Privacy Policy

This policy explains what information the Devfinix website (https://devfinix.com) collects, why it collects it, who else it reaches, and what you can ask us to do about it. It covers this website and the emails we send in reply to it.

We have written it against the actual code that runs this site rather than from a template, so it names the specific fields, events and storage the site really uses. Where something is a limitation, we say so instead of describing a feature we do not have.

This site has no user accounts, no login, and no checkout. Everything below happens without you creating anything.

We use what we collect only for these purposes:

• To read your enquiry and reply to it, and to prepare a proposal if you have asked for one
• To send you the automatic confirmation email that follows a form submission
• To send the occasional newsletter to people who subscribed to it
• To understand which pages and which services people actually engage with, using the analytics events listed above
• To limit how often a single IP address can post the forms, so the inbox is not flooded by scripts
• To investigate an error when something on the site breaks

We do not sell your information, we do not rent it, and we do not share it for anyone else's advertising. We do not use it to build a profile about you, and nothing on this site makes an automated decision about you.

This site sets no cookies of its own. The only cookies that can appear come from Google Analytics, and only when the site has been built with a measurement ID configured:

• _ga — set by Google Analytics as a first-party cookie on this domain. It holds the randomly generated ID that lets Google tell one browser apart from another, so repeat visits are not counted as new people. Google documents its lifetime as two years.
• _ga_ followed by our measurement ID — set by Google Analytics for this specific property. It holds session state, such as whether this is a new session and when it started.
• devfinix-theme — not a cookie. This is a local storage entry in your own browser holding only the word light or dark. It is never sent with any request, so it never reaches our server, Google, or anyone else.

We do not use web beacons, tracking pixels or clear GIFs, on the site or in our emails. Our emails load our logo from this website so the message looks right; there is no per-recipient open tracking and no click tracking on the links. The fonts used here are served from this site rather than fetched from a font provider, so no third party learns about your visit that way. This site does not currently show a cookie consent banner, which means analytics loads on every visit where a measurement ID is configured — the opt-out section below explains how to prevent that from your side.

Only four kinds of third party are involved in running this website, and each one is here because the site genuinely depends on it:

• Google, for Google Analytics. The measurement script is loaded from googletagmanager.com and the events are sent to google-analytics.com. Google processes the analytics data described above on our behalf and under its own terms.
• Google, for email. Enquiries and newsletter notifications are sent through Gmail's SMTP servers, and they arrive in, and stay in, a Gmail mailbox. Everything you type into the form is in that email.
• Cloudflare, which sits in front of this website as its DNS and content delivery network, so your requests pass through its edge network before they reach our server.
• Our hosting provider, which runs the server that serves these pages and therefore handles the requests your browser makes.

Nobody else receives your information. We do not pass enquiries to partners, resellers, lead marketplaces or advertising networks. Links to other websites — including our own free tools, which run at their own addresses — take you somewhere this policy no longer applies, so read the policy of any site you go on to use.

If the UK or EU General Data Protection Regulation applies to you, these are the legal bases we rely on for each purpose:

• Steps taken at your request before a contract — reading your enquiry, replying to it and preparing a proposal.
• Consent — sending you the newsletter. You gave it by submitting the newsletter form, and you can withdraw it at any time by telling us to stop.
• Legitimate interests — measuring how the site is used so we can improve it, and rate-limiting the forms so the inbox stays usable. We consider these limited, expected uses that do not override your rights, and you can object to them at any time.
• Legal obligation — keeping or disclosing information where the law requires it of us.

Depending on where you live, data protection law may give you some or all of the following rights. We will honour these requests wherever we can, whether or not a particular law applies to you:

• Access — ask what information we hold about you and get a copy of it
• Rectification — ask us to correct anything inaccurate or incomplete
• Erasure — ask us to delete what we hold
• Restriction — ask us to stop using it while something is disputed
• Objection — object to our use of it, including analytics and any marketing email
• Portability — receive what you gave us in a structured, machine-readable format
• Withdrawal of consent — withdraw consent for the newsletter at any time, without affecting anything sent before
• Complaint — complain to the data protection authority in your country if you are unhappy with how we handled your request

To use any of these, email [email protected] and say what you want. It costs nothing, we will not make you create an account, and we aim to reply within one month. Because enquiries live as emails rather than in a database, please write from — or tell us — the address you used, so that we can find them.

