Privacy Policy

Who this is

Automation Experience is a done-for-you build service for established service businesses. We design, build and operate the internal systems established service businesses use to turn enquiries into booked work.

This policy covers automationexperience.net. It does not cover the platforms our clients run, which have their own policies and their own controllers.

If you want anything on this page actioned, the fastest route is to reply to whatever email brought you here, or to submit the form and say so in the last question.

What we collect, and when

Nothing at all if you only read the site. There is no analytics script, no advertising pixel, no session recorder and no consent banner, because there is nothing to consent to.

If you complete the application at /apply/, we receive exactly what you typed into it:

• Your first name and email address, which are the two required answers.
• Your answers to the other questions: business name, website, the kind of operation you run, your role, number of locations, market, what is breaking, enquiry volume, what a good outcome looks like, which systems are in your journey today, your timeline, and where you came across us.
• Technical information sent by your browser with the submission: your IP address, your user agent string, and the page that referred you.

The IP address and user agent are stored because a public form endpoint that keeps no record of who submitted what cannot be defended against abuse. They are not used for profiling, and they are not shared.

Why we collect it

To read your application, decide whether there is a system worth building for you, and reply. That is the whole purpose.

We do not sell it, rent it, trade it, or use it to build a list that gets marketed to. If we later want to send you something that is not a reply to your own application, we will ask first.

The lawful basis, where that framing applies to you, is your request to enter into a business relationship, together with our legitimate interest in operating and defending a contact form.

Where it goes

The form posts to a small PHP endpoint on our own hosting. That endpoint validates the submission, discards anything that fills the hidden anti-spam field, and writes the submission to a file outside the public web root as one line of JSON per application. That file is not reachable from the web.

From there, depending on how the deployment is configured at the time you submit, it may also be:

• Forwarded to our own workflow system, which creates the record we work from.
• Emailed to a mailbox on our own domain, so a human sees it.

That is the complete list. There is no CRM sitting behind this form that we have not named, and no data enrichment service is called with your address.

Third parties

Three, and only three at the time of writing.

• Our hosting provider, which operates the servers this site and the submission file sit on. They are a processor acting on our instructions.
• Our email provider, if a notification is sent, which is a mailbox on our own domain.
• Google Fonts is NOT used. Type on this site is self-hosted, so your browser does not contact a font CDN when you load a page here.

No advertising network, analytics vendor, heatmap tool, chat widget or social pixel receives anything from this site, because none of them is on it.

How long we keep it

Applications from people we work with are kept for as long as the relationship lasts and then for as long as we need them for tax and contractual records.

Applications from people we do not end up working with are kept for two years, so that if you come back we know what you told us the first time, and are then deleted.

You can ask for yours to be deleted sooner and we will do it, without asking you why.

Your rights over it

Wherever you live, you can ask us to tell you what we hold about you, send you a copy, correct it, or delete it. We will do all four on request.

If you are in the UK or the EU, those rights come from UK GDPR and GDPR respectively, and you also have the right to object to processing and to complain to your supervisory authority.

If you are in California, the CCPA gives you the right to know, delete, and opt out of sale. We do not sell personal information, so the third one has nothing to act on, and we will not discriminate against you for exercising any of them.

There is no account to log into and no dashboard, so all of this happens by email rather than through a self-service portal. We would rather answer you than build a portal nobody uses.

Security, described honestly

The site is served over HTTPS. The submission file is written outside the public web root with restrictive file permissions, and the endpoint validates and length-limits every field before writing anything.

The endpoint's configuration, which is the only account-specific part of it, is held in a file that is deliberately excluded from our public code repository.

No system is perfectly secure and we are not going to claim ours is. What we can say is that the amount of your data sitting on this website is small by design, because the smallest surface is the easiest one to defend.

Children

This is a business-to-business service and it is not directed at anybody under 18. We do not knowingly collect information from children, and if we learn that we have, we will delete it.

Changes to this policy

If what this site does changes, this page changes in the same commit that changes it. The date at the top is the date of the last such change.

We will not quietly broaden this policy to permit something we have started doing. If we start doing something materially different with your information, we will say so.