Binge Built Built to be yours

Legal

Privacy

Plain English. Last updated 15 August 2026.

The short version

I only ask for what I need to do the job. I do not sell your details to anyone. I do not use them for anyone else's marketing. I keep them no longer than I have to, and I tell you below exactly how long that is. Last updated 15 August 2026.

One thing worth knowing up front: if you enquire, I may build you a draft website before you have paid me anything. That draft sits on a private web link. This notice explains what goes on it, who can see it, and how long it stays up.

Who looks after your data

Binge Built is run by James Binge, a sole trader trading as Binge Built. Email is the way to reach me about anything to do with your data.

For anything at all about your data, email hello@bingebuilt.co.uk. I answer these myself.

I am registered with the Information Commissioner's Office, the UK's data protection regulator. My registration reference is ZC212670.

What I collect, and when

When you ask a question through the form on my home page, I collect: your name, your email address, and whatever you type in the question box. Nothing else. That form is not an enquiry: it sends me one email so I can reply to you, and my software keeps no record of it beyond that email. Nothing in the two paragraphs below about package stamps, fingerprints or second copies applies to it.

When you fill in the enquiry form on my pricing page, I collect: your name, your email address, your mobile number, your trade, your town, your business name if you give one, a link to photos of your work if you paste one into the box on the form that asks for it, and whatever you type in the message box. My software also stamps a package on your record. It falls back to the standard one-page build wherever it has nothing it can read to go on, so that stamp does not always match the package you were looking at. If you use the pricing wizard I also record your answers to it: which tier you looked at, whether you are interested in the Care plan, and which add-ons you ticked. If you use the optional first-look questions after you have sent it, I also collect the main job or service you want to feature and any photos, Facebook or Google link you choose to share. The mobile number, the business name, the photo link and the first-look answers are all optional, and I only hold them if you send them.

Two more things get written when you send that form, and neither is obvious from looking at it. My software works out a fingerprint of your answers, a long string of letters and numbers, so that if the same form arrives twice it can tell a retry from a fresh enquiry. And if you enquire again when I already hold a record for you that my software cannot safely match you to, it keeps a second copy of that enquiry, with your name, email address, mobile number, trade, town, business name and message in it, for 90 days, so that I can sort it out by hand. That 90 days is a limit I hold myself to and not a timer: clearing those second copies is another job I run by hand.

While you are on my site, an anti-spam check (Cloudflare Turnstile) runs so I can tell a person from a bot. It loads at different points on different pages, so here is the plain version of each. On my pricing page it loads as soon as you open the page, which means Cloudflare sees your IP address even if you never go near a form. On my home page it is held back until you either scroll near the contact form or tap into one of its boxes, so on that page nothing reaches Cloudflare unless you head towards the form. If your browser is old enough to be missing the part my home page uses to notice you scrolling, it loads there as soon as the page opens too. When it runs, it sends your IP address and a one-off token to Cloudflare.

A different check runs on the form itself. If your browser is missing any of the pieces the send needs, the form does not try to send at all. It offers you an email instead, already filled in with what you typed, so your words are not lost. Nothing is posted anywhere else on your behalf.

I do not write your IP address into a file or a database of my own. My form software keeps a count against it in memory so that the same address cannot post the form over and over, and that count goes as the software tidies its memory. What I cannot tell you is that nothing about it is written down anywhere. My software runs on Cloudflare with request logging switched on for every single request, as described under "When you send something" below, and your IP address is part of the request that logging is switched on for.

When you just visit this site, the only logs are my host's. This site is a set of plain files sitting on Cloudflare's network. None of my own software runs when you open a page here, so nothing of mine writes anything down about your visit. Cloudflare keeps its own basic security and traffic logs as my host, on their schedule rather than mine. This site sets no cookies at all, it carries no advertising tags, and it carries nothing that follows you from one site to another.

