Privacy Policy

Who we are

Caswell Labs is the trading name of Bray Caswell, a UK sole trader providing custom software and related services. Bray Caswell is the data controller for the personal information described here. You can write to Caswell Labs, 61 Bridge Street, Kington, HR5 3DJ, United Kingdom, or email [email protected].

Information we use

When you send an enquiry, we receive the name, email address and message you provide, along with an optional project type if you choose one. If we discuss or carry out work together, we may also use the contact details, project requirements, files, content and correspondence you choose to share with us.

For customer administration and payments, we may record service details, invoices, amounts, payment status and transaction references. Card entry and card processing are handled by payment providers such as Stripe; we do not receive or store full payment-card details.

Our website and its delivery and security providers may process limited technical request information, such as IP address, request time, page requested, browser information and security signals, to deliver and protect the site. Rate limiting is handled server-side using IP-based request controls.

The enquiry form uses one first-party cookie named session for CSRF protection and secure submission handling, including duplicate-submission protection. It is marked Secure, HttpOnly and SameSite=Lax, and lasts for the browser session. The cookie is created only when you begin using the form, not simply by loading the homepage. It contains security and submission-handling values, not the name, email address or message you submit. We do not use advertising or marketing cookies. Website analytics and the one cookie that remembers your analytics choice are described under Website analytics below.

Website analytics

We use Cloudflare Web Analytics, provided by Cloudflare, to understand how the website is used and how well it performs. We use it for aggregate, statistical website analytics and to improve the site. We do not use it for advertising, behavioural profiling or cross-site tracking.

The analytics may include page views, the page or site that referred you, browser, operating system and device type, an approximate location such as country where Cloudflare provides it, and website performance measurements such as page load times.

You can control analytics at any time using the Privacy choices link at the bottom of every page. Where prior consent is required, analytics does not load until you give permission. Where we rely on an applicable statistical analytics exception, analytics is on by default and you can object using the same control. If you turn analytics off, it stops loading from your next page view; information already sent before you objected cannot be recalled by us.

To remember your choice we store one first-party cookie named cl_analytics, containing only the word allowed or denied. It lasts 12 months, contains no personal information and no identifier, and is not sent to third parties. To decide whether to ask you first, our server reads the country code Cloudflare attaches to your request and returns only a region category to the page. We do not store your IP address or country for this.

Why we use it

• To answer enquiries and take steps you request before a contract: necessary for a potential contract or our legitimate interest in handling genuine enquiries.
• To agree, provide and support commissioned work and manage the customer relationship: necessary for a contract or our legitimate interests in service administration.
• To invoice, record payments and maintain required business records: necessary for a contract, our legitimate interests in accounting, or a legal obligation.
• To operate and secure our website and services, prevent abuse and investigate technical problems: our legitimate interests in reliable, secure operation.
• To understand how the website is used and how well it performs, using aggregate analytics: your consent where prior consent is required, and otherwise an applicable statistical analytics exception that you can object to at any time.
• To meet legal or regulatory duties and respond to lawful requests: legal obligation where applicable.

We do not use a website enquiry as consent to receive marketing emails.

How long we keep it

We review enquiries and correspondence and keep them only while needed to respond, assess potential work, manage an active relationship or resolve a dispute. Customer, invoice and payment records are kept for the period required by applicable tax, accounting and legal rules. Technical security information is kept only for operational and security needs, subject to our providers’ retention settings. When information is no longer needed, we delete it or make it anonymous where practical.

Service providers and transfers

We use providers where needed to deliver the website and services, including Cloudflare for website delivery, security and website analytics, hosting and email providers for infrastructure and communications, and Stripe or another agreed payment provider for payments. We share only information relevant to their role. We may also share information when required by law or to protect legal rights. We do not sell personal information.

Some providers may process information outside the UK. Where a transfer is restricted by UK data protection law, we use an applicable UK adequacy arrangement or appropriate contractual safeguards and assess the transfer as required. Contact us for information about safeguards relevant to your data.

Security

We use reasonable access controls, encrypted connections and other proportionate technical and organisational measures. No online service can guarantee absolute security.

Your rights

Depending on the circumstances, you can ask to access, correct or erase your personal information, restrict or object to its use, or receive a portable copy. Some rights are limited where we must keep records by law. To make a request, email [email protected]. We may need to verify your identity before acting.

You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint. We would welcome the opportunity to address your concern first.

Changes to this policy

We may update this policy when our practices or legal requirements change. The date above shows when this version was last updated. Material changes will be explained on this page.