Privacy.

Sites by Panda is a service of AutomatedPanda. That's James Graham, trading as AutomatedPanda, a one-person studio and not a registered company. I decide what happens to the information on this page, which in data protection terms makes me the controller for it.

For anything on this page, including asking me to delete what I hold, email hello@sitesbypanda.com.

The form on the contact page asks for these, and nothing else:

Your name

So I know who I'm replying to.

Your email

So I can reply. It's the only way I'll contact you.

Business name

The business the site would be for.

Current website

Optional. If you've already got one, so I can have a look.

What you need

What you type about the site you're after. It's stored exactly as you wrote it, so please don't put anything in there you'd rather talk about on a call.

When you need it

Optional. One of a few options, not a date you type.

How you found me

Optional. One of a few options, like Google or word of mouth, so I know where enquiries come from.

Your builder picks

If you tried the builder on the homepage: the trade, colours and type you picked. They come with you to the form, and you can change them there.

Your estimate

If you came from the estimate on the pricing page: the options you picked, the currency you were seeing prices in, and what they added up to (worked out again when it arrives, not taken from your browser).

Two more things go with it that you don't see. One is a hidden field that a person never fills in. It's there to catch spam bots, and if it's filled in, the enquiry is thrown away. The other is the time the form was put on your screen, because anything sent within two seconds of that is a bot too. Neither is stored.

The form also has Cloudflare Turnstile on it, the small box above the send button. It checks you're a person rather than a bot, usually without you having to click anything. To do that, Cloudflare looks at your IP address and some details about your browser and device, and how the page was used. When you send the form, this site passes the result (and your IP address) to Cloudflare once to confirm it. Nothing from that check is stored with your enquiry. What Cloudflare does with it is in Cloudflare's privacy policy.

When you send the form, this is all that happens:

• It's emailed to me, with a PDF of it attached (your shop brief).
• The same details are saved to my own business system (Panda HQ), so I can find your enquiry again later.
• You get an email back to say it arrived, with the same PDF attached as your copy. The picture at the top of that email (your shop with its name lit up, and your first name) is loaded from this site when you open it.
• The page you sent it from lets you download the PDF for a week. That works from a sealed copy of your enquiry held in the page itself, so nothing extra is stored for it, and nobody else can download it.

Before any of that, the enquiry gets a quick spam check. It looks at the words for the signs of a sales pitch (SEO offers, price lists, a pile of links and so on). Plenty of real enquiries mention Google or SEO, so it takes more than that. If it does look like a pitch, it's still saved in Panda HQ so I can check it, but no emails go out, including the copy to you.

There's a limit too. If the same email address sends more than three enquiries in an hour, the extra ones aren't saved or sent, and the same goes for more than five from one connection. For that, your IP address is turned into a scrambled code that only exists in the server's memory for an hour. It's never saved. And if Cloudflare can't be reached when you send, your enquiry still gets to me, but you won't get the email copy, because nothing could confirm the address was typed by a person.

No account is created and you're not added to any mailing list. I don't sell it, share it for anyone else's marketing, or use it to email you about anything other than the site you asked about.

This site keeps three small things in your browser. None of them is used to track you, and none is shared with anyone.

sbp-currency

A cookie that remembers which currency to show prices in: dollars, pounds or euros. On your first visit it's picked from the country your connection seems to come from, which Vercel (the host) works out from your IP address. Only the currency is saved, not the country or the address. If you change currency with the switch, it saves that instead.

It lasts a year, or until you clear your cookies.

sbp:builder

In your browser's session storage, not a cookie: the business name, trade, colours and type you try in the builder, so they're still there as you move around the site. It never leaves your browser on its own, and it's cleared when you close the tab.

sbp:how-neon

Also session storage. It notes that the sign in How it works has done its flicker, so it doesn't do it again on the same visit. Cleared when you close the tab.

One thing worth knowing. When you click through from the builder to the contact page, your picks (the business name included) go along in the page's address. That's how the form knows them, but it also means they show up in the host's request logs, the same as any address you visit.

There's no analytics on this site yet, so nothing about your visit is sent to Google or anyone else.

When I add it (it'll be Google Analytics), it'll only load if you say yes, nothing will be sent before you do, and saying no won't change how the site works. I'll update this page before it goes on.

You sent me an enquiry, so handling it is a step taken at your request before you and I might agree a project. That's the lawful basis for the enquiry details.

The currency cookie and the two session storage items are there so the site works the way you'd expect (prices in your own currency, your picks kept as you move around). That's my legitimate interest in running the site properly, and none of them is used to identify you.

Enquiries

For as long as the conversation runs, and for 24 months after the last message. Then deleted.

Client project records

For as long as the work runs, and for 6 years after it ends, because that's how long tax and contract records need to be kept.

The currency cookie

A year, or until you clear it.

Session storage

Until you close the tab.

If you want your enquiry gone sooner, ask and I'll delete it. You don't need to give a reason.

I run this on other people's services, so four companies handle some of it for me. They're not allowed to use it for anything of their own.

Vercel

Hosts the site. Like any web server it logs requests, including your IP address, to keep the site up and spot abuse. It also works out your country for the currency cookie.

Supabase

Stores your enquiry in Panda HQ, my business system.

Resend

Sends the enquiry email to me, and the confirmation email to you.

Cloudflare

Runs Turnstile, the check on the contact form that you're not a bot.

These are US companies, so your information reaches the United States. Those transfers rely on the contractual safeguards each of them provides.

Worth saying, because most sites do at least one of these and you can't tell from the outside:

• No advertising or tracking pixels. No Meta pixel, no LinkedIn tag, no retargeting.
• No analytics yet, and when there is, only if you say yes.
• No fonts fetched from Google. They're downloaded when the site is built and served from this domain, so your browser never asks Google for them.
• No session recording, heatmaps or scroll tracking.

You can ask me for a copy of what I hold about you, or ask me to correct it, delete it, restrict what I do with it, or stop using it. You can also ask for it in a format you can take elsewhere.

Email hello@sitesbypanda.com and I'll deal with it within a month. There's no charge. You can clear the cookie and session storage yourself at any time in your browser's settings.

If I get it wrong, you can complain to the UK Information Commissioner's Office at ico.org.uk. I'd rather you told me first so I can fix it, but you don't have to.

If this changes in any way that matters, I'll update the date at the top. There's no archive of old versions, so if you need to know what it said on a particular day, ask me. The terms cover everything else.