When you send something, that is different. The enquiry form does not post to this site. It posts to my own software, which runs on Cloudflare at a separate address, and the same goes for the software behind payments and behind the forms on customers' own sites. Each of those writes its own log line for every request it handles, and I have them set to record every single one rather than a sample. Those logs are mine. My software writes them on purpose, and they are not my host's record of passing traffic. I read them when something goes wrong. They carry the internal reference my system uses for a customer record, which points back to you for as long as I hold the key that matches the two up. The lines my enquiry software writes about an enquiry are deliberately short codes rather than your answers. Where something fails, my software also records why it failed, and a reason handed back by a supplier can carry personal details in it, in the log and sometimes in a note written into my database as well. I am working through exactly how much of that detail reaches those logs, path by path, and until that is finished I am not going to tell you they hold nothing of yours. See "Forms on your own site" below for the case I can describe most precisely.

When you become a customer, I collect what is needed to build and run your site and your Google listing, plus billing details. Card payments go through Stripe and Direct Debit through GoCardless, so I never see or hold your card number or your bank details. If you sign in to the customer portal, that sets two cookies to keep you signed in. Nothing else.

When someone fills in a form on your own site, once you are a customer, those details belong to you, not me. See "Forms on your own site" below.

Do you have to give me any of this? No. None of it is required by law and none of it is a condition of anything. If you leave the optional parts out (your business name, a link to your photos, the first-look answers) it makes no difference to how I deal with you. What I cannot do without is a way to reply: give me no name and no email address and there is nothing for me to answer, so the form will not send. If you would rather not fill anything in at all, email me at hello@bingebuilt.co.uk instead and tell me only what you want to.

Details I did not get from you

If you enquire, I usually look at what your business already puts in public before I draft anything: your existing website, your Google Business Profile, your listing on a trade directory, your social pages. I use it so the draft looks like your business and not a template.

So some of what ends up in your file did not come from you. It came from sources anyone can see. I use the business side of it: your trading name, your trade, your area, the services you offer, your opening hours, your reviews and accreditations, and any phone number or email address you already publish. I do not go hunting for anything that is not already public, and I do not buy lists.

If you would rather I did not do that, email me and I will stop, delete what I gathered, and take any draft down. You do not have to give a reason.

The draft website, and the link it sits on

Here is how the draft works, because it is the part most people have not met before.

  • After you enquire I may build you a draft of your site. It is speculative. You have not paid, and you are not committed to anything.
  • The draft goes on its own web address on pages.dev. I have two ways of building one, and the address is different in each. On the way I build them now, the address is 26 random characters, like https://<26 random characters>.draft-previews.pages.dev/, and there is nothing in it that names you or your business. I also still have an older way, and on that one the address carries your business name: sometimes as a shortened version of it followed by 12 random characters, and sometimes as your whole business name written into the address as a folder on an address I share between drafts. So on the older way the address itself gives your business name away. However it is built, the address is not linked from anywhere, and it is set to keep search engines out.
  • Anyone who has that link can open the draft. There is no password on it. That is deliberate, so you can look at it on your phone on a job without signing in to anything, and so you can show it to your other half. It also means that if you forward the link, whoever you forward it to can see it too.
  • Your business name is on the page, because otherwise it is not your draft. Your private details are not. Neither way of building one gives you a working phone link, a working email link or a working contact form, and the page says the contact details will be added before launch. On the newer way that is switched off in the build itself, not just hidden, and checked again before the draft leaves my hands. On the older way it is switched off because none of what I hold for you at that stage is marked as a number or address meant for printing. Nothing is marked that way today, but if something ever were, that older way would print it, so on that one it is a matter of what I hold rather than something the build refuses outright.
  • Paying is the difference between the two ways that matters most, so here it is plainly. A draft built the newer way has no way to pay on it at all. A draft built the older way carries a live "pay your deposit" button, and pressing it hands you over to Stripe's checkout, so whatever you put in there goes to Stripe. You are still not committed to anything by having one: it does nothing until you press it, and nobody can take a payment from you without you going through that checkout yourself. If you would rather it was not on there, say so and I will take the draft down.
  • Your business name is kept out of the page title and out of the link preview card, so a draft pasted into WhatsApp or texted to someone does not unfurl into your business name. It is on the page itself, as above, but not in the part a chat app reads to build that little preview box.

