Privacy Policy
Who we are
Your Web Toolkit is operated by Cathy Topping, a sole trader based in the United Kingdom.
Data controller: Cathy Topping
Email: cathy@yourwebtoolkit.com
Phone: 07555 079027
Address: 66 Paul Street, London EC2A 4NA
We are registered with the Information Commissioner's Office (ICO) as a data controller. Registration reference: ZA879157.
What information we collect
We collect personal information in the following ways:
When you contact us or enquire about our services
- Name and email address
- Information you share about your business and goals
When you book a discovery call or onboarding call
- Name, email address, and any information shared during the booking process
- Notes and content from the call itself
When you become a client
- Name, email address, and billing address
- Payment information (processed securely by our payment provider; we do not store card details)
- Business information shared during the course of working together
When you visit our website
- IP address and browsing behaviour (via Google Analytics)
- Cookie data (see Cookies section below)
When you join our mailing list
- Name and email address
Why we collect it and our lawful basis
Under UK GDPR, we must have a lawful basis for processing your personal data. Here is ours:
| Purpose | Lawful basis |
|---|---|
| Delivering services you've purchased | Contract |
| Sending quotes and proposals | Legitimate interests |
| Following up on enquiries | Legitimate interests |
| Sending marketing emails to existing clients and subscribers | Legitimate interests / Consent |
| Analysing website traffic to improve our site | Legitimate interests |
| Complying with legal obligations | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interests do not override your rights and freedoms as an individual.
Where we rely on consent (for example, marketing emails to new subscribers), you can withdraw that consent at any time by unsubscribing or contacting us directly.
How we use AI tools
AI tools are a core part of how we work. This section explains how they interact with your data. For full details of how and where we use AI, see our AI Transparency Statement.
Tools we use
- Claude (Anthropic): primary tool for writing, strategy, and building client systems
- ChatGPT (OpenAI): occasional use for research and comparison
- Canva AI: image generation and design work
What your data is used for in AI tools
We use AI tools to assist with:
- Drafting content, copy, and written materials
- Research and planning
- Building AI-powered systems and automations for clients
- Summarising discovery call notes to help write proposals (with your consent, obtained at the start of the call)
How we handle your data with AI tools
We work from a local system. Your files and documents are stored on our machine, not on AI servers. When content is sent to an AI provider for processing, it is not retained by them or used for model training under their API terms.
We minimise the personal data that goes into AI tools. Where a task can be completed without including identifying details, we do so. Where we do need to include information from a discovery call or project brief, we use only what is necessary for the task.
We do not enter financial details, passwords, or sensitive personal data into AI tools.
AI providers as data processors
Anthropic and OpenAI act as data processors when we use their tools. Both are based in the United States. Data transfers are covered by standard contractual clauses and their respective data processing agreements.
Who we share your data with
We share personal data with the following third-party providers where necessary to deliver our services:
| Provider | Purpose | Location |
|---|---|---|
| Anthropic (Claude) | AI processing | United States |
| OpenAI (ChatGPT) | AI processing | United States |
| GoHighLevel | CRM, email marketing, and booking | United States |
| Stripe / payment processor | Payment processing | United States / EU |
| Google Analytics | Website analytics | United States |
| Meta (Facebook Pixel) | Advertising and website visitor tracking | United States |
| Airtable | Project and content management | United States |
| SiteGround | Website hosting | European Union |
All providers are required to handle your data in accordance with applicable data protection law. Where data is transferred outside the UK, appropriate safeguards are in place (standard contractual clauses or adequacy decisions).
We do not sell your personal data.
International data transfers
Some of the third-party providers listed above are based in the United States. The UK has adequacy arrangements and standard contractual clauses in place to cover these transfers. Where we use US-based providers, we ensure they participate in appropriate data transfer frameworks or have signed standard contractual clauses.
How long we keep your data
| Data type | Retention period |
|---|---|
| Client project files and correspondence | Up to 10 years from end of contract (for tax, legal, and reference purposes) |
| Enquiries and leads | Up to 10 years (for follow-up and business development purposes) |
| Email marketing subscribers | Until you unsubscribe |
| Website analytics data | 26 months (Google Analytics default) |
Cookies
Our website uses cookies to help it function and to understand how visitors use it. These include:
- Essential cookies: required for the website to work
- Analytics cookies: Google Analytics, to help us understand traffic and behaviour
- Marketing cookies: the Facebook Pixel tracks visitor behaviour on our website and shares it with Meta to help us measure and target advertising
You can manage your cookie preferences via the cookie banner on our website or by adjusting your browser settings. See our Cookie Policy for full details. To opt out of Google Analytics tracking, visit tools.google.com/dlpage/gaoptout. To manage your Facebook ad preferences, visit facebook.com/ads/preferences.
Your rights
Under UK GDPR, you have the following rights regarding your personal data:
- Right of access: to request a copy of the data we hold about you
- Right to rectification: to ask us to correct inaccurate data
- Right to erasure: to ask us to delete your data in certain circumstances
- Right to restrict processing: to ask us to limit how we use your data
- Right to data portability: to receive your data in a portable format
- Right to object: to object to processing based on legitimate interests or for direct marketing
- Right to withdraw consent: where processing is based on consent, you can withdraw it at any time
- Right not to be subject to automated decision-making: we do not make solely automated decisions that significantly affect you
To exercise any of these rights, contact us at cathy@yourwebtoolkit.com. We will respond within 30 days.
Children's privacy
Our services are intended for adults running businesses. We do not knowingly collect personal data from anyone under 18.
Complaints
If you have concerns about how we handle your personal data, please contact us first at cathy@yourwebtoolkit.com and we will do our best to resolve it.
If you remain unhappy, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- ICO website: ico.org.uk
- ICO helpline: 0303 123 1113
Changes to this policy
We may update this policy from time to time, particularly as regulations around AI evolve. The date at the top of this page reflects when it was last updated. Significant changes will be communicated to active clients by email.
Questions
If you have any questions about this policy or how we handle your data, contact us at cathy@yourwebtoolkit.com.