How your data is handled.

Last updated: 14 September 2026

This is the privacy policy for Conversion Forge, a sole trader based in Sevenoaks, Kent, founded by Tk. It covers this website, conversionforge.co.uk, and the information you share when you get in touch or become a client. It is written to meet UK GDPR and the Privacy and Electronic Communications Regulations (PECR).

If anything here is unclear, email hello@weareconversionforge.uk. You will get a reply from us, not a support team.

Who is responsible for your data

The data controller is Conversion Forge, a sole trader in Sevenoaks, Kent, United Kingdom. For anything about your data, write to hello@weareconversionforge.uk.

What happens when you visit this website

Hosting. The site is hosted on GitHub Pages (GitHub, Inc.) and delivered through Fastly's content network. To send you each page, they receive your IP address, browser details and the address you opened, and keep security logs under their own privacy terms. We cannot see those logs.
Fonts. The typeface is loaded from Google Fonts, so Google receives your IP address when the font file is fetched. Google Fonts does not set a cookie.
Analytics, only if you agree. When you first arrive you are asked whether your visit can be counted with Google Analytics 4. Nothing from Google Analytics loads unless you choose yes. If you do, it records the pages you view, roughly where you are (town level), the kind of device and browser, and whether you use the audit form or tap to email, phone or WhatsApp. Google says Analytics 4 does not store IP addresses. Visit-level data is kept for 2 months and user-level data for 14 months, then deleted. It is used only to see which pages help people, never for advertising.
The chat assistant. The chat bubble is an AI assistant, not a person. Your messages are processed by an AI model running on Cloudflare (Cloudflare, Inc.). Conversation logs are kept in Cloudflare's storage and deleted automatically after 30 days; they are used to improve how the assistant answers. Your IP address is held for about two minutes to stop abuse. Please do not send sensitive personal information through it.

What happens when you get in touch

The free audit form sends your name, business name, email address and what you tell us about your business through FormSubmit (formsubmit.co), which delivers it to our inbox.
Email to hello@weareconversionforge.uk is handled by Zoho Mail in its EU data centre.
WhatsApp messages are handled by WhatsApp (Meta) under its own terms.

We keep what you send so we can reply and, if we work together, do the work.

What is held if you become a client

Your name, business name, billing address, phone number and email.
The brief, the scope, and any content or files you send.
Invoices and the payment records that match them. If you pay online by card, the payment is processed by Stripe.
Logins you choose to share for systems we work on for you (domain, hosting, social profiles). These are kept in access-restricted storage and never written into emails or chat messages. At handover you are shown how to change them.

Project files are kept in Microsoft OneDrive.

What your data is used for

Replying to your enquiry.
Doing the work you have asked for, and handing it over.
Invoicing and taking payment.
Meeting legal duties, such as HMRC record keeping.
Counting visits to improve the site, only if you agreed to analytics.

Your data is not sold, not shared for anyone else's marketing, and not used to train AI models.

The lawful bases

Consent for Google Analytics. You can withdraw it at any time with the button below.
Legitimate interests for replying to enquiries, running the chat assistant and keeping the site secure.
Contract for delivering work you have hired us for.
Legal obligation for invoices and tax records.

Where your data goes

Some of the services above are run by companies outside the UK, including in the United States (GitHub, Fastly, Google, Cloudflare, Microsoft, Stripe, Meta). Where data leaves the UK, those providers use the safeguards UK law recognises for international transfers, such as the UK Extension to the EU-US Data Privacy Framework or standard contractual clauses.

How long things are kept

Google Analytics (only if you agreed): visit data 2 months, user data 14 months.
Chat assistant logs: 30 days, deleted automatically.
Emails and audit requests from people who do not become clients: 12 months from the last message, then deleted.
Client project files: for the length of the project and up to six years afterwards, then deleted.
Invoices and tax records: six years from the end of the tax year they relate to (HMRC).

Cookies and your analytics choice

This site sets no cookies unless you agree to analytics. If you choose yes, Google Analytics sets two cookies:

_ga and _ga_WH2KGWG5MH: tell one visit from another. They last up to two years.

Two small notes are kept in your own browser, not as cookies: cf-analytics remembers your analytics choice so you are not asked again, and cfw_teased remembers that the chat assistant has already said hello, until you close the tab.

Your rights

Under UK GDPR you can:

Ask what data is held about you and get a copy.
Ask for anything wrong to be corrected.
Ask for your data to be deleted, where there is no legal reason to keep it.
Ask for its use to be limited while a question is sorted out.
Object to a particular use of your data.
Withdraw consent at any time, without giving a reason.

Email hello@weareconversionforge.uk and you will get a reply within 30 days. If you are not happy with how your data is handled, you can complain to the Information Commissioner's Office at ico.org.uk.

Asking for your data to be deleted

Email hello@weareconversionforge.uk with the subject "Data deletion" and say how you got in touch (the email address, the form, WhatsApp or the chat). You will get a confirmation, the data will be removed where there is no legal reason to keep it, and you will hear back within 30 days.

Marketing emails

No newsletters are sent from this domain. If you receive an email from Conversion Forge that you did not ask for, it is a one-to-one message to a business, sent under the PECR rules for business contact. It says who it is from and how to opt out, and an opt-out is recorded and respected.

Changes to this policy

If the way your data is handled changes in a way that matters, this page will be updated and the date at the top will change. Data already held will not be used in a new way without telling you.