How long it stays up. If I send you the link, the draft comes down up to 30 days later. If I build one and never send it, it comes down after 7 days. Those are the limits I work to, not a timer: taking a draft down is a command I run by hand, on both ways of building one, and nothing on either of them does it on a schedule. A draft comes down when I take it down and not before.

It works the other way round from how you might expect, and it is worth being straight about. While a draft built the newer way is still up, I cannot delete the enquiry it was built from, because my system refuses to delete an enquiry that still has a live draft hanging off it. So an enquiry with one of those still up can outlast the 90 days set out below, and it stays until the draft comes down. If that bothers you, ask me to take the draft down and both go. A draft built the older way is not recorded in a way that holds anything up, so there the two clocks run separately.

When a draft built the newer way comes down, the same web address serves a short "this draft has expired" page instead, with nothing about you on it. I keep that expired page standing rather than deleting the address, because a deleted address can be made to serve the old content again, and a standing expired page cannot. Taking down a draft built the older way works differently: it deletes what was published, and the address stops answering.

If you want it down sooner, say so and I will take it down.

Why I use your data, and my lawful basis

  • To reply to your enquiry, and to do the things you asked for, like answering your questions, quoting and talking the job through: these are steps you asked me to take before there is any contract between us. You asked, so I do not have to weigh anything up to justify them.
  • To build you a draft before you have paid, and to look at your public business details so it is any good: my legitimate interest in showing you what I would actually do rather than describing it. You did not ask for the draft, so that one sits on a different footing from the reply. I have written the judgement behind it down and I am still working it through. Once it is finished, ask and I will send you a copy.
  • To put that draft on a link anyone with the address can open, and to keep a short "this draft has expired" page at the same address afterwards: the same legitimate interest, and covered by the same written judgement.
  • To keep a short record of what happened to past enquiries (the trade, the month, and whether it converted), so I can tell whether this way of working is worth doing: my legitimate interest in running the business on facts.
  • To keep the spam off my forms: my legitimate interest in not being buried.
  • To keep a nightly backup: my legitimate interest in not losing the only copy of my customer records.
  • To build, run and look after your site, listing and billing once you are a customer: to perform our contract with you.
  • To meet tax and accounting duties: a legal obligation.
  • To send you the odd update about your site or your bill: my legitimate interest in keeping you in the loop. Never marketing unless you have asked for it.

I do not rely on your consent for any of the above, so there is no consent to withdraw. Where I rely on legitimate interests you have the right to object, and I have set out how below. That right covers every use in the list above that I have called a legitimate interest, which is all of them bar three: the draft, the link it sits on and the research behind it, the record I keep of past enquiries, the spam check, the backups, and the updates I send you about your site or your bill. The three it does not reach are the reply to your enquiry, the work of building and running your site once you are a customer, and my tax and accounting duties, because none of those rests on a legitimate interest of mine. Objecting to the updates is a right and not a favour I am doing you: tell me and they stop.

There is no automated decision-making and no profiling. A person, me, reads every enquiry and decides what to do with it.

Who else touches your details

When you send the enquiry form, it normally goes to my own software running on Cloudflare. That software checks the anti-spam challenge with Cloudflare, saves your enquiry in my database at Supabase, and sends two emails through Resend: a confirmation to you, and a copy to me at my Proton inbox. The optional first-look answers go the same way, to the same software and the same database.

If my form tells you it could not send, it offers you an email instead, already filled in with what you typed. That email opens in whatever mail app your device is set up to use, and it is not sent until you send it yourself. If you do send it, it lands in my Proton inbox like any other email. With JavaScript switched off the form cannot send at all, so it is hidden and my email address shown instead.

I will not pretend that message always means nothing happened. Your enquiry is never handed to a third-party form relay: my forms no longer have one. But the same message covers two different cases, and the form cannot tell you which. Sometimes nothing you typed was stored, and the only thing that went anywhere was the anti-spam check's trip to Cloudflare. Sometimes your enquiry was already saved on my side and it was only the confirmation emails that had not settled. So if it matters to you, send the email as well. A duplicate is no trouble, and you can ask me at any point what I hold.

Beyond that, only the suppliers needed to do the job, and only what they need.

