Legal

Privacy policy

Last updated 26 October 2026

This policy explains how Matthew Wright, trading as Matthew Wright Studio (“I”, “me”), collects and uses personal data. I’m the data controller. Contact: matthewwright.studio@gmail.com or 07455 840 231.

What I collect

• Enquiries: when you use the enquiry form or email me — your name, email, phone (optional), business name, current website, package, budget, timeline and your message.
• Business outreach: if I’ve contacted your business, the business name and the contact email or phone number published on your website or public listings.
• Clients: the information needed to deliver a project and invoice for it.
• Mock-up pages: if I’ve built a free homepage mock-up for your business, I record when its page is opened (the time only, with no cookies and nothing about the device), so I know whether it’s a good moment to follow up.
• Website analytics: Google Analytics records anonymous usage data such as pages viewed, device type and approximate location.

Why I use it

• To reply to your enquiry and give you a quote (steps before entering a contract, at your request).
• To deliver projects and send invoices (performance of a contract, and legal obligations such as keeping accounts).
• To contact businesses that may benefit from my services, and follow up a small number of times (legitimate interests). I only send unsolicited emails to limited companies and other corporate bodies, or to people who have agreed to hear from me.
• To understand how the website is used and improve it (legitimate interests).

Who processes it

I don’t sell your data. I use these services to run the business, each acting on my behalf:

• Vercel — website hosting
• Supabase — secure database for enquiries and client records (stored in the EU, Ireland)
• Google — Gmail for email, and Google Analytics
• Formspree — backup delivery of enquiry form submissions

Some of these providers may process data outside the UK. Where they do, they rely on recognised safeguards such as the UK International Data Transfer Addendum or adequacy regulations.

How long I keep it

Enquiries and outreach records that don’t become projects are deleted within 24 months of the last contact. Client and invoice records are kept for six years to meet UK tax rules. Ask me to stop emailing you and I’ll keep only a note of that, so I don’t contact you again.

Your rights

You can ask to see the data I hold about you, have it corrected or deleted, object to how I use it, or ask me to stop contacting you. Just reply “no thanks” to any email, or contact me using the details above. I’ll respond within one month.

If you’re unhappy with how I’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.

Gmail access

My own internal tools connect to my own Gmail account to send replies and follow-ups and to detect replies, so that I don’t email people who have already responded. They don’t access anyone else’s Gmail. Use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.