Privacy

The short version

• I don't sell your data. To anyone. Ever.
• This site sets no cookies. Not one. That's why there's no banner asking you to accept any.
• If you email me, I keep the email. That's mostly it.
• You can ask me what I hold on you and I'll tell you, or delete it, within a month.
• If you think I've got it wrong, you can complain to me or straight to the regulator.

The rest of this page is the detail.

Who I am

Stillworks is the trading name of Nathan Pearson, a sole trader.

I'm the data controller for anything on this page.

There's no data protection officer, because there's no one else. It's me, and [email protected] reaches me directly.

When you visit this site

The site runs on servers in the UK, hosted by Krystal. Their systems keep standard web logs, your IP address, browser, and which pages you asked for, for a short period, so the server can work and so abuse can be investigated. That's necessary to run a website at all, and my lawful basis is legitimate interests.

Analytics. I use Plausible to see which pages people read and how they found the site. It's about a kilobyte of code, I run it myself on my own server in Germany rather than sending anything to Plausible the company, and it works differently from the analytics you may be used to: it sets no cookies, stores no identifier on your device, and can't follow you between sites. It counts pages, referrers and rough country. Never individuals.

That's why there's no cookie banner on this site. Consent under PECR is about storing or reading something on your device, and nothing here does. My lawful basis for the counting itself is legitimate interests: I need to know which pages are worth keeping.

I chose it over Google Analytics on purpose. If you're curious about the reasoning, ask.

Nothing else runs on this site. No embedded videos, no maps, no chat widget, no advertising pixels, no social media buttons, no fonts loaded from someone else's server, and no tracking of any kind.

Uptime monitoring. UptimeRobot requests a page every few minutes to check the site is up. It doesn't collect anything about you.

When you get in touch

If you email, phone or text me, I keep what you send: your name, contact details, the business you're asking about, and whatever you tell me about it.

I use it to answer you and, if it goes further, to quote for the work. My lawful basis is legitimate interests: you contacted me about a service, so it's reasonable to expect me to reply and keep a record of it.

Enquiries live in my inbox and in a CRM I built and run myself, hosted on my own server in Germany. Nobody else has access.

If nothing comes of it, I delete the lot after six months.

When you become a client

I keep what I need to do the work and get paid: your contact details, business details, billing information, the access I need to your accounts, and the correspondence between us. My lawful basis is performance of our contract, plus legal obligation for the accounting records.

Invoicing and accounts run through Xero. Payment details are handled by my bank and by Xero. I don't store card numbers anywhere.

When I work on your behalf

This is the part most agency privacy notices skip.

When I run SEO, ads or email for you, I'm usually handling your customers' data: mailing lists, ad audiences, enquiry records, review responses. For that data I'm a processor, not a controller: it's yours, I act on your instructions, and your own privacy notice governs it, not this one.

That relationship is set out in a data processing agreement which I'll give you before any work starts. It covers what I can and can't do with it, who my sub-processors are, security, and what happens when we part company. If you're a client and haven't got a copy, email [email protected] and I'll send one.

I don't use AI tools on client work.

Who else touches your data

Everyone I use, and why. If I add anyone, this list changes.

Where data goes outside the UK, that transfer is covered either by UK adequacy regulations, which cover the EU, Germany and New Zealand, or by the UK's International Data Transfer Addendum in the supplier's contract.

I've never sold data to anyone and I'm not going to start.

How long I keep things

I delete things when the time is up rather than keeping them because storage is cheap.

Marketing

If you join the mailing list, it's because you asked to. Every email has an unsubscribe link that works, and I keep a note that you unsubscribed so I don't accidentally add you again.

I occasionally email businesses I haven't worked with. Where I do, it's to companies rather than to individuals or sole traders, it's about services relevant to what they do, and it's from me personally rather than a sending platform. Tell me to stop and I will, permanently. It's not something I do much of. I dislike it as much as you do.

I don't buy lists, and I don't scrape them.

Your rights

You can ask me to:

• Tell you what I hold on you, and give you a copy
• Correct it if it's wrong
• Delete it, where I don't have a legal reason to keep it
• Stop using it for a particular purpose
• Hand it over to you or someone else in a portable format
• Stop marketing to you. This one is absolute, no reasons needed

Email [email protected]. I'll respond within one month and it costs you nothing. I may ask you to confirm who you are first, which is a protection for you rather than an obstacle.

Where I rely on your consent, the mailing list, you can withdraw it whenever you like, and withdrawing it doesn't affect anything that happened before. There's no analytics consent to withdraw, because there's nothing on your device to withdraw it from.

If you're unhappy

Tell me first: [email protected]. I'd rather fix it than have you go elsewhere with it.

But you don't have to. You can complain directly to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113. They're the UK's data protection regulator and complaining to them costs nothing.

Changes

If this changes I'll update the date below. If it changes in a way that actually affects you, a new supplier, a new purpose, I'll say so plainly rather than quietly editing it.

Last updated: 28 August 2026