If you are a California resident, the CCPA as amended by the CPRA gives you the right to know what personal information has been collected about you and where it came from, the right to have it corrected, the right to have it deleted, the right to opt out of its sale or sharing, and the right not to be treated differently for exercising any of these.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. There is no advertising or remarketing tag on this site, and we run no financial incentive programme tied to your data.

The categories we collect are set out in section 2: identifiers such as your name, email address, phone number and IP address; professional information such as your company and job title; the content of what you write to us; and internet activity in the form of the analytics events listed above. To make a request, email [email protected]. You may use an authorised agent, and we may need to check that the request really comes from you before we act on it.

We want to be straightforward about this, because most privacy policies are not: there is no one-click unsubscribe link in our emails, and there is no preference centre on this site.

The reason is that we have not connected an email marketing platform. A newsletter subscription is delivered to us as an email; there is no stored subscriber list, no database and no suppression list behind it. We are not going to claim a mechanism we have not built.

So opting out is a human step: reply to any email from us and say stop, or email [email protected]. We will delete your address from our inbox and not contact you again. If we connect a proper email platform later, it will carry a working unsubscribe link and this section will be rewritten to say so.

Emails that answer an enquiry you sent us are a reply to you, not marketing, and they stop when the conversation does.

If you would rather not be counted in our analytics, any of these will work:

• Block cookies or third-party scripts in your browser settings, or browse in a private window and close it when you are done
• Install Google's official Google Analytics Opt-out Browser Add-on, which stops the measurement script reporting anything from any site
• Use a browser or extension that blocks analytics domains — nothing on this site depends on analytics to work, so blocking it breaks nothing

Analytics is switched on by a measurement ID set when the site is built. Where the site is built without one — local development and preview builds, for example — no analytics script is loaded at all and no analytics cookie is set. We should also be honest that the site does not currently detect Do Not Track or Global Privacy Control signals automatically; if you send one and want us to act on it, email us and we will.

Enquiries and newsletter subscriptions are kept as email. That means they stay in the mailbox indefinitely, until someone deletes them by hand. We have no automatic deletion schedule, because there is no system running that could apply one. Ask us to delete yours and we will, and that is the honest answer to how long it otherwise stays.

IP addresses used for rate limiting last only minutes, in memory, and are never stored.

Analytics data is held by Google under the data retention setting on our Google Analytics property; aggregated reporting outlives the underlying event data, and we cannot delete a record we cannot identify as yours.

Your theme preference lives in your browser until you clear your site data.

The site is served over HTTPS and asks browsers to refuse an insecure connection to it. It sends a content security policy restricting which scripts may run, blocks content-type sniffing, restricts framing of the site, limits how much of the referring URL is sent to other sites, and switches off camera, microphone and location access for the page. Email credentials live only in the deployment environment and never in the code.

It is also worth saying what the security position really is: there is no customer database on this site to be breached, and the meaningful risk to your information is the security of the mailbox your enquiry lands in. That mailbox is protected by the email provider's own account security.

No method of sending or storing information is completely secure, and we cannot promise absolute security. If a breach happens that affects your information, we will tell the people affected and any regulator we are required to notify, as promptly as we can once we understand what happened.

We will never email you asking for a password, a card number or a one-time code.

Devfinix works with clients across every time zone, and the services this site depends on are global. Your information will therefore be processed in countries other than your own — including, in Google's and Cloudflare's case, outside the UK, the EEA and wherever you live — and the data protection laws there may differ from the ones you are used to.

Where a transfer is made by one of those providers, it happens under the transfer safeguards in that provider's own terms. By sending us an enquiry you are asking us to correspond with you by email, which necessarily means it is handled by our email provider.

This website is aimed at businesses and the people who run them, not at children. We do not knowingly collect information from anyone under 18, and nothing here is designed to appeal to a child. If you believe a child has sent us information, email [email protected] and we will delete it.

When what the site does changes, this page is updated to match, and the last updated date at the top changes with it. Our rule is that the code and this page move together: if a new tool, form field or third-party service is added, this policy is rewritten in the same change.

Because there is no stored mailing list, we cannot email everyone about an update. Material changes are described here rather than announced, so check the date at the top if it matters to you. Continuing to use the site after a change means the current version applies to your visit.

Questions about this policy, a request about your own information, or a correction to something here that you think is wrong — all of it goes to the same place, and a person reads it: