Privacy and analytics.

This website is operated by Thomas Howcroft. It has no user accounts, comments or checkout.

The project brief form sends the details you choose to provide over HTTPS to a protected intake area at SiteGround, my personal mailbox and my private local enquiry CRM. It is separate from XO3D systems.

I use enquiry information to assess fit, reply, manage follow-up and keep necessary business records. Submitting a brief is not consent to receive newsletters or other marketing.

I rely on steps you ask me to take before a possible contract where that applies, and on legitimate interests in responding to genuine business enquiries and maintaining proportionate business records. I do not use enquiry details for unrelated purposes.

The form asks for your name, work email, company, role, the type and stage of work, timeframe, problem, desired change, likely investment, referral source and any high-level confidentiality requirement you choose to state. Do not submit confidential material in the form.

A protected delivery copy is stored outside the public website so a temporary email problem cannot lose the enquiry. That delivery copy is normally removed within 30 days. A short-lived keyed HMAC derived from the submitting IP address is used only to limit automated abuse; the raw IP address is not stored in the enquiry record and the abuse record is normally removed within 48 hours.

The private CRM can identify lost or archived enquiry records that have not been updated for at least 24 months for manual retention review. Deletion and anonymisation are not automatic. Records connected to active clients, contracts, disputes, tax or other legal duties may be kept for as long as those requirements apply.

Direct emails to tom@thomashowcroft.com may also create or update a private CRM record so I can manage the conversation and any agreed follow-up.

The booking form asks for your name, email address and chosen time. You can also provide your company, website and a note about what you would like to discuss. Please do not include confidential information.

I use these details to arrange and hold the call. They are stored in the site's private storage on its UK web host, SiteGround, in the same place as project enquiries. I receive an email notification when you request a call. Booking details are deleted about 90 days after the call.

A one-way hash of your IP address is kept for 48 hours to limit abuse. Your raw IP address is not stored in the booking record.

Booking a call does not add you to a marketing list. To ask for access to your booking details or request deletion, email tom@thomashowcroft.com.

The Index signup asks only for your email address and a separate, unticked agreement to receive new Howcroft Index notes from Thomas Howcroft by email. I rely on that consent and do not treat a project enquiry or direct email as marketing consent.

The protected intake record includes your email address, the consent statement and version, when you agreed, the source page and a submission reference. It is imported into a separate subscriber list in my private local CRM. A single-use confirmation link expires after 48 hours. The address remains unverified until you review that link and confirm, and unverified records cannot receive Index updates. A protected delivery copy is normally removed within 30 days, and the same short-lived keyed abuse limit described above applies.

If a confirmation link expires, you can request a replacement. Resends are limited to prevent abuse and the response does not reveal whether an address is on the list. I use this list only for new Howcroft Index notes. It is not shared with XO3D or added to an unrelated sales list.

Every Index email includes a consent-specific public unsubscribe link and supported mailbox providers can submit the same request using one-click unsubscribe. An unsubscribe creates a durable suppression record so the address cannot be selected or mailed by mistake. Joining again requires a fresh unticked consent action and a new email confirmation. Old unsubscribe links cannot change a later consent.

You can withdraw consent at any time using the email link or by emailing tom@thomashowcroft.com. A minimal suppression and consent history may be retained to prove the request and prevent accidental re-addition.

Google Analytics 4 is used only after you choose Allow analytics. It helps me understand which pages are useful and how people find the site.

When a project brief is accepted, its record is saved privately. If you have allowed analytics, the site may record a generate_lead event in Google Analytics 4. A separate cookieless server event may be sent only when its measurement route is configured. These events contain no name, email address, company, message content or advertising identifiers. An Index signup is recorded in Analytics only if you have allowed analytics.

It may collect pages viewed, interactions, referral source, approximate region, and browser or device details. With consent, it may also record clicks on Work, Contact and external proof links, whether the project brief was started or successfully submitted, and whether an Index signup succeeded. It does not receive form answers or email addresses.

I do not use Analytics for advertising, remarketing, Google Signals or ad personalisation, and I do not intentionally send names, email addresses, company names or message content to Analytics.

The Analytics cookies are configured to expire after no more than 180 days. User-level and event-level data is configured for the shortest standard retention period of two months. Google may keep aggregate standard reports for longer.

I rely on your consent for this analytics processing. Google explains its own processing in the Google Privacy Policy.

The site stores one local preference called th_analytics_choice so it can remember whether you allowed or rejected analytics. This preference is used only to remember your choice.

If you reject or withdraw permission, the Google Analytics tag will not load on later pages and the site will remove Analytics cookies it can access. Withdrawing permission stops new collection but does not remove information already included in aggregate reports.

Review analytics choice

You can also use Google's Analytics opt-out browser add-on.

The site is hosted by SiteGround. Like most web hosts, it may process technical logs needed to deliver and protect the site. These can include IP address, date and time, requested URL, referrer, browser details and security information.

This processing supports site delivery, reliability and security. I rely on legitimate interests for these basic operational logs. SiteGround controls its own infrastructure and log retention and explains its processing in the SiteGround Privacy Policy.

You may ask what personal information I hold about you, request a correction or deletion where the law provides that right, object to processing, withdraw Index email consent, or withdraw analytics consent at any time.

Contact tom@thomashowcroft.com. You may also raise a concern with the UK Information Commissioner's Office.

External websites linked from this site have their own privacy practices. Their policies apply after you leave thomashowcroft.com.