Last updated: 22 August 2026
This policy describes how Reflow Digital handles information submitted through the website’s application and contact flows.
Information we collect
When you apply for a free website, we collect the business details, contact information, services, website preferences, online profiles and optional files you provide. When you use the contact form, we collect your name, email address, optional telephone and business name, the subject and your message.
We also store limited technical and attribution information, such as referrer and UTM campaign values, where available. Rate-limiting identifiers are hashed before storage. If you make an advertising consent choice, we record that choice and its policy version with an application. We do not ask for card details through these forms.
How we use information
We use application information to assess the request, communicate with you, design and build an accepted website, manage the project status and provide any service you later choose. Contact enquiries are used to respond to the question.
Submitting an application or enquiry does not subscribe you to marketing. We do not sell applicant information.
Advertising measurement
Meta advertising measurement is optional and stays off until you select Allow advertising. If enabled, Meta Pixel records page views and may record that an application journey started. A Lead event is sent only after Supabase has successfully saved a new application.
For a consented Lead event, Reflow Digital sends Meta the shared event ID used for deduplication, the application page URL, time, browser information, IP address, available Meta browser identifiers, and hashed versions of the applicant email address and telephone number. The access token stays on the server. Meta may use this information to measure advertising, attribute conversions and improve ad delivery under its own terms.
You can reject advertising without affecting the site or the free website offer, and can change your choice at any time using Cookie preferences. See the cookie information page for categories and controls.
Storage and security
Application and enquiry records are stored privately in Supabase. Uploaded assets are held in a private Storage bucket. Public browser access to these records and files is blocked; the website writes through controlled server endpoints.
Transactional emails are sent through Reflow Digital’s Fastmail account. Relevant contact information is included only where needed to deliver the notification or confirmation.
Retention
Records are retained for as long as reasonably required to assess enquiries, deliver work, maintain business records and meet legal obligations. Records can be reviewed, exported or deleted when a valid operational or legal need arises.
Your rights
Depending on the circumstances, you may have rights to access, correct, restrict or erase personal information, object to certain processing and receive a portable copy. Identity may need to be verified before a request is completed.
Cookies and local storage
Local storage remembers the advertising choice for up to six months. After advertising consent, the application journey may use session storage to retain referral and campaign attribution while you move through the form. Meta technologies and advertising storage are not activated before an affirmative choice. Reflow Digital does not currently run GA4.
Contact
Use the contact page for privacy questions or requests. Please do not include passwords or payment details.