Privacy policy.

Who I am

This is the privacy policy for xleo.dev, the website of XLeo, a web design business based in North Devon and run by Leo. I am the “data controller”, which means I decide what personal information this website collects and why.

Questions about any of this: [email protected].

What this website collects, and why

The contact form

Your name, your email address, the topic you pick and your message (up to 500 characters). I use it to reply to you with an answer or a quote. The form also sends you a short automatic thank-you email.

Legal reason: taking steps you ask for before a contract, and my legitimate interest in answering enquiries.

Emails you send me

Your email address and whatever you write. I use it to reply to you.

Legal reason: my legitimate interest in answering you.

Technical information

When a page loads, the servers that deliver this site can see your IP address, the type of browser and device you use, and the pages you ask for. That is how every website works. It is used to deliver the site, keep it secure and fix faults.

Legal reason: my legitimate interest in running and protecting the website.

Cookies and tracking

This website sets no cookies and stores nothing on your device. There is no advertising, no analytics and no tracking, so there is no cookie banner.

The fonts are hosted on my own server, so your browser does not contact Google or anyone else to load them. Small touches like the time-of-day greeting and the clock in the contact section work entirely in your browser, and nothing about them is sent anywhere.

Who else handles your information

I do not sell your information and I do not use it for advertising. A few companies handle it so the website works:

• FormSubmit (formsubmit.co) receives what you type into the contact form and emails it to me.
• Google provides my email (Gmail), so enquiries and my replies pass through Google’s systems.
• Cloudflare sits in front of xleo.dev to deliver it quickly and protect it from attacks, so traffic passes through it.
• The company that hosts the server this website runs on.

Some of these companies may handle information outside the UK. I may also have to share information if the law requires it.

How long I keep it

• Enquiries and emails: they stay in my email inbox for as long as I need them to deal with your enquiry and any work that follows. You can ask me to delete yours at any time.
• If you become a client, your details move into your portal account, and the portal’s privacy policy covers how long they are kept there.
• Technical information: kept for short periods by my host and Cloudflare, under their own policies.

Keeping it safe

This website is served over an encrypted (HTTPS) connection, and the contact form sends your message over one too. No system is perfectly secure, but I take reasonable care. If something goes wrong that puts your information at risk, I will tell you and, where required, the Information Commissioner’s Office (ICO).

Your rights

You can ask me, at any time, to:

• see the personal information I hold about you and get a copy,
• correct anything that is wrong,
• delete your information (I may have to keep some if the law requires),
• limit how I use it, or object to me using it,
• give you your information in a form you can reuse.

Email [email protected] and I will reply within one month.

If you are unhappy with how I have handled your information, you can complain to the ICO (ico.org.uk (opens in a new tab), 0303 123 1113). I would appreciate the chance to put it right first.

The client portal and other websites

The client portal at portal.xleo.dev has its own privacy policy, which covers everything held there.

This site links to other websites, such as my clients’ sites. Once you click through, their own policies apply.

Changes to this policy

If I change what this website collects or how I use it, I will update this page and the date at the top.