Privacy notice
Version 1.0, 11 October 2026.
1. Who we are
FirstLook Sites is the trading name of Jamie Atherton, a sole trader. Address: 21 Farringford Gardens, Warrington, WA4 3ED. ICO: Registered with the ICO; registration number to follow. We are the data controller for the data below. Contact for privacy matters: hello@firstlooksites.co.uk. We work by email only. We are an AI-assisted studio.
2. What we collect and why
| Who | Data | Source | Purpose | Lawful basis (UK GDPR) |
|---|---|---|---|---|
| Businesses we contact (outreach) | Company name and number, business website, generic business email (info@, hello@ and similar) taken from their own public site, publicly measured site facts (speed score, HTTPS, copyright year) | Companies House, the company's own website | To send one proportionate business-to-business email offering a free preview and a possible website rebuild, plus at most one follow-up | Legitimate interests (Art. 6(1)(f)); our assessment is available on request |
| Enquirers | Name, email, business name, message | You, via our form or email | To reply and quote | Legitimate interests / steps before a contract |
| Customers | Contact name, email, business details, site content, billing details (Stripe handles card data; we never see full card numbers) | You, Stripe | To deliver and bill for services, keep records | Contract; legal obligation (accounts and tax records) |
| Visitors who use our free website check | The address you type in is used for the check but not stored. We keep a salted hash of your IP address (not the IP itself) for up to 1 hour, only to limit each visitor to 5 checks an hour | You | To run the free check and prevent abuse | Legitimate interests |
| People who opt out | Email address and time of opt-out | You (unsubscribe link, form or reply) | To make sure we never contact you again | Legitimate interests; legal obligation (PECR) |
| Website visitors | Basic technical logs held by our host (IP address, browser) | Automatically | Security and operation | Legitimate interests |
We email businesses only (limited companies, LLPs and PLCs) at generic company addresses. We do not cold-email sole traders, ordinary partnerships or private individuals, and we check the company is active on Companies House first.
3. Previews
Previews we build are private, not indexed by search engines, marked as unsolicited and not affiliated, and deleted after 14 days or on request. They use no one else's logos or photos.
4. Who we share data with
Processors that help us run the business: Netlify (hosting and forms), Stripe (payments), our email provider Resend (email delivery), and AI model providers used to draft copy (we send only public business text, not customer personal data beyond what is needed). Some are outside the UK; transfers rely on UK-approved safeguards such as the UK addendum to standard contractual clauses or the UK-US data bridge where applicable. We do not sell data. Opt-outs are recorded in a small store on Netlify (Netlify Blobs) holding the email address and the time you opted out, and are copied to our permanent do-not-contact list. Our email provider Resend delivers our emails and sees the recipient address and message.
5. How long we keep it
- Prospect records: up to 6 months from the last contact, unless they become a customer or reply.
- Do-not-contact (suppression) list (anyone who asks us to stop): kept permanently, holding only the minimum needed (the email address) so we never contact you again. It applies to everyone working for us, including our AI agents.
- Enquiries: 12 months.
- Customer and invoice records: 6 years after the tax year (HMRC requirements).
- Previews: deleted after 14 days.
6. Your rights
You can ask us to access, correct or erase your data, restrict or object to our use of it. You can object to our outreach at any time: use the one-click unsubscribe link in any email, our unsubscribe page, or reply "stop", and we will add you to our do-not-contact list. You may also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).
7. Cookies
Our website does not use analytics, advertising or tracking cookies, and has no third-party tracking scripts. Our enquiry and unsubscribe forms are handled by Netlify Forms, which stores the details you submit but does not need a tracking cookie from us. If you pay, you are taken to Stripe's hosted checkout page, which sets its own cookies under Stripe's cookie policy. If we add analytics later, we will add a consent banner first.
8. Free website check
The check tool fetches the public page you enter and reports PageSpeed (via Google's PageSpeed API), HTTPS and copyright-year results. It does not keep the address you entered or the results.
9. Changes
We will post updates here with the date.