Privacy

The data controller is FatFish Digital Ltd, a company registered in England and Wales. We will publish our company number and ICO registration number here as soon as they are issued.

To ask about your data, use the contact form on our About page. That message comes to the people who do the work: David Lane, David Caswell and Owais Nizam.

We only collect what you give us, or what we have to see to do the job you asked for.

• Launch Audit: your first name, last name, email address, website address, optional notes about what you are building, and your confirmation that you own the site or have permission to have it audited.
• Playbook: your first name, last name and email address, so we can send What’s your next move? and address you by name.
• Contact form: your name, email, what you are building, an optional site address, and which package you asked about if you used the packages form.
• Technical logs: the sort of request data any website sees (for example IP address, time, and which page was requested), used to run the site, stop abuse and rate-limit the forms.

We do not buy lists. We do not scrape your customers’ data into a marketing database. We do not ask for passwords.

You apply for a Launch Audit with your name, email, a website address, and a tick that you own the site or have permission to have it audited. We will not start without that tick.

The audit looks at your site the way a customer and a security reviewer would. That means we request pages and public files that anyone on the internet could request. We check whether the site is actually live, whether search engines are allowed to find it, whether it loads, and whether obvious launch-blocking problems are present.

The database check is a safe, read-only probe. We ask whether a database or data API answers to a stranger who is not logged in. If it answers, we record that it did, and enough detail to tell you what is exposed. We do not log in with your credentials. We do not create, change or delete records. We do not try to guess passwords, bypass paywalls, or use exploits. We do not download your customers’ data to keep it.

We never change anything on your site as part of the Launch Audit. Changes only happen if you later buy a package.

• Launch Audit: to send you the report and video, and to tell our team that an audit was requested so we can do the work.
• Playbook: to send you What’s your next move?, the getting-started workbook. That is the only marketing-style email from this form. You can unsubscribe any time.
• Contact form: so we can reply to what you sent.
• If you later buy a package or Site Watch: to deliver the work, send invoices and service messages.

We do not sell your email address. We do not pass it to anyone for their marketing.

UK GDPR and the Data Protection Act 2018 require a lawful basis for each use.

• Contract, or steps you ask us to take before a contract: sending the playbook you asked for, answering a message, delivering an audit or package.
• Legitimate interests: stopping abuse of the forms, keeping basic logs so the site stays up, emailing the team that an audit or message came in so we can do the work, and keeping a record of what we sent you.
• Legal obligation: invoices, tax records, and anything the law says we must keep.
• Consent: only where we ask for it. The playbook form is a request to email you that document. You can withdraw consent by unsubscribing or writing to us.

We use a short list of suppliers to run the site. They only get what they need to do their job for us.

• Vercel hosts the website.
• Resend sends our emails.
• If you pay us through the site, Stripe will process the payment. We do not see your full card number.

Some of those suppliers are outside the UK. Where that happens we rely on a lawful transfer tool, such as the UK addendum to the EU standard contractual clauses, or an adequacy decision.

We will also share data if the law requires it, or if we have to protect you, us or someone else from serious harm.

• Launch Audit applications and reports: 12 months from the request, unless you buy work from us. If you do, we keep them with the job file for as long as we need them to deliver and support that work, then for up to 6 years where we need them for contracts, tax or disputes.
• Playbook sign-ups: until you unsubscribe or ask us to delete them.
• Contact messages: 24 months after we last heard from you, unless they become part of a paid job.
• Invoices and accounting records: 6 years, as UK law requires.
• Server logs used for security and rate limits: a short period, typically under 90 days, unless we need them to investigate abuse.

You can ask us to access the data we hold about you, correct it, delete it, restrict how we use it, or give you a copy in a portable form. You can object to uses based on legitimate interests. Where we rely on consent, you can withdraw it.

To do any of that, use the form on the About page and say what you want. We will respond within one month.

You can also complain to the Information Commissioner’s Office at ico.org.uk. We would rather fix it ourselves first.

This site is for people building and running businesses. We do not knowingly collect data about children.

If we change this notice in a way that matters, we will update this page and the date at the top. For a significant change we will also email people we are still in contact with, where we have a working address.