Privacy policy

Who I am

I’m Shalina, trading as Written Art. I’m the “controller” of the personal information described here, which means I decide how it is used.

You can contact me about this policy or your information at shalina@writtenart.co.uk.

What I collect

When you send an enquiry

• Your name, email address and the type of enquiry.
• Anything else you choose to give me: the date you need, quantity, stationery, style and ink preferences, budget, and what you write about your project (for example wording, or a link to a reference).
• If you came from a piece in my portfolio, the name of that piece, so I know what you were looking at.
• To keep the form free of spam: the time the form was opened, a hidden field that people never fill in, your IP address (see “How your enquiry reaches me”) and the result of a security check (see “Spam protection”).

Information about other people

Some commissions involve other people’s details, such as a partner’s name or guests’ names and addresses for place cards or envelopes. Please share only what’s needed. I use it only for your commission.

When you visit the website

The website is hosted by Cloudflare. Like any web host, Cloudflare processes technical information such as your IP address, browser type and the pages you request, to deliver the website and keep it secure.

How your enquiry reaches me

When you press “Send enquiry”, your details go to a small program that runs on Cloudflare’s network (a Cloudflare Worker). It checks the form and the security check, and then passes your enquiry to a small script in my own Google Workspace account (Google Apps Script), which emails it to my inbox so I can reply to you directly. The website does not keep a copy of your enquiry in a database, and the Worker does not record the content of your enquiry, your IP address or your browser details in its logs.

To stop the form being flooded with messages, the Worker uses a scrambled (hashed) version of your IP address to limit how many enquiries can be sent in a short time, and passes your IP address to Cloudflare to confirm the security check. Your IP address is not included in the enquiry I receive.

My email inbox is provided by Google Workspace, and the script that delivers your enquiry runs in the same Google account. Your enquiry and our emails are kept there.

Spam protection

The enquiry form uses Cloudflare Turnstile to tell people apart from automated spam. It loads only on the contact page. According to Cloudflare’s Turnstile Privacy Addendum, Turnstile processes signals such as your IP address, your browser’s user agent and TLS fingerprint, and the website the check runs on. Cloudflare says these signals are used to detect bots, not to identify, profile or target you.

Cloudflare acts on my behalf when it runs the check. It also uses the signals, as a controller in its own right, to improve Turnstile’s bot detection.

Cookies and analytics

This website does not set any cookies of its own, and it does not use advertising or tracking cookies.

Any information the Turnstile check stores in your browser is set by Cloudflare and used only for that security check.

I don’t use any analytics on this website.

Why I use your information

• To reply to your enquiry and prepare a quote: these are steps you have asked me to take before we agree a commission (UK GDPR Article 6(1)(b)).
• To carry out a commission you decide to go ahead with: performing our contract (Article 6(1)(b)).
• To keep business and tax records: legal obligation (Article 6(1)(c)).
• To protect the website and the form from spam and misuse: my legitimate interests (Article 6(1)(f)).

Your name, email address, type of enquiry and a description of your project are needed so I can reply. Everything else on the form is optional. I don’t use your information for automated decisions or profiling.

Who else handles it

• Cloudflare: website hosting, the enquiry Worker and the Turnstile spam check.
• Google (Google Workspace): my email inbox, and the Google Apps Script in my account that delivers each enquiry to it.

I don’t sell your information, use it for advertising or add you to a mailing list. Cloudflare and Google may process information outside the UK, including in the United States. Where they do, they use safeguards recognised under UK data protection law.

How long I keep it

• Enquiries that don’t become bookings are deleted within 12 months.
• Booking records are kept for as long as they are needed for the work and to meet my legal and accounting duties.

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how I use it, and, where it applies, to have it transferred to you or someone else. To ask, email me at the address above. I’ll respond within one month.

Complaints

If you’re unhappy with how I’ve handled your information, please tell me first so I can try to put it right. You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

Keeping it safe

The website is served over an encrypted connection (HTTPS), and enquiries are delivered only to my inbox.

Changes to this policy

If this policy changes, I’ll update this page and the date at the top.