  • Supabase: my database. Every enquiry, customer, payment record and site record is stored here. The project sits in a London region.
  • Resend: sends my emails, including the reply that confirms your enquiry landed, the draft link, and payment and handover emails. The email body has your details in it, so Resend handles them.
  • Proton: my own mailbox, behind hello@bingebuilt.co.uk. Anything you email me, and the copy of your enquiry that lands with me, sits there. If your site is handed over as files, the copy I keep for the month sits in Proton's file storage too.
  • Cloudflare: hosts this site, my draft sites and the software behind them, and runs the anti-spam check on my forms.
  • GitHub: several separate things. It holds the source code of your finished site. It holds a nightly backup copy of my database in a private repository, and that backup contains customer contact details. On the older of my two ways of building a draft, it is where the build actually happens: your enquiry details are pulled out of my database onto a GitHub machine for the length of that build. And on the newer way, the draft is built on my own computer and then pushed up to a private repository on GitHub of its own, one per customer, so the files that make up your draft site sit there as well.
  • Stripe: card payments.
  • GoCardless: Direct Debit for the Care plan.
  • Google: where I work on your Business Profile.
  • Cloudflare Registrar: holds the registration for my domain names.
  • Anthropic: only where I use an AI tool to help draft the wording on a site. What goes to it is the business facts for the site: trading name, trade, town, areas covered, services, years trading, accreditations, customer quotes, opening hours, and any phone number or email address that is meant to be printed on the site. Your private mobile number and the email address you enquired from are not sent to it. Nothing an AI writes goes on a site without me reading it first.

I never sell your data. I never pass it to anyone for their own marketing.

Some of these suppliers are based outside the UK, or hold data outside it. I am working through each one's current terms to pin down exactly what covers that transfer, supplier by supplier, and I will set the answer out here once I have it. I am not going to claim a safeguard I have not checked. If you want to know where a particular supplier holds your details before then, email me and I will tell you what I know and what I do not.

How long I keep it

One thing to read first, because it changes how you should read the rest. The clocks below are not all the same sort. The ones in the list below that are mine to run do not run by themselves. There is no timer on them. Each one is a tool I run by hand, so what follows is the limit I hold myself to and the point at which I clear things out, not a promise that a machine does it at midnight on the day. The one exception among mine is the nightly backup, which really is scheduled. The rest of the list belongs to somebody else, my mailbox, my email supplier and my host, and those do run on their own, on their schedule and not on mine. My own software's logs sit between the two: the logs are mine, but the clock that clears them is my host's. I have said which is which on each line. I would rather tell you that than let you assume otherwise. I am building something that runs my own clocks for me, and until it is switched on this paragraph stands.

