Privacy Policy

Last updated: 7 October 2026

Who I am

This website is run by Luke Reaney, trading as Luke Studio ("I", "me"). I am the data controller for personal data collected through this website. You can contact me about anything in this policy at lukeszns@gmail.com.

What I collect and why

• Quote and contact requests: your name, email, and the project details you choose to share. I use these only to reply to you and prepare a quote. Lawful basis: taking steps at your request before entering into a contract.
• Reference photos: images you upload with a website project (for example your logo or photos for the site) are stored securely with Netlify and shared with me through a private link in your project details. I use them only for your project. Ask me at any time and I'll delete them.
• Purchases: when you pay, Stripe collects your name, email, billing address and payment details on its own secure checkout page. I receive your name, email, billing address and what you bought, but I never see or store your full card or bank details. Lawful basis: performing our contract, and legal obligations (for example, keeping tax records).
• Your basket: the packages in your basket, and the project details you enter with them, are saved in your own browser (local storage) so they aren't lost if you leave the page. They stay on your device until you pay. At checkout they are saved with your order in Stripe, and once payment is confirmed they are sent to me through a Netlify form and removed from your browser. You can clear them at any time by emptying your basket or clearing your browser data. This is strictly necessary to provide the basket you asked for, so no consent banner is needed.
• Chat assistant: the chat widget runs entirely in your browser. Messages you type are not sent or stored anywhere.

This website does not use advertising or analytics cookies, and does not track you across other sites.

Who I share data with

I only share personal data with service providers that help run this website, under contracts that require them to protect it:

• Stripe: payment processing (Stripe privacy policy).
• Netlify: website hosting, contact and order form submissions, and short-lived order logs (your email and what you bought) (Netlify privacy policy).
• Google Fonts: loads the fonts used on this site, which means your IP address is sent to Google (Google privacy policy).
• WordPress.com mShots: provides the live preview screenshots of my projects, which means your IP address is sent to Automattic (Automattic privacy policy).

Some of these providers process data outside the UK. Where they do, they use safeguards approved under UK data protection law, such as the International Data Transfer Agreement or Standard Contractual Clauses.

I never sell your personal data.

How long I keep it

• Enquiries that don't lead to work: up to 12 months, then deleted.
• Client and payment records: 6 years after the end of the tax year they relate to, as required by HMRC.

How I protect it

The website is served only over encrypted HTTPS connections. Payments are handled by Stripe, a PCI DSS Level 1 certified provider. The site uses security headers that restrict which scripts can run and block it from being embedded in other sites, and access to the accounts that hold your data is protected by strong passwords and two-factor authentication.

Your rights

Under UK data protection law you have the right to access, correct, delete, restrict or object to the use of your personal data, and to receive a copy of it in a portable format. To use any of these rights, email lukeszns@gmail.com. I'll respond within one month.

If you're unhappy with how I've handled your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

If this policy changes, I'll update it here and change the date at the top.