Privacy

Who we are

Themetrek Studio designs and builds websites for local service businesses in the United States and the United Kingdom. For the purposes of UK and EU data protection law we are the data controller for the information described here. You can reach us at hello@themetrek.com.

What we collect

• What you type. Your first name, email address and current website address when you request a redesign. If you go on to apply for a call, we also collect your phone number, country, how many customers your site currently produces, what you want fixed and your timeframe.
• The website you ask us to scan, and its scores. When you enter a web address into the scanner on our home page, we send that address to Google’s PageSpeed Insights API and store what comes back: the address itself, the four Lighthouse scores for mobile and for desktop, the Core Web Vitals measurements, and which of Google’s recommendations applied to that page. Alongside it we store the date and time, the country your request came from, the page that referred you and any campaign parameters in the link you arrived on.
  
  We store this whether or not you go on to give us your details, because it is how we know how many people find the scanner useful. The scan record itself holds no name, no email address and no IP address: we read your IP only to derive the two-letter country and for the abuse counters described below, and the address is never written into the record. If you do give us your details, they are attached to that record so we can send you the report. Scan records are deleted automatically after 90 days.
• What you tell us you do. If you use the “I’m a…” selector on our home page, the industry you pick is kept in your browser’s session storage and attached to your request if you go on to make one. It is not linked to you until then, and we use it to decide which trades to build dedicated pages for next.
• How you found us. Campaign parameters in the link you clicked (utm_source, utm_medium, utm_campaign, utm_content, utm_term), advertising click identifiers from Meta and Google (fbclid, gclid), and the page that referred you. These are stored in your browser’s session storage and attached to your submission so we know which advert produced it.
• Your IP address. Your IP address is read from the request whenever you run a scan or submit a form, and is used to stop one person or script flooding the service. We treat it as personal data, because under UK GDPR it is.
  
  It is never stored as an IP address. Before it is used as a counter key it is converted into a keyed one-way hash, so what our rate-limiting store actually holds is an irreversible fingerprint, not an address, and nobody with access to that store can work backwards to you. Those counters expire on their own: within one hour for the hourly limit, and within 24 hours for the daily one. Nothing about them survives past that.
  
  It is also not written into the emails we send ourselves, and it is not part of the scan records described above. We used to include it in our internal notification emails and removed it, because nothing we did with it justified keeping a copy of your address sitting in an inbox.
  
  Two places it does still travel, both stated in full: it is sent to Meta with the server-side copy of a conversion event, where it is one of the signals Meta uses to match the event to an account — that is described under “Analytics and advertising” below. And if we have an outbound CRM webhook configured, the submission we forward to our own systems includes it.
• Your browser user agent. Read from the same request. It is included in the internal notification email so we can reproduce problems people report and tell a real browser from a script, and it is sent to Meta alongside the IP for the same matching purpose described above.
• Analytics and advertising. If you have not blocked them, the Meta Pixel and Google Analytics set cookies and record page views and events. We also send a server-side copy of conversion events to Meta. Your email address, phone number and first name are hashed with SHA-256 before they leave our server — we never transmit any of those to an advertising platform in plain text. Your IP address and browser user agent are sent unhashed, because Meta requires them in the clear to match the event, and without them the server-side event is largely useless for measurement.

What we don’t collect

We don’t ask for or store payment details on this website. We don’t run a database — form submissions arrive as email and, if configured, as a webhook to our own CRM. We don’t buy contact lists and we don’t sell, rent or share yours.

Why we’re allowed to use it

For the redesign and the follow-up emails: your consent, given when you submit the form, and our legitimate interest in responding to a business enquiry you started. For analytics and advertising cookies: your consent, which you can withdraw at any time through your browser or your Meta and Google ad settings. For rate limiting and fraud prevention: our legitimate interest in keeping the service working.

Who processes it for us

• Vercel — hosting and request logs.
• Resend — sending the confirmation and notification emails.
• Upstash — abuse counters keyed to a one-way hash of your IP address, and storage for the website scan records described above.
• Meta Platforms — advertising measurement, including hashed conversion events.
• Google — Analytics and Ads conversion measurement.
• Cal.com — scheduling, if you book a call.

Some of these are based in the United States. Where information leaves the UK or EEA it is transferred under the providers’ standard contractual clauses or an equivalent approved mechanism.

How long we keep it

Enquiry emails and CRM records are kept for as long as there is a realistic prospect of working together, and for up to 24 months after your last contact with us. Ask us to delete yours sooner and we will. Analytics data follows the retention period configured in Google Analytics and Meta, which is typically 14 months. Website scan records — the address you entered and the scores it produced — are deleted automatically 90 days after the scan.

Your rights

If you are in the UK or the EEA you can ask us for a copy of what we hold, ask us to correct or delete it, object to us using it, or ask us to send it somewhere else. If you are in California you can ask what we have collected and ask us to delete it, and we will not discriminate against you for asking. In all cases, email hello@themetrek.com and we will action it within 30 days.

If you are unhappy with how we have handled your information you can complain to the UK Information Commissioner’s Office at ico.org.uk or to your local supervisory authority.

Cookies

This site sets no cookies of its own. The attribution parameters described above live in session storage and are cleared when you close the tab. Any cookies you do receive come from Meta, Google or Cal.com and are controlled by your browser settings and by those companies’ own opt-outs.

Changes

If we change how any of this works we will update this page and the date at the top. There is no version of this policy where we start selling your details.