  • An enquiry that goes nowhere: 90 days from when you enquired, then I delete your record. A strip runs alongside it over the entry my system made when your enquiry came in, and takes your name, email address, mobile number, business name and message out of that entry. If a draft of yours is still up, the enquiry stays until that draft comes down, as set out above.
  • The gap in that, which you should know about: my system keeps a running list of things that happened, and those entries outlive the record they are about. Deleting a customer cuts the link back to them and leaves the entries standing. The strip above reaches the entry for your original enquiry. It does not reach an entry written when I revise the details of a site by hand, and one of those can have a contact email address in it. So a hand-written revision can keep a contact email address after the record it belonged to has gone, and nothing takes it out on a timer today. If you ask me to delete your data, that is one of the places I go and clear by hand. Whether to automate it is on my list, and it is written up in my own notes rather than being something I have quietly left.
  • What survives the 90 days on purpose: a short line saying an enquiry of that trade came in and did not convert, carrying the day it came in and the day I cleared it out. It has no name, no business name, no contact details and no free text in it. The entry it sits in also records the moment it was written, to the second. I keep it so I can see how the business is doing, and I mean to keep it for 12 months and no longer. I have not yet put anything in place that removes it at 12 months, so as things stand it sits there until I clear it out.
  • A draft site: up to 30 days from the day I send you the link, or 7 days if I built one and never sent it. After that the address serves an expired page. I keep a record that the draft existed for as long as that expired page stands. That record carries no name, no business name and no contact details, but it does carry the times attached to the draft: when I first tried to send it, when it went, when it is due to come down, and when the record itself was made and last changed. I cannot strip those out without rebuilding part of the database, and my system refuses outright to move the first three once they are set, so treat them as staying.
  • Customer records: while you are a customer, then afterwards for as long as tax and accounting need them. HMRC's requirement is 6 years. Nothing clears them at 6 years today, so that is the mark I am working to rather than something that has already been settled and automated.
  • A copy of your site files, if you take the site as files: not every site I build stays with me. Some are handed over as files for you to host yourself, and if yours is one of those, the files go to you on a secure link. That link stops working after a while, so save them somewhere safe. I keep a copy for one month from the day I send them, so that if you lose yours I can send them out again. After that month I take my copy down. That one is not even a tool I run by hand: it is me deleting a file, from a note in my diary. Nothing on my side expires it, and nothing on my side would notice if I were late.
  • Enquiries through a form on your own site: I strip your visitor's name, email address, mobile number, message, business name and trade out of my copy at 90 days. What stays is a record that an enquiry came in, which site it came through, the town and the date. Again, that stripping is me running it, not a timer.
  • Emails: copies sit in my Proton mailbox and in Resend's sending logs on their own retention, not mine. Those two really do run on their own.
  • Backups: a copy of my database is written to a private repository every night. Backup files older than 60 days are pruned, but older copies survive in that repository's history until the history is rewritten. If you ask me to delete your data, I delete it from the live system straight away and put the backups beyond use, which means I do not go back into them for any other purpose.
  • My host's website and security logs: the ones described under "When you just visit this site". They are Cloudflare's, kept by Cloudflare on their own schedule, not mine.
  • My own software's logs: the ones described under "When you send something", written by the software behind my forms, my payments, my Direct Debits, my customer portal and the nightly checks on customer sites. Every one of those is set to record every request rather than a sample. They sit in Cloudflare's logging service, and I do not export them, copy them or feed them into anything else. What I control there is whether the logging runs and how much of the traffic it takes, not how long it is kept. I have not pinned down how long Cloudflare keeps it, and I am not going to guess at a number here. Finding out and printing it on this page is on my list.

Forms on your own site

If your site has a tool that collects visitors' details (a contact form, a "ring me back", an RSVP or similar), those details belong to you, not me. You decide what is collected and why. In data-protection terms you are the controller and I am your processor. Each such tool carries its own privacy notice.

One thing worth saying plainly about that, because it is not obvious. When a visitor sends a form on your site, my software emails it on to you. If my email supplier refuses that send, my software writes the reason it gave into my own logs, the ones described under "When you send something" and listed in "How long I keep it", both above. That reason can have the visitor's email address in it. So a failed send can put a visitor's email address in my logs. The software behind the enquiry form on my own site writes short codes about an enquiry rather than what was typed, which is why the two are described differently above.

Cookies

My marketing site sets no cookies. None.

The customer portal sets two, and only after you sign in: one holds your session and one keeps you signed in for up to 30 days. They are strictly necessary for you to be signed in, they cannot be read by scripts on the page, and they do nothing else. There are no advertising or tracking cookies anywhere.

Your rights

You can ask me to:

  • show you what I hold about you,
  • correct anything wrong,
  • delete it,
  • stop using it while a query is sorted out,
  • object to a use I have based on my legitimate interests, including the draft site and the record I keep of past enquiries,
  • give you a copy to take somewhere else.

Just email hello@bingebuilt.co.uk. I will sort it, normally within a month, and free of charge. If I ever have to refuse a request I will tell you why and tell you how to complain about it.

If you object to the draft, I will take the draft down and stop, unless I can show a compelling reason not to. In practice, for a draft, I will just take it down.

If you are not happy

Please tell me first and I will try to put it right.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. You can complain to them without telling me first.

Changes to this notice

If I change how any of this works, I change this page and the date at the top on the same day. If the change is significant and I hold your details, I will email you about it.

Get in touch

Any questions about your data, email me and I'll answer plainly.

Back to the top