Privacy policy

Brennlo is a web development and automation studio. For the purposes of UK and EU data protection law, Brennlo is the data controller for the information described on this page — meaning we decide what is collected and why.

We operate from India and work with clients in the United Kingdom, the United States, Australia and elsewhere. You can reach us about anything on this page at hello@brennlo.com.

Only two things, and one of them requires your permission first.

The enquiry form. When you submit the contact form we receive your name, your email address, the project type you selected, and the message you wrote. Nothing else — there are no hidden fields, and we do not store your IP address alongside the enquiry.

Analytics, only if you accept. If you accept analytics cookies, Google Analytics 4 records which pages you visited, roughly where in the world you are, and whether you reached us from a search engine or a link. It does not know your name. If you reject, the Google Analytics script is never loaded at all — not loaded and silenced, but never requested.

Our host, Vercel, keeps short-lived operational logs of requests to the site, which can include an IP address. That is standard infrastructure logging needed to keep the site running and defend it from abuse; we do not query it, build profiles from it, or connect it to enquiries.

We use your enquiry to reply to you, quote for the work, and — if you become a client — deliver it. The lawful basis is our legitimate interest in responding to someone who has contacted us about our services, and, once we are working together, performance of a contract.

Analytics rests on your consent, which you gave through the banner and can withdraw at any time using the Cookie preferences link in the footer.

We keep the list of third parties short on purpose. These are all of them:

• Google — enquiries are written to a private Google Sheet and emailed to us through Gmail. If you accepted analytics, Google also processes your usage data.
• Vercel — hosts this website and serves every page you load.

We do not sell your data, share it with advertisers, or pass it to anyone else. There are no advertising pixels, no retargeting tags, no social trackers, and no third-party chat widget on this site. The typefaces are served from our own domain rather than from Google’s font servers, so loading a page makes no request to Google unless you have accepted analytics.

If you are in the UK, the EU or Australia, your enquiry leaves your country. It is stored on Google’s infrastructure and read by us in India. Google transfers data under the European Commission’s Standard Contractual Clauses and the UK Addendum, and we access it only through Google’s own authenticated services rather than copying it elsewhere.

If you would rather not have your details leave your jurisdiction, email us instead and say so, and we will handle the conversation accordingly.

Nothing non-essential is set before you agree. The full list:

• brennlo-consent — stored in your browser’s local storage, not a cookie. It records whether you accepted or rejected analytics so we don’t ask again. Strictly necessary, and it never leaves your device.
• _ga, _ga_<id> — set by Google Analytics only after you accept, and used to recognise a returning browser. Google sets them to expire after two years. Choosing Reject deletes them.

You can change your mind whenever you like through the Cookie preferences link at the bottom of every page.

Enquiries that do not turn into work are deleted from the sheet and the mailbox within 24 months. If we work together, we keep the project correspondence for as long as we are contractually and legally required to, and no longer.

Analytics data is retained by Google for the period configured on our property, after which Google deletes it automatically. You can shorten that to nothing at any point by rejecting analytics.

Wherever you are, you can email us and ask for a copy of what we hold about you, ask us to correct it, or ask us to delete it. We will action it within 30 days and we will not ask you why.

If you are in the UK or the EU, the UK GDPR and GDPR give you the right of access, rectification, erasure, restriction, portability, and the right to object to processing based on legitimate interests. You also have the right to complain to a supervisory authority — in the UK that is the Information Commissioner’s Office at ico.org.uk. We would rather you told us first, but it is your right either way.

If you are in California, we do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months. If you are in Australia, the Australian Privacy Principles apply and you may complain to the Office of the Australian Information Commissioner.

The site is served over HTTPS only. The form endpoint is authenticated with a shared secret so it cannot be written to by anyone who finds the URL, and access to the enquiry sheet and mailbox is protected by two-factor authentication.

No system is perfect. If you believe you have found a security problem with this site, email us and we will take it seriously.

If we change what we collect or who processes it, we will update this page and the date at the top. We will not make a change retroactive to information you have already given us.