Privacy policy.

In plain terms

I’ve named every supplier rather than hiding behind categories like “hosting partners”, because you should be able to see exactly where your information goes.

Who I am

I’m Michael Overton, based in Surrey, United Kingdom. I’m the data controller for the information described in this policy. You can reach me about anything here at privacy@overton.cloud.

I don’t publish a street address, as I work from home. If you need it in writing, for a legal notice or a complaint, email me and I’ll provide it.

When I’m not the controller

If you’ve landed here from a website I built or host for one of my clients, I’m probably not the controller of your data. The client is, and I act as their processor, handling data only on their instructions. Contact them directly, and their own privacy policy applies. If you’re not sure who to contact, email me and I’ll point you the right way.

The rest of this policy covers data I hold about my own clients, enquirers and website visitors.

What I collect, why, and the lawful basis

How long I keep things

Straight answer: not as tidily as a large company would.

• Enquiries that go nowhere: I keep the email thread for up to two years, in case you come back, then delete it.
• Client project files and correspondence: for the life of our relationship and six years afterwards, which matches how long a contract dispute could realistically run.
• Invoices and financial records: six years plus the current tax year, because HMRC requires it.
• Credentials: deleted when the project ends, or sooner if you ask.
• Server logs: cleared periodically.

If you want your data gone sooner, ask. Unless I’m legally required to keep something, I’ll delete it.

Everyone I share your data with

These are all the third parties involved. Nobody else sees your data.

On AI, plainly: I use AI assistants as part of my working process, for things like drafting website copy, producing design mockups, building email signatures and optimising files. That means project material, which can include business contact details you’ve asked me to put on a website, may be passed to Anthropic or OpenAI. I don’t give them your passwords, your customers’ personal data, or anything you’ve asked me to keep confidential. If you’d rather I didn’t use AI on your project at all, tell me and I won’t.

I take payment by bank transfer only. I don’t use a card processor, so I never see or hold your card details.

Sending data outside the UK

Some suppliers above are outside the UK, mainly in the United States. Those transfers are covered by the safeguards the suppliers have in place, typically the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK Extension to the EU-US Data Privacy Framework. Hetzner and Bunny keep data in the EU, which is covered by the UK’s adequacy decision.

Cookies

This site doesn’t set any cookies on your device, tracking or otherwise. The analytics described above work without them, which is why there’s no cookie banner. That’s deliberate. The only cookie anywhere on the site is a login cookie for my own private stats page, which visitors never see.

Security

The site runs over HTTPS. My devices are encrypted and password protected. Credentials live in 1Password with two factor authentication. Backups are encrypted and stored separately. The contact form uses a hidden spam trap and rate limiting to filter out bots.

No system is perfect. If I ever suffer a breach that puts your rights at risk, I’ll tell you and the ICO without unnecessary delay.

Your rights

Under UK GDPR you can ask me to:

• give you a copy of the data I hold about you
• correct it if it’s wrong
• delete it
• restrict or object to how I use it
• send it to you, or someone else, in a portable format
• stop relying on legitimate interests, where that’s my basis

Email privacy@overton.cloud. There’s no charge and I’ll respond within one month. If you’re unhappy with how I’ve handled your data, you can also complain to the Information Commissioner’s Office at ico.org.uk.

Children

My services are aimed at businesses. I don’t knowingly collect data about anyone under 18.

Changes

If I add or drop a supplier, this page gets updated, because the list above is meant to be complete. The date at the top tells you when it last changed.