Straight answers
Plain English, no burying. What we collect, why, who touches it, and how to make us stop. Cookie specifics live in the cookie policy.
This website is operated by TOTAL TOOLS LTD trading as Oxwyn Studio, company number 08355850, registered office Unit 4b, 4c and 4d Dales Manor Business Park, Grove Road, Sawston, Cambridge CB22 3TJ, United Kingdom. For anything in this policy, contact hello@oxwynstudio.com.
Contact briefs: when you submit the contact form we collect your name, email, phone (optional), business name, budget and project selections and your message. Lawful basis: taking steps at your request before entering a contract. We use it solely to respond to your enquiry.
Newsletter: your email address, with your consent, to send the newsletter. Every email includes an unsubscribe link.
Analytics: with your consent (the cookie banner), Google Analytics collects usage data such as pages viewed, approximate location and device information. Lawful basis: consent, which you can withdraw at any time via Cookie settings in the footer. Separately, Vercel Web Analytics counts page views without cookies and without collecting anything that identifies you, which is why it needs no consent and is not listed on the cookies page.
X-Ray scans: when you run a website scan we record the address you entered, the resulting report, your IP address, the approximate location the edge network reports and your browser user agent. Lawful basis: legitimate interests, namely preventing abuse of a free public tool and being able to recognise your enquiry if you contact us. You are told this on the form and asked to confirm before any scan runs. If you then ask us for the full report we also collect the name, email and business you give us, on the basis of taking steps at your request.
Client records: if you become a client we keep contact, contract and service records to perform the contract and meet legal obligations.
We use trusted processors to run this site and our services: Vercel (hosting and cookieless web analytics), Supabase (database and authentication), Resend (email delivery), and Google (analytics, with consent, and PageSpeed Insights when you run a website X-Ray). Each processes data under contract with us and, where data leaves the UK or EEA, under the UK IDTA or EU Standard Contractual Clauses.
X-Ray scans where you did not ask for the full report: 90 days, then deleted automatically. Where you did ask for it, the scan is kept with your enquiry and follows the contact brief period below. Contact briefs: up to 24 months from last contact, then deleted. Newsletter data: until you unsubscribe. Analytics data: per the retention settings of Google Analytics (14 months). Client and contract records: 6 years after the relationship ends, for legal and tax obligations.
You can ask for access, correction, deletion, restriction or portability of your personal data, and object to processing, by emailing hello@oxwynstudio.com. You can withdraw analytics consent at any time via Cookie settings. You can complain to the UK Information Commissioner's Office (ico.org.uk) or your local supervisory authority.
Data is encrypted in transit, access is restricted by role at the database level, and payment card details never touch our systems (they are handled by Stripe). We notify affected users and regulators of any qualifying breach as the law requires.
We use AI tooling in research, content drafting and engineering, always under human review by a senior engineer before anything ships. Where a client deliverable includes AI-generated assets, such as imagery, we say so in the deliverable.
We do not feed client confidential data or personal data into public AI models without a written agreement covering that use. Your contact brief is processed by the providers listed in section 3 and nothing else.
Last updated: July 2026. This page is maintained as a working document and reviewed with our legal advisers; the version published here applies.
