimate Interests Assessment weighing that against your interests and rights, and we will provide a copy on request. Alongside it, the PECR corporate subscriber rules permit marketing email to companies and LLPs, provided we identify ourselves and give you a way to stop it, which we do in every message.

What we actually send

One email, written for your business rather than sent as a bulk mailing. It is checked so that it only ever states things we have actually measured. We do not send automated follow-up sequences, and if you reply to us for any reason at all, nothing further is ever sent to you automatically.

Replies and bounces

We send these emails from alex@alvexstudio.co.uk and we watch that mailbox for what comes back. Our software connects to our own inbox at our email provider over IMAP, which is the standard way any mail app reads a mailbox, and looks for two things: delivery failures, so that we stop writing to addresses that no longer work, and replies, so that a "no thanks" is acted on straight away. Replies are read by a person, not answered automatically, and nothing in that mailbox is used for any other purpose.

How to stop it

Reply to the email with the words "no thanks", or email hello@alvexstudio.co.uk. You do not need to give a reason. Your address and your company's whole domain go onto a suppression list immediately and permanently, which means no one at your business will be contacted by us again. This is also how you exercise your right to object under Article 21 of the UK GDPR.

Why the suppression list is kept for good

The suppression list holds email addresses and domain names and nothing else, other than the date each one was added. We keep it permanently on purpose, and that is in your favour rather than ours. Deleting it is the one thing that could cause you to be contacted again, so keeping it is the only way to make sure an objection sticks. If you would still rather we removed your entry, ask and we will, but then we can no longer promise you will not hear from us.

How long we keep it

If you do not respond, we delete the business's details, the screenshots and the mock-up within 12 months. If you tell us you are not interested, we delete everything except the suppression entry, and we do that within 30 days. You can ask us to delete it sooner at any time.

Publishing to our own social accounts

We run our own accounts on Facebook, Instagram, LinkedIn and Bluesky, and we use our own software to publish our marketing posts to them through those platforms' official interfaces. Meta and LinkedIn both require any app connected in this way to publish a privacy policy explaining what it does with platform data, and this section is that explanation.

What the software does is narrow:

  • It publishes posts, our own words and our own pictures, to accounts and pages that Alvex Studio owns.
  • It reads only the account, page and profile identifiers it needs in order to publish to the right place.
  • The access tokens that let it do this are held on Alvex Studio's own machine. They are not shared with anyone and not passed to any other service.

What it does not do matters more:

  • It does not collect, store or process data about visitors, followers, commenters or anyone else who uses those platforms.
  • It does not read your profile, your posts, your connections, your messages or your engagement history.
  • It does not use platform data for advertising, profiling or marketing lists, and it does not combine anything from those platforms with anything else we hold.
  • It is a tool we built for ourselves. It is not offered to anyone else and no one else's accounts are connected to it.

If you follow, like or comment on one of our posts, that happens on the platform itself and is covered by that platform's own privacy policy. We see it the way any account holder sees activity on their own page, through the platform's own app.

What we don't do

  • We don't sell your data to anyone
  • We don't pass your data to anyone else for their own marketing
  • We don't use advertising cookies or retargeting
  • We don't send newsletters, bulk mailshots or automated follow-up sequences, and we don't send marketing email to individuals or sole traders. Where we do introduce ourselves to a limited company, it is one email, and the section above explains it in full.
  • We don't buy contact lists or use data brokers
  • We don't post about the businesses we contact, and the screenshots we take are never used anywhere except the email we send to that business
  • We don't collect anything about people who follow, like or comment on our social posts

Third-party services

Our own software uses these services when we research and contact businesses, and when we publish our own social posts:

  • Companies House - the public register we read company details from. We only read it. Nothing about you is sent to it. Their personal information charter
  • Google PageSpeed Insights - measures the performance of a public website. The website address is sent to Google to run the test. Google's privacy policy
  • Anthropic (Claude API) - helps draft the wording of an outreach email. It receives the company name, the website address and the public measurements described above. Anthropic's privacy policy
  • 20i (StackMail) - our email provider. Our emails are sent through it, and the alex@alvexstudio.co.uk mailbox we monitor for replies and bounces is held there. 20i's privacy policy
  • Meta (Facebook and Instagram) - receives the posts we publish to our own accounts. Meta's privacy policy
  • LinkedIn - receives the posts we publish to our own page. LinkedIn's privacy policy
  • Bluesky - receives the posts we publish to our own account. Bluesky's privacy policy

How long we keep your data

Contact form submissions are kept for as long as needed to respond to your enquiry and complete any agreed work. If you'd like us to delete your data, email us and we'll do it within 7 days.

Google Analytics data is retained for 14 months (Google's default), then automatically deleted.

Business details gathered for the direct marketing described above are kept for up to 12 months, or 30 days if you tell us you are not interested. Suppression list entries are kept indefinitely so that we can keep honouring an objection.

Replies you send us are kept as business correspondence in the alex@alvexstudio.co.uk mailbox, and are deleted on request. Bounce records are kept only long enough to stop us writing to a dead address.

Your rights

Under UK GDPR, you have the right to:

  • Access the data we hold about you
  • Ask us to correct or delete your data
  • Withdraw consent for analytics cookies at any time (clear your browser's localStorage or use your browser's cookie settings)
  • Object to direct marketing, which is an absolute right. Say so and we stop, permanently, with no questions asked
  • Object to any other processing we carry out under legitimate interests, and ask for a copy of the assessment behind it

To exercise any of these rights, email hello@alvexstudio.co.uk or write to us at Alvex Studio, 4 Ledson Road, Manchester, M23 9GB.

If you are not happy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint. We would rather you told us first so we can put it right.

Changes to this policy

If we update this policy, we'll change the "last updated" date at the top. We won't make significant changes without making it obvious.

Contact

If you have questions about this policy or your data, email hello@alvexstudio.co.uk, or write to us at Alvex Studio, 4 Ledson Road, Manchester, M23 9GB.