Book a free discovery call
Book a free discovery call

Privacy policy

Last updated 27 October 2026

This is a draft and has not yet been reviewed by a solicitor. [[PLACEHOLDER: remove this notice once a solicitor has reviewed this page]]

Who we are

The controller of your personal data on this website is [[PLACEHOLDER: owner legal name]], a sole trader trading as Small Hours, [[PLACEHOLDER: contact address (a business or virtual address is fine)]]. In this policy, "we" and "us" mean Small Hours.

You can contact us about your data at [[PLACEHOLDER: hello@domain]].

What we collect

  • Contact form: your name, email address, company (optional) and the message you write.
  • Platform waitlist: your email address, what you would use the platform for (optional), the exact wording you saw when you joined, and the time you joined.
  • Booking a call: if you choose to book through Cal.com, your name, email address and booking details are collected by Cal.com and shared with us.
  • Technical data: Cloudflare keeps security logs when you visit the site. We use Cloudflare Web Analytics, which gives us aggregate page counts, uses no cookies and does not track you across sites.

We do not ask for, and you should not send us, sensitive information such as health details or payment card numbers.

Why we use it, and our legal basis

  • Replying to your enquiry: our legitimate interests in answering the people who contact us, and steps taken at your request before a contract.
  • Waitlist emails: your consent. You can withdraw it at any time by using the unsubscribe link in any email or by contacting us.
  • Security and spam prevention: our legitimate interests in keeping the site and our systems safe.
  • Bookings: steps taken at your request before a contract.

Who receives your data

We use these service providers (processors) to run the site and handle your messages. They act on our instructions.

  • Cloudflare (hosting, form handling, a temporary backup copy of form submissions, Turnstile spam protection and Web Analytics). Cloudflare is a US company.
  • n8n workflow host (the automation that logs enquiries, alerts us and sends confirmation emails). It is self-hosted by us on our own equipment in the UK. [[PLACEHOLDER: update if moved to a VPS provider]]
  • Formspree (a backup route that emails us your message if the main route is unavailable). Formspree is a US company.
  • Cal.com (bookings, only if you choose to book). [[PLACEHOLDER: Cal.com data region]]
  • Our email provider (where enquiries and replies are stored). [[PLACEHOLDER: e.g. Google Workspace or Microsoft 365]]

We use AI providers only when processing a client's project data under a contract with that client. We do not send website visitors' details to AI providers.

International transfers

Some of the providers above are based in the United States. Where your data is sent outside the UK, we rely on an adequacy arrangement (such as the UK Extension to the EU-US Data Privacy Framework) or on standard contractual clauses with the UK addendum. [[PLACEHOLDER: confirm the safeguard for each provider]]

How long we keep it

  • Backup copy of form submissions: 30 days, then it is deleted automatically.
  • Enquiries: 12 months after we last spoke if we did not work together, or 6 years after a contract ends (for tax and legal limits).
  • Waitlist: until you unsubscribe, or 12 months after the platform launches.
  • Bookings: on the same terms as enquiries.

[[PLACEHOLDER: confirm retention periods]]

Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or move it to someone else. You can object to us using your data where we rely on legitimate interests, and withdraw consent at any time.

To use any of these rights, email [[PLACEHOLDER: hello@domain]]. We will reply within one month.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Cookies

We set no non-essential cookies, so there is no cookie banner. Cloudflare Turnstile, which checks that a form is being sent by a person, is a strictly necessary security check and loads only when you start filling in a form.

Cal.com loads only when you click the booking button, and nothing is requested from Cal.com before that. When it loads, Cal.com may set its own cookies. In our test it set one, __cf_bm, which is a security cookie from Cloudflare (Cal.com's provider) that helps tell people from bots. Cal.com's own policy explains the rest. [[PLACEHOLDER: re-check the cookie list with the real booking link before launch]]

Security, children and changes

Security

We use business-grade tools, limit who can see your data, and keep form backups for a short time only.

Children

This website is not aimed at people under 18, and we do not knowingly collect their data.

Changes to this policy

If we change this policy we will update the date at the top of the page.