Privacy Policy

1. Who we are

forklab.studio is a trading name of Michal Winiarski, a sole trader based at 21 Trumpeter Rise, Norwich, NR15 2DY, United Kingdom. For the personal information described in this policy, we are the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are registered with the Information Commissioner's Office (ICO) under number ZC262039.

If you have any question about your information, email hello@forklab.studio. You will always get a reply from a person.

2. What we collect and why

We only collect what we need. For each purpose below we list the information and the lawful basis we rely on under UK GDPR.

• Consultation bookings: your name, email address, company, phone number, time zone, the time you chose and, if you used our configurator, the options you selected. We use them to arrange, prepare and remind you about the call, and to create the Google Calendar event with its Google Meet link. Lawful basis: steps you asked us to take before a possible contract.
• Messages you send us by email or WhatsApp: your contact details and whatever you write. We use them to reply. Lawful basis: our legitimate interest in answering enquiries.
• Clients and prospective clients: contact and billing details, the answers and files you give us in the website brief (such as your logo, photos and menu), and our correspondence. We use them to prepare and agree your website, then to design, build and support it and to invoice you. Lawful basis: steps you ask us to take before a contract, our contract with you, and our legal obligation to keep accounting records.
• Restaurants we may contact: business information from public sources such as Google Maps, the restaurant's own website and its social media profiles. This can include the name of the owner or manager, the business phone number and the business email address. We use it to decide which restaurants to offer our services to and to contact them. Lawful basis: our legitimate interest in offering our services to businesses. Every message tells you how to ask us not to contact you again, and we stop as soon as you ask.
• Website usage: pages visited, device and browser type, approximate location and how the page performed. Vercel Web Analytics measures this without cookies (lawful basis: our legitimate interest in running a fast, working website). Google Analytics and Microsoft Clarity only run if you accept analytics cookies (lawful basis: your consent).
• Security: when you submit a form, Google reCAPTCHA checks your browser and IP address to tell people and bots apart, and our error monitoring (Sentry) receives technical details when something breaks. Sentry never receives what you type into forms. Lawful basis: our legitimate interest in keeping the website secure.

3. If you booked a table at a restaurant we work with

Some restaurants use the forklab.studio platform for their website and table bookings. When you book a table with one of them, the restaurant is the controller of your booking details and forklab.studio only processes them on the restaurant's behalf and under its instructions. The restaurant's own privacy policy explains how it uses your information, and requests about that information are best sent to the restaurant. If you write to us instead, we will pass your request on.

4. Who we share information with

We do not sell or rent personal information, and we do not use it for advertising. We share it only with the providers that run our services, each of which only receives what it needs and processes it on our behalf:

• Vercel: website and platform hosting, Web Analytics and Speed Insights.
• Neon: the database that stores consultation bookings and platform data.
• Google Workspace: our email, Google Calendar and Google Meet for consultation calls.
• Google reCAPTCHA: spam protection on our forms.
• Google Analytics and Microsoft Clarity: only if you accept analytics cookies. In Clarity, text you type into forms is masked and never recorded.
• Resend: sends booking confirmations, reminders and notification emails.
• Cloudflare: domain name services, and storage for the photos and files uploaded to the platform and the website brief.
• Clerk: sign-in for the forklab.studio platform.
• Sentry: error monitoring.
• WhatsApp: if you choose to message us there, your message is handled by WhatsApp under its own privacy policy.

5. International transfers

Some of these providers store or access information outside the UK, mainly in the European Economic Area and the United States. Where they do, the transfer is covered by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or by the UK International Data Transfer Addendum to the EU standard contractual clauses.

6. How long we keep it

• Consultation bookings: 2 years after the consultation, unless you become a client.
• Client records, contracts and invoices: 6 years after the end of the tax year they relate to, as UK tax law requires.
• Website brief answers and files: if we go ahead, for as long as we work together and deleted within 12 months after the work ends; if we do not, deleted automatically 6 months after the brief was last changed.
• Restaurants we may contact: 2 years after our last contact, or straight away if you ask us not to contact you. We then keep only your business name and address on a do-not-contact list, so that we do not contact you again.
• Emails and messages: 2 years after the conversation ends, unless they form part of a client record.
• Analytics: Google Analytics keeps data for up to 14 months, Microsoft Clarity keeps session recordings for 30 days and heatmaps for up to 13 months, and Sentry keeps error reports for up to 90 days.

7. Your rights

Under UK GDPR you have the right to:

• get a copy of the personal information we hold about you;
• have inaccurate information corrected;
• have your information deleted;
• restrict how we use it;
• object to how we use it, including an absolute right to object to direct marketing;
• receive information you gave us in a portable format;
• withdraw your consent at any time, for example with "Cookie settings" at the bottom of every page. This does not affect what we did before you withdrew it.

8. How to use your rights or complain

Email hello@forklab.studio. It is free, and we reply within one month. We may ask you to confirm your identity before we share or delete anything.

If you are unhappy with how we handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

We do not make decisions about you based solely on automated processing.

9. Cookies

A cookie is a small piece of information that a website stores in your browser.

forklab.studio uses a functional cookie that remembers your region, so prices are shown in your currency. Google reCAPTCHA may set its own cookies when you use the booking form, to tell people and bots apart.

If you accept analytics cookies, Google Analytics sets cookies named _ga and _ga_<id> to count visits and tell returning visitors apart. They last up to 2 years. Microsoft Clarity sets cookies named _clck and _clsk (and Microsoft may set CLID, MUID and related cookies) to link page views in one visit and recognise returning visitors, for up to 1 year. They are not set unless you click Accept, and you can change your choice at any time with "Cookie settings" at the bottom of every page.

Vercel Web Analytics and Speed Insights do not use cookies. We do not use advertising or remarketing cookies.

You can also block or delete cookies in your browser settings. The website will still work, although the booking form may ask you to try again if reCAPTCHA cannot run.

10. Security

Information is encrypted in transit and stored with providers that encrypt it at rest. Access is limited to the accounts that need it, and those accounts are protected with two-step verification. Database backups are encrypted. No system is completely secure, but if a breach ever puts your information at risk, we will tell you, and the ICO where the law requires it.

11. Children

Our services are for businesses and are not aimed at children. We do not knowingly collect information from anyone under 16.

12. Changes to this policy

We update this policy when our services or the law change. The effective date at the top shows the latest version. If a change significantly affects how we use information we already hold, we will tell our clients by email.