Privacy policy

Petal & Code is the trading name of Petal & Code Ltd, company number 17405589, the data controller for the information described on this page, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, run by me, Rosie. Petal & Code Ltd is registered with the Information Commissioner's Office, reference ZC225137. This page explains what information I collect through this site and how I use it.

What I collect

When you fill in the consult form on the Contact page, what you type is sent to the site's back end and saved so that I can reply to it: your name, email address, and whatever you tell me about your business, project, budget and timeline. Nothing else is collected with it, and it is only ever read by me.

There are no analytics, advertising or tracking scripts anywhere on this site, and nothing here follows you around the web. The login pages run a Cloudflare bot check, which sees your IP address and may set a short-lived cookie to confirm you are not a bot. If you log in, your browser stores a sign-in token so you stay logged in between pages. That is only there to keep you signed in, it isn't used to track you, and signing out clears it.

This site sets no cookies of its own, and there is nothing here to consent to. The few things it does keep on your device are the ones the service you asked for cannot work without, which is why you are not being asked to agree to anything before you can read the page.

How I use it

Your details are used only to respond to your enquiry and, if we work together, to deliver your project. I never sell your information, and I don't share it for anyone else's marketing.

Running this site does mean a few trusted companies handle data on my behalf, under contract and only on my instructions. Vercel hosts this site and runs the code that receives your enquiry. Supabase stores enquiries and runs the login system. Resend delivers the email that tells me an enquiry has arrived. Cloudflare runs the bot check on the login pages. They are used purely to deal with your enquiry and deliver your project, and none of them use your information for anything of their own. Nobody else handles it: where a project needs a specialist, an illustrator or a photographer for instance, they are briefed on the piece they are making and are never given access to your workspace, your accounts or the code.

That is this site. Data inside a site I build for your business, your own customers' details passing through your forms and your systems, is yours rather than mine. There you are the controller and I am the processor, handling it only on your instructions, and your services agreement sets out what that means in full.

Why I'm allowed to hold it

Data protection law asks me to say what my legal basis is for holding your information, so: if you have sent me an enquiry, it is my legitimate interest in replying to someone who asked me a question. If we are working together, it is because I need it to carry out our contract. And a few things, invoices in particular, I keep because HMRC requires me to.

Where I rely on legitimate interests you can object, and I will stop unless there is a good reason I cannot. There is no marketing list here, so there is nothing to unsubscribe from.

Where your information goes

Vercel, Resend and Cloudflare are US companies, so some of the handling happens outside the UK. Transfers like that are covered by the standard safeguards in each company's data processing terms, which is the mechanism UK law provides for exactly this. Supabase hosts its data in the region I selected when I set the project up, and I keep that within the UK or EU.

Other than those, your information does not leave my systems, and I don't pass it to anyone else.

How long I keep it

If we don't end up working together, I'll delete your enquiry details within 12 months. If we do work together, I'll keep the project files for as long as they're useful to you, and anything with a number on it, invoices and payment records, for six years after the tax year it falls in, because that's what HMRC requires. After that it goes. When a project ends you can ask me to delete or hand back anything I was holding on your behalf, and I will, keeping only what the law says I have to.

Your rights

You can ask me at any time to see the information I hold about you, to correct it if it is wrong, or to delete it. You can also ask me to pause using it while something is being sorted out, to hand you a copy in a form you can take elsewhere, or to stop using it where I am relying on legitimate interests. Just email rosie.jaeger@petalandcode.com and I will sort it, normally well inside a month.

Nothing here is decided about you automatically, and there is no profiling.

If you think I have got something wrong and we cannot resolve it between us, you can complain to the Information Commissioner's Office, the UK's data protection regulator. I would rather you came to me first, but it is your right either way.

Accessibility

I've tried to make this site easy to read and navigate: clear contrast, sensible font sizes, and a simple structure that works with keyboards and screen readers. I build to WCAG 2.2 AA as a working target, which is the same standard I hold client projects to, and I test this site against it rather than assuming. If anything on the site is difficult to use, let me know at rosie.jaeger@petalandcode.com and I'll fix it.

Questions

If you have any questions about this policy, get in touch at rosie.jaeger@petalandcode.com.