Legal
Privacy Policy
What we collect when you visit this site or send us an enquiry, why we hold it, how long we keep it, who else touches it, and how to get it back or have it deleted. Written to be read once, not skimmed forever.
Who we are
Devdwell is a web design and development studio. We design, build and optimise Webflow websites for growing brands, and we have been doing it since 2022. We are a 100% remote team, there is no office to visit and no phone line to call, and email is the channel we actually answer.
For anything in this policy, write toinfo@devdwell.com. That address reaches a person, and it is the same address every other page on this site gives you.
Still to be completed. The legal entity behind Devdwell, its registered address and any company or tax registration number belong in this section. This draft does not invent them.
What this policy covers
It covers this website, devdwell.com, and the personal data we handle as a result of you visiting it, sending us an enquiry, or engaging us for work.
It does not cover:
- Websites we have built for clients. Those are the client's own sites, governed by the client's own privacy policy.
- Third-party services we link to, including social platforms and review sites. Their policies apply once you are on them.
- Data a client asks us to process inside their own systems during a project. There we act on the client's instructions, and their policy governs what happens to it.
What we collect
Things you tell us
If you send an enquiry, through the form on thecontact page or by writing to us directly, we receive whatever you put in it. That is typically your name, your email address, your company, your current website, a budget range, a timeline, which services you are interested in, and a description of what you want changed. The form also has an optional phone number field, and it is only there for people who tick the SMS box beside it; leave that box unticked and there is no reason to fill it in.
Everything except a name, an email address, a budget range and a couple of sentences is optional, and the form says so. Please do not send us anything sensitive, health information, political or religious views, anything about a criminal record. We have no reason to hold it and we do not want it.
Things your browser tells the server
Loading any page of this site sends our hosting provider the usual request data: your IP address, your browser and operating system, the page you asked for, the page that referred you and the time. This happens for every visitor to every website on the internet and is what makes serving a page possible.
Things measurement tools tell us
If you allow analytics, we see aggregate figures: which pages get read, roughly what part of the world readers are in, what devices they use, and which search or link brought them. We use it to decide which pages are worth keeping and which need rewriting. It does not tell us who you are.
Things a project needs
If you engage us, a build usually needs more: billing details, access to the accounts and platforms the site depends on, and the content, brand assets and copy that go into it. We ask for the least access that will do the job, and we ask to be removed from those accounts at handover.
How the enquiry form actually works
This is worth a section of its own, because two other companies are involved and you should not have to find that out from a network panel.
When you press send, the form posts toBasin, a form service run by Moonshot Ventures Inc. Basin receives what you typed, stores it against our account, and forwards it to one inbox atinfo@devdwell.com. It is a processor acting on our instructions, not a party with its own use for your enquiry, and it is listed with the others in the table below.
Alongside it, the contact page loadsGoogle reCAPTCHA, which is what stops the form filling our inbox with automated submissions. It is worth being precise about when: reCAPTCHA loads as the page loads, not when you press send, so opening the contact page is enough for Google to see the request, and it sets a cookie of its own in the course of deciding whether you are a person. That is the one thing on this website that happens before you answer the consent notice, and it happens on that page only.
What follows from that is the honest trade. Until you press send, nothing you have typed has left your device; abandoning the form halfway still leaves nothing behind, and that part has not changed. What has changed is that a sent enquiry now exists in Basin's system as well as in our inbox, and we delete it from Basin on the same schedule as everything else in section 06.
Two boxes sit above the send button and they are not the same kind of thing. One is required and records that you have read this policy and the terms. The other is optional, is never pre-ticked, and is the only thing that permits us to send you an SMS; it is worded the way the mobile carriers ask for, which is why it reads less like the rest of this page than we would like. Ticking it without giving a number does nothing, so the form asks for one at that point rather than filing a permission it cannot act on.
If you would rather neither company saw it, write toinfo@devdwell.com instead. It is the same inbox, it gets the same reply, and it reaches us without passing through either. That is not a lesser option and the form page says so too.
Why we hold it, and on what basis
Six purposes, and the legal basis each one rests on. If a purpose is not on this list, we are not using your data for it, and we do not sell personal data, ever, to anyone.
Answering your enquiry and quoting for work
- What
- Your name, email address, company, website, budget range, timeline and whatever you write in the brief.
- Basis
- Legitimate interests, you asked us to reply, and, once a quote is on the table, steps taken at your request before entering a contract.
