Privacy Policy

Who this is

Automation Experience is a done-for-you build service for established service businesses. We design, build and operate the internal systems established service businesses use to turn enquiries into booked work.

This policy covers automationexperience.net. It does not cover the platforms our clients run, which have their own policies and their own controllers.

If you want anything on this page actioned, the fastest route is to reply to whatever email brought you here, or to submit the form and say so in the last question.

What we collect, and when

If you only read the site, nothing is collected until you choose to allow it. Nothing loads before you answer the banner, and if you decline, nothing loads at all. There is no session recorder and no heatmap tool on this site in any case.

If you complete the application at /apply/, we receive exactly what you typed into it:

• Your first name and email address, which are the two required answers.
• Your answers to the other questions: business name, website, the kind of operation you run, your role, number of locations, market, what is breaking, enquiry volume, what a good outcome looks like, which systems are in your journey today, your timeline, and where you came across us.
• Technical information sent by your browser with the submission: your IP address, your user agent string, and the page that referred you.
• How you arrived: the campaign tags on the link you clicked, any advertising click identifier on it, the site that linked you, and the first page of ours you landed on. This is read from the address of the first page you opened, held for the length of that one visit, and submitted with your application so we know which of our own efforts reached you. It is not a profile, it does not follow you between visits, and it is not shared with anybody.

The IP address and user agent are stored because a public form endpoint that keeps no record of who submitted what cannot be defended against abuse. They are not used for profiling, and they are not shared.

Why we collect it

To read your application, decide whether there is a system worth building for you, and reply. That is the whole purpose.

We do not sell it, rent it, trade it, or use it to build a list that gets marketed to. If we later want to send you something that is not a reply to your own application, we will ask first.

The lawful basis, where that framing applies to you, is your request to enter into a business relationship, together with our legitimate interest in operating and defending a contact form.

Where it goes

The form posts to a small PHP endpoint on our own hosting. That endpoint validates the submission, discards anything that fills the hidden anti-spam field, and writes the submission to a file outside the public web root as one line of JSON per application. That file is not reachable from the web.

From there, depending on how the deployment is configured at the time you submit, it may also be:

• Forwarded to our own workflow system, which creates the record we work from.
• Emailed to a mailbox on our own domain, so a human sees it.

That is the complete list. There is no CRM sitting behind this form that we have not named, and no data enrichment service is called with your address.

Third parties

Our hosting provider, our email provider, and whichever of the measurement services below you have allowed.

• Our hosting provider, which operates the servers this site and the submission file sit on. They are a processor acting on our instructions.
• Our email provider, if a notification is sent, which is a mailbox on our own domain.
• Google Fonts is NOT used. Type on this site is self-hosted, so your browser does not contact a font CDN when you load a page here.
• Cal.com, if you choose to book a call. Pressing the button on the confirmation page loads their booking calendar and sends them the name and email address you already gave us, so you do not type them twice. Nothing loads and nothing is sent unless you press it.
• Google Analytics, if you allow it. It records which pages you viewed, which buttons you pressed, and how far through the application you got. We do not send it your name, your email address, or anything else you typed into the form. Google's own terms forbid that, and we have no use for it there. If you decline, it is not loaded at all. Google offers a mode in which the tag runs anyway without storing anything and estimates the rest; we do not use it, because this page says nothing loads if you decline and that ought to be true.

That is the complete list. There is no heatmap tool, no session recorder, no chat widget and no data broker, and none of the above receives anything you typed into the form.

Cookies, and the banner

The banner appears once, on your first visit, and does not come back once you have answered it. Declining is one press, the same size and in the same place as accepting, because a choice that is harder to refuse than to accept is not really a choice.

Nothing loads before you answer it. Not the analytics tag, not the advertising pixel, nothing. Most sites load everything and then ask; this one asks first, which is both what the rules require and what the banner claims is happening.

Two things are stored whatever you choose, and neither is a tracker:

• Your answer to the banner, so we do not ask again. It stays in your own browser and is never sent anywhere.
• Your part-completed application, if you start one, so that closing the tab does not lose seven minutes of typing. Also in your own browser, and cleared when you submit.

To change your mind, clear this site's data in your browser settings and the banner will ask again on your next visit. We would rather point you at the browser control that genuinely works than build a preferences panel that only appears to.

How long we keep it

Applications from people we work with are kept for as long as the relationship lasts and then for as long as we need them for tax and contractual records.

Applications from people we do not end up working with are kept for two years, so that if you come back we know what you told us the first time, and are then deleted.

You can ask for yours to be deleted sooner and we will do it, without asking you why.

Your rights over it

Wherever you live, you can ask us to tell you what we hold about you, send you a copy, correct it, or delete it. We will do all four on request.

If you are in the UK or the EU, those rights come from UK GDPR and GDPR respectively, and you also have the right to object to processing and to complain to your supervisory authority.

If you are in California, the CCPA gives you the right to know, delete, and opt out of sale. We do not sell personal information, so the third one has nothing to act on, and we will not discriminate against you for exercising any of them.

There is no account to log into and no dashboard, so all of this happens by email rather than through a self-service portal. We would rather answer you than build a portal nobody uses.

Security, described honestly

The site is served over HTTPS. The submission file is written outside the public web root with restrictive file permissions, and the endpoint validates and length-limits every field before writing anything.

The endpoint's configuration, which is the only account-specific part of it, is held in a file that is deliberately excluded from our public code repository.

No system is perfectly secure and we are not going to claim ours is. What we can say is that the amount of your data sitting on this website is small by design, because the smallest surface is the easiest one to defend.

Children

This is a business-to-business service and it is not directed at anybody under 18. We do not knowingly collect information from children, and if we learn that we have, we will delete it.

Changes to this policy

If what this site does changes, this page changes in the same commit that changes it. The date at the top is the date of the last such change.

We will not quietly broaden this policy to permit something we have started doing. If we start doing something materially different with your information, we will say so.