SCARECROWINNOVATIONS Start a project

Legal

Privacy policy

This explains what happens to personal data when you use this website or send us an enquiry. It is written to be read rather than to satisfy a template, and it describes what actually happens rather than what we might do one day.

Last updated 30 July 2026 · Applies to scarecrowinnovations.com

The short version

  • This website sets no cookies and runs no analytics, advertising or tracking of any kind.
  • The only personal data we collect is what you type into the enquiry form, or send us by email.
  • We use it to answer you. Nothing else.
  • We do not sell it, share it for marketing, or add you to a mailing list.
  • Two suppliers handle it on our behalf: Netlify, which hosts this site and receives the form, and Google, which runs our email.
  • Ask us to delete it at any time and we will, and confirm when it is done.

1. Who we are

Scarecrow Innovations Ltd, a company registered in England & Wales, is the data controller for the personal data described in this policy. That means we decide what is collected and why, and we are responsible for looking after it.

You can reach us about anything in this policy at tom@scarecrowinnovations.com. It goes to a person, not a ticketing system.

2. Cookies and tracking

This website sets no cookies. It contains no analytics, no advertising pixels, no social media trackers, no session recording and no fingerprinting. Nothing is stored in your browser, and no third-party scripts run on the page.

That is why there is no cookie banner. There is nothing to consent to. Fonts and images are built into the page itself rather than loaded from anyone else’s server, so simply reading this site tells no one anything about you.

If this ever changes — for example if we add visitor statistics — this policy will be updated first, and anything requiring consent will ask for it before it loads.

3. What we collect

There are three ways personal data reaches us, and that is all of them.

The enquiry form. When you submit the form on our home page, we receive exactly the fields you filled in:

  • Company name
  • Your name
  • Email address
  • Phone number, if you chose to give one — it is optional
  • What you need, your indicative budget and your target date
  • The description of the problem you typed

The form contains a hidden anti-spam field that real people never see and never fill in. If it is completed, the submission is discarded.

Email and correspondence. If you email us, or we exchange messages while discussing a project, we hold that correspondence and whatever you chose to put in it.

Server logs. Like every website, this one is served by a host that keeps technical logs, which typically include the IP address making the request, the page requested, the time, and the browser and operating system reported. These are generated automatically by our host and are used for security and to keep the site running. We do not use them to build a profile of you and we do not attempt to identify anyone from them.

4. Why we collect it, and our lawful basis

We collect it to answer you. Someone reads the enquiry, works out whether we are the right people to help, and replies. That is the whole purpose.

Enquiry form and correspondence
To respond to your enquiry and, if it goes further, to discuss and deliver a project. Lawful basis: taking steps at your request before entering into a contract, and our legitimate interest in responding to people who contact us about our services.
Server logs
To keep the website available, secure and working. Lawful basis: our legitimate interest in operating and protecting the site.
Records of work done
Where we go on to work together, to keep accounts and records required by law. Lawful basis: legal obligation, and performance of a contract.

Where we rely on legitimate interests, we have considered whether it is fair to you. Answering a message you chose to send us, using only the details you chose to give, is about as narrow as that gets.

5. Who else handles it

Two suppliers process personal data on our behalf. They are not permitted to use it for their own purposes.

Netlify
Hosts this website and receives enquiry form submissions, which are stored in our project account and emailed to us. Netlify also generates the server logs described above.
Google
Provides our email. Any enquiry notification, and any correspondence between us, sits in that email account.

Beyond those two, nobody. We do not use a CRM, a marketing platform or an outsourced sales function, and we do not pass enquiries to anyone else. If that changes, this policy changes with it.

We may also disclose personal data where we are legally required to — for example to a regulator, or in response to a valid legal request — or where it is necessary to establish or defend a legal claim. This has never happened, and we would not do it quietly if it could be avoided.

6. Where your data is held

Netlify and Google are both United States companies operating global infrastructure, so your data may be stored or processed outside the United Kingdom, including in the United States.

Where personal data leaves the UK, it is protected by the safeguards those providers put in place for international transfers — in practice the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, and the UK extension to the EU–US Data Privacy Framework. Both providers publish the detail of their arrangements, and we are happy to point you at the current terms if you want to read them.

If you are engaging us on a project where data location matters — healthcare, for example, or anything involving special category data — tell us early. Hosting region is something we agree per project rather than assume, and it is easier to decide at the start than to move later.

7. How long we keep it

Enquiries that go nowhere
Kept for up to 24 months from our last contact, in case you come back to us or we need to remember what was discussed. Then deleted.
Enquiries that become projects
Kept for the duration of the work and for 6 years afterwards, which is the period we need for accounting, tax and any potential legal claim.
Server logs
Retained by our host according to their own retention schedule, which is short. We do not keep separate copies.

You do not have to wait for any of that. Ask us to delete your data sooner and we will, unless we are legally required to keep a specific record — in which case we will tell you exactly what we are keeping and why.

8. What we never do

  • We do not sell personal data. Not to anyone, at any price.
  • We do not share it with third parties for their marketing.
  • We do not add enquirers to a mailing list or a newsletter. If we ever run one, you will have to ask to join it.
  • We do not run automated decision-making or profiling. A person reads your enquiry and a person decides what to do about it.
  • We do not track you across other websites, because we do not track you on this one.
  • We do not knowingly collect data about children. This site is aimed at businesses.

9. Keeping it secure

The site is served over HTTPS. Access to form submissions and to our email is protected by strong, unique credentials and two-factor authentication, and is limited to the people who need it — which, given the size of the company, is a very short list.

No system is perfectly secure, and anyone claiming otherwise is selling something. If a breach ever occurred that presented a risk to your rights and freedoms, we would report it to the Information Commissioner’s Office within 72 hours and tell you directly where required to.

10. Your rights

Under UK data protection law you have the following rights over your personal data. All of them are free to use, and we will respond within one month.

Access
Ask for a copy of the personal data we hold about you.
Rectification
Have anything inaccurate corrected, or anything incomplete completed.
Erasure
Ask us to delete it, where there is no overriding reason for us to keep it.
Restriction
Ask us to stop using it while a question about it is resolved.
Objection
Object to our processing where we rely on legitimate interests.
Portability
Receive the data you gave us in a common, machine-readable format.

To use any of them, email tom@scarecrowinnovations.com. You do not need to give a reason, use particular wording or cite any legislation. Asking plainly is enough, and we will confirm in writing once it is done.

11. Complaints

If you think we have handled your data badly, please tell us first — it is usually the fastest way to fix it, and we would rather know.

You also have the right to complain directly to the UK supervisory authority, the Information Commissioner’s Office, at any time. You do not have to come to us first.

Information Commissioner’s Office · Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF · 0303 123 1113 · ico.org.uk/make-a-complaint

12. Changes to this policy

If how we handle personal data changes, this page changes first and the date at the top is updated. We will not quietly start doing something this policy says we do not do.

Because there is no mailing list, we cannot notify you of changes directly. If a change materially affects an enquiry you have already sent us, we will email you about it.

13. Contact

Anything at all about this policy, about data we hold, or about how a system we have built handles data:

Company
Scarecrow Innovations Ltd, registered in England & Wales
Data controller
Scarecrow Innovations Ltd