Privacy Policy

Last updated: 30 August 2026

This policy explains what personal information suleytangun.com collects, why, how it's used, who it's shared with, and the choices and rights you have over it. It's written to describe what this site actually does — not a generic template — so it should answer real questions rather than repeat boilerplate.

The data controller is Suley Tangun, a UK-based sole trader. For anything in this policy, or to exercise any of the rights below, contact info@suley-tangun.com.

1. Information we collect

When you use the contact form

The contact form on this site (and the chat button that opens the same form) asks for: what you'd like help with (chosen from a fixed list of enquiry types), a message describing your project, an optional budget or timeframe, your name, and your email address. That's everything the form collects — it doesn't ask for a phone number, address, or payment details.

If you've accepted the cookie/analytics prompt (see section 4), submitting the form also causes your IP address to be looked up against a third-party geolocation service (ipapi.co) to derive an approximate location — city and country level, not precise coordinates. If you've declined, this lookup doesn't happen and no IP address or location is stored against your enquiry.

The form is also protected by Cloudflare Turnstile, a bot-detection check that runs before submission and communicates directly with Cloudflare. See section 5 for what that involves.

When you leave a testimonial

The testimonial form asks for a star rating, your written testimonial, your name, and optionally your role or company. Testimonials are never published automatically — every submission is reviewed by hand before it appears anywhere on the site, and only your name, role, rating and quote are shown; we don't publish your email address or any other contact detail. If you'd like a testimonial edited, unpublished or removed entirely, email info@suley-tangun.com with your name and the testimonial text so we can find it.

Information collected automatically

Beyond the IP/location lookup described above (which only happens for a contact-form submission, and only with consent), we don't run any first-party visitor tracking or store page-view logs in our own systems. Aggregate, anonymised traffic statistics — pages viewed, approximate country, device type — are collected by Google Analytics, but only once you've accepted analytics cookies; see section 4.

Information we don't collect

This site takes no payments and has no user accounts for visitors, so we never collect card numbers, passwords, or account credentials from anyone using the public site. The only password-protected area is the administrator's own content-management login, which is unrelated to visitor data.

2. How we use your information

To reply to your enquiry. Submitting the contact form sends you an automatic acknowledgement email and notifies us so we can reply personally, usually within 24 hours.

To publish a testimonial you've submitted, with your consent, after we've reviewed it. See section 1.

To protect the site from spam and abuse — Cloudflare Turnstile, a hidden honeypot field, and a submission rate limit (a maximum of three enquiries per email address in a 15-minute window) all help keep the enquiry form from being abused.

To understand how the site is used, in aggregate, if you've opted in to analytics — see section 4.

We don't run an email marketing list on this site, and your enquiry isn't added to one. If that ever changes, we'll only send marketing communications to people who've separately and explicitly opted in, and every message will include a way to unsubscribe.

We don't sell personal information, and we don't share it with anyone for their own marketing purposes.

3. Our legal basis for processing

Legitimate interests — responding to enquiries you've sent us, and keeping the site secure from spam and abuse (Turnstile, rate limiting).

Consent — analytics cookies and the IP/location lookup on the contact form (see section 4), and publishing a testimonial under your name.

Legal obligation — where we're required to keep or disclose information to comply with the law, for example accounting records.

Where we rely on consent, you can withdraw it at any time — see sections 4 and 6.

4. Cookies and the analytics choice

When you first visit, a banner asks you to accept or decline analytics. Your choice is remembered in your browser's local storage (not a cookie, despite the name) indefinitely, until you change it — you can revisit that choice at any time using “Manage cookie preferences” in the site footer.

If you accept: Google Analytics loads and records anonymised, aggregate page-view statistics (which pages are visited, roughly how often, in what country and on what kind of device), and the IP/location lookup described in section 1 runs when you submit the contact form. If you decline: neither of those happens — no analytics script runs, and no IP or location is looked up or stored.

We don't use cookies or tracking technologies for advertising, retargeting, or building profiles about you for marketing purposes, and we don't have any advertising partners.

A small number of things happen regardless of your choice because they're required for the site to function or stay secure: the cookie-choice storage itself, and the Cloudflare Turnstile anti-spam check on the contact and testimonial forms. This site's fonts are loaded directly from Google Fonts on every visit, which — like any request to a third-party server — shares your IP address with Google as a normal part of that request; Google's own privacy policy covers how they handle that.

Most browsers let you block or delete cookies and local storage yourself, independently of the choice above, through their own settings.

5. Who we share information with

We use a small number of specialist service providers to run this site. Each only receives the information it needs to do its job, and none are permitted to use your information for their own purposes:

Supabase — hosts the site's database, admin login, and uploaded media. Enquiry and testimonial submissions are stored here.

Vercel — hosts and serves the website itself.

Resend — sends the transactional emails this site generates (the enquiry acknowledgement you receive, and the notification we receive).

Cloudflare (Turnstile) — verifies that form submissions come from a real person, not a bot.

ipapi.co — resolves an IP address to an approximate location, only for the consent-gated lookup described in section 1.

Google (Analytics, Fonts) — aggregate analytics (consent-gated, section 4) and webfont delivery (section 4).

Some of these providers may process data on servers outside the UK and European Economic Area, including in the United States. Where that happens, they do so under recognised legal safeguards for international transfers, such as Standard Contractual Clauses. We may also disclose information where required by law, for example in response to a court order.

6. How long we keep information

We keep enquiry and testimonial submissions for as long as they remain relevant to our business relationship with you or a reasonable record-keeping period, and no longer than necessary for the purpose it was collected for. In practice, that means enquiries and testimonials are periodically reviewed, and anything old and no longer needed is deleted. You can ask us to delete your information sooner at any time — see section 8.

7. How we keep information secure

The site is served entirely over HTTPS. The administrator's own login is protected by multi-factor authentication, and only the site owner has access to the database holding enquiry and testimonial submissions. No method of transmission or storage is ever 100% secure, but we take reasonable technical and organisational steps to protect the information you share with us.

8. Your rights

If UK GDPR applies to you (which it does for anyone whose data we process, as a UK-based site), you have the right to:

Access the personal information we hold about you.

Have inaccurate information corrected.

Have your information erased (for example, deletion of a past enquiry or a published testimonial).

Restrict or object to how we process your information.

Receive a copy of information you've provided, in a portable format, where technically applicable.

Withdraw consent at any time, where we rely on consent — this won't affect anything done before you withdrew it.

To exercise any of these, email info@suley-tangun.com with what you'd like and enough detail to find your record (e.g. the name or email address you used). We'll respond within one month. If you're unhappy with how we've handled your information, you also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office, at ico.org.uk.

9. Children

This site isn't directed at children, and we don't knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact info@suley-tangun.com and we'll delete it.

10. Do Not Track

Some browsers offer a “Do Not Track” signal. There's no agreed standard for how sites should respond to it, so like most sites, this one doesn't currently act on it — your analytics choice in section 4 is the control that actually takes effect here.

11. Changes to this policy

We'll update this page if what the site collects or how it's used changes, and update the “Last updated” date at the top. Significant changes will be reflected here directly — there's no separate mailing list to notify, since we don't run one.

12. Contact us

Questions, requests, or concerns about this policy or your information: email info@suley-tangun.com.