KaiForgeDigital

Privacy policy

Last updated 16 October 2026

This explains what personal information I collect through kaiforge.digital and when you work with me, why I need it, and what I do with it. I've kept it as short and plain as I can.

Who I am

I'm Oliver Bundy, trading as KaiForgeDigital. I'm responsible for your information (the law calls this being the "controller"). If you've got any questions about it, or want to use any of your rights below, email me at hello@kaiforge.digital.

This policy is about my own website and my own customers. If you're visiting a website I run for one of my customers, that business is in charge of your information, and their own privacy policy explains what they do with it.

If you're just looking around

I don't use advertising or tracking cookies, and there's no Facebook or Google tracking code on this site.

  • Visitor counts. So I can see how many people visit and what they find useful, my own server counts which pages are looked at, how long each one is on your screen and how far down it you scroll, and which links and buttons are pressed. With each visit it notes roughly where you came from (like a Google search or a Facebook post), whether you're on a phone or a computer, which browser you use, and which country you're in, which my server works out from your IP address. Your IP address itself isn't kept: it's mixed with a random code that's thrown away every night, so I can follow a visit from page to page but can't recognise you the next day. Nothing is stored on your device, nothing you type is recorded, and on setup pages and your account I only count that the page was opened. These counts aren't shared with anyone and are deleted after about a year.
  • Server logs. Like any website, my server keeps a basic log of requests: your IP address, the page you asked for, your browser and the time. I only use these to keep the site running and secure, and they're deleted after about two weeks.
  • Fonts. The fonts on this site come from Google Fonts, so your browser asks Google for them and Google sees your IP address. You can read Google's privacy policy for what they do with it.
  • Settings in your browser. If you pick a different look for my homepage, your browser remembers it for next time. On a setup page, it remembers which steps you've been to. This stays on your device and isn't sent to me.

If you get in touch

When you send a message with the contact form on my site, my server keeps it and emails it to me through Resend. If you press Send on WhatsApp instead, what you filled in on the form is also sent to my server, so I have a record of your enquiry. When you email me, or call, message me on WhatsApp or contact me on Facebook, I get whatever you send: usually your name, contact details, your message and any offer code.

I use it to reply to you and talk about your website. If we don't end up working together, I delete it within 12 months.

If you become a customer

To build and run your website, I keep:

  • your name, email address, phone number and business name
  • what you tell me on your setup page: things like your business address, opening hours, what you do, the words for your site, the web address you want, and any mailboxes you'd like and who they're for
  • the files you send me, like your logo, photos and documents
  • which accounts you already have, like your Google Business Profile, and who looks after them. I'll never ask for your passwords.
  • payment records: what you've paid, when, and whether payments went through. Stripe handles your card, so I never see your full card number.
  • a copy of each email my system sends you
  • my own notes about your site and our conversations

If you give me details about other people, like your team's names and photos for your site, please make sure they're happy for you to.

Your account. You sign in to your account with a link I email you. The link works once and runs out after 15 minutes. When you use it, a single cookie keeps you signed in on that device for 30 days. It's only there so you can sign in, so it doesn't need a cookie banner.

Why I'm allowed to use it

Data protection law says I need a proper reason to use your information. Mine are:

  • To do what we've agreed: building and hosting your site, setting up your web address and email, taking payments, and keeping you updated.
  • Because the law says I have to: I keep records of payments and invoices for tax.
  • Because it's reasonable to: replying when you get in touch, keeping my site and systems secure, counting visits so I can make the site better, and keeping records in case there's ever a disagreement about what we agreed.

I don't send marketing emails, and I'll never sell your information to anyone.

Who else sees it

I use a few trusted services to run things. Each one only gets what it needs to do its job, and they're all required to look after it properly.

  • DigitalOcean hosts my website, the setup pages, my customer records and the files you upload.
  • Stripe takes card payments and sends receipts.
  • Resend sends the emails from my system, like setup links, sign-in links and updates on your site.
  • Fasthosts provides my email, so it stores the emails you send to hello@kaiforge.digital. If you take business email from me, your mailboxes are hosted by Fasthosts too, and it's where I buy web addresses.

I may also share information with my accountant or HMRC for tax, or with the police or a court if the law requires it.

Outside the UK

Some of these services are based in the US, so your information may be handled there. When it is, it's protected by safeguards the UK government recognises, such as the UK extension to the EU-US Data Privacy Framework, or contracts approved for exactly this.

How long I keep it

  • Enquiries that don't lead to any work: up to 12 months.
  • Setup pages that are never finished: deleted within 12 months of the link being sent.
  • Customers: for as long as you're a customer. After you leave, I delete your setup answers, files and notes within 3 months. I keep payment and invoice records for 6 years after you leave, because the tax rules say I have to.
  • Visitor counts: about a year.
  • Backups: my system is backed up every night, and backups are kept for a few weeks. So something I've deleted can take a few weeks to disappear from the backups too.

Keeping it safe

Everything travels over a secure (HTTPS) connection. Only I can get into my admin area, and it needs a password plus a code from an authenticator app. Customer sign-in links and sessions are stored scrambled, so they're useless to anyone who got hold of them.

Your rights

You have the right to:

  • ask for a copy of the information I hold about you
  • ask me to correct anything that's wrong
  • ask me to delete it
  • object to how I use it, or ask me to limit it
  • ask for your information in a format you can take elsewhere

Just email me. It's free, and I'll reply within a month. Some things I can't delete straight away, like payment records I have to keep for tax, but I'll tell you if that's the case.

If you're unhappy with how I've handled your information, please tell me so I can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes to this policy

If I change this policy, I'll update the date at the top. If it's a change that affects my customers, I'll email you about it too.