Your data, in plain English.
We run this site on our own. There is no marketing stack behind it, no data broker, and nothing gets sold. This page says exactly what is collected, why, and how to switch it off. If something here is unclear, email us and we will fix the wording.
Three things worth knowing.
- Analytics are off until you say yes. No measurement cookie is written on your first visit. If you decline, the cookies are cleared.
- The contact form goes to our inbox. Straight to email. No CRM, no database, no mailing list, no automated follow-up.
- Nothing is sold or shared for advertising, profiling or any other commercial purpose.
Lucy Websites.
Lucy Websites is a sole-trader web design studio based in Bath, Somerset, working with clients across the UK. Lucy Murray is the data controller for this site. This policy covers the public website at lucywebsites.co.uk. It does not cover the separate client login area, which is governed by your own client agreement.
Questions, corrections or complaints: lucy@lucywebsites.co.uk or 07522 466993.
Four things, and that is the lot.
1. The contact and quote forms
When you send an enquiry we receive your name, email address and message. If you ran the free website audit first, the report it produced is attached so we can see what you are asking about without making you repeat yourself.
That enquiry is delivered as an email to our inbox. Your IP address is included in the email and a scrambled version of it is kept for a short period so a bot cannot flood the form. Nothing is written to a database, and your address is never added to a mailing list. We keep enquiry emails as long as they are useful for the job, then delete them.
2. Google Analytics, but only with your consent
If you press Accept on the cookie banner, Google Analytics 4 (property G-XXXXXXXXXX) records which pages you viewed, roughly where you were (country and city level, never a street address), what device and browser you used, and how you arrived. We use it to work out which pages actually help people and which ones are wasting everyone's time.
Until you accept, Google Consent Mode holds every storage permission at denied, so no analytics cookie is written at all. Advertising features are switched off permanently, not just until consent: this site does not run ads and does not build advertising audiences. Google acts as our data processor here, and its own handling is covered by the Google Privacy Policy.
3. The free website audit tool
When you enter a web address into the free audit tool, that address is sent to Google's PageSpeed Insights API to generate the performance report. The URL you type is the only thing sent. The result is shown in your browser and stored there so it can be attached if you then contact us.
4. Standard web server logs
Our hosting provider keeps ordinary server logs (IP address, the page requested, the time, and your browser's user agent). These exist for security and fault-finding, they are not linked to analytics, and we do not use them to build any profile of you.
What actually gets stored on your device.
- lw_consent (local storage, kept until you clear it). Remembers whether you accepted or declined analytics. This one is strictly necessary: without it the banner could not remember your answer, so it is not itself optional.
- theme (local storage, kept until you clear it). Remembers whether you chose light or dark mode.
- _ga and _ga_7ZL5C4026Q (cookies, up to 13 months). Google Analytics. Only written after you press Accept, and deleted if you later decline.
The main site loads its fonts from its own server, so no third party sees your visit just because a font loaded. The one exception is the Business OS page, which loads its fonts from Google's font CDN.
Changing your mind is one click.
Withdrawing consent should be exactly as easy as giving it, so it is the same button in the same place:
You can also block or delete cookies in your browser settings, or install Google's Analytics opt-out add-on to switch analytics off everywhere at once.
Access, correction and complaints
Under the UK GDPR and the Data Protection Act 2018 you can ask what personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict or stop using it, object to how we are using it, and ask for a copy in a portable format. Email lucy@lucywebsites.co.uk and we will respond within one month. There is no charge.
If you are not happy with how we handled it, you have the right to complain to the Information Commissioner's Office, the UK regulator, at ico.org.uk.
If this changes, the date changes.
If we add a tool that collects something new, this page gets updated and the "last updated" date at the top moves. If the change is significant, the consent banner will ask you again rather than assuming your old answer still stands.
This page was last updated on 12 August 2026.