Running a project you have engaged us for
- What
- Contact details, billing details, access to the accounts and platforms the build needs, and the content you give us to put on the site.
- Basis
- Performance of a contract.
Invoicing, accounts and tax records
- What
- Company name, billing address, amounts, dates and payment references.
- Basis
- Legal obligation.
Sending you SMS updates about an enquiry or a project
- What
- The phone number you typed into the form, and the fact that you ticked the SMS box.
- Basis
- Consent, and only consent. The box is optional, it is never pre-ticked, and nothing is sent to a number given without it. Reply STOP to any message and it stops; so does an email asking us to.
Understanding how this website is used
- What
- Aggregate analytics: pages viewed, approximate region, device and browser, and the site or search that sent you.
- Basis
- Consent, and only consent. The analytics script is not loaded and no cookie is set until you accept in the notice, wherever in the world you are, and withdrawing stops it and deletes the cookies.
Keeping the site up, fast and secure
- What
- Server and CDN logs: IP address, user agent, the page requested, the response and a timestamp.
- Basis
- Legitimate interests, a website that cannot be defended or debugged is not a website.
Showing our work
- What
- The finished site, the client name, and results that are already public or that the client has agreed we can publish.
- Basis
- Legitimate interests, and the portfolio clause in our terms. Any client can ask us to stop and we will.
How long we keep it
The honest general rule is that we keep things for as long as they are useful for the reason we were given them, and then we get rid of them. In practice that means:
- Enquiries that do not become projects
- Up to 24 months
- They sit in the mailbox in case you come back, then they are deleted. Ask sooner and we will delete sooner.
- Project records and correspondence
- The life of the engagement, plus 12 months
- So we can answer a question about a build after handover without asking you to re-explain it.
- Invoices and financial records
- As long as tax law requires
- Commonly six years. This is not a period we get to choose.
- Analytics
- No more than 14 months
- Aggregate figures. Nothing in them identifies an individual visitor to us.
- Server and CDN logs
- Days to weeks
- Set by the hosting provider and rotated automatically.
- Credentials and access you give us
- Removed at handover
- We ask to be taken off the accounts at the end of a project rather than keeping standing access.
You can shorten any of these except the financial records by asking. Seeyour rights.
Your rights
Which of these the law grants you depends on where you live. We will honour all of them for everyone regardless, because working out which ones apply to which visitor is more effort than simply doing the right thing.
- Access
- Ask what we hold about you and get a copy of it.
- Correction
- Have anything inaccurate fixed.
- Deletion
- Have it erased, unless we are legally required to keep it, invoices, mostly.
- Restriction
- Tell us to keep it but stop using it while something is in dispute.
- Portability
- Get the data you gave us in a machine-readable format, or have it sent elsewhere.
- Objection
- Object to anything we do on the basis of legitimate interests, including marketing of any kind.
- Withdrawing consent
- Where consent is the basis, withdraw it at any time. It does not undo what was lawful before you did.
- Complaining
- Take it to the data protection authority where you live. We would rather you came to us first, but it is your call.
How to use them
Email info@devdwell.com and say what you want. You do not need to use any particular form of words, quote a regulation or explain why. We may ask a question to confirm you are who you say you are, usually just replying from the address we hold is enough, and we will answer within one month. There is no charge.
If you are unhappy with how we handle it, you can complain to the data protection authority in your country. We would rather you told us first, but you are not obliged to.
How it is kept
- Everything on this site is served over HTTPS, so what you send is encrypted in transit.
- Accounts that hold client or enquiry data are protected with strong, unique passwords and two-factor authentication.
- Access is limited to the people who need it for the work in front of them, and client credentials are handed back at the end of a project rather than kept.
- We do not store card details. Payment providers handle those and we never see the full number.
No system is perfectly secure and anyone who tells you otherwise is selling something. If we ever discover a breach that puts your data at meaningful risk, we will tell you and the relevant authority as quickly as we can, with what we know and what we are doing about it.
Children
This is a business-to-business website and nothing on it is directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, tell us atinfo@devdwell.com and we will delete it.
Links to other sites
This site links out to client websites, to social platforms, to review sites and to Webflow. Following any of those links takes you somewhere we do not control and where this policy stops applying. Their own terms and privacy policies take over, and they are worth a glance if you are about to type anything into them.
Changes to this policy
We will update this page when what we do changes, a new provider, a new tool, a new reason for holding something. The date at the top of the page is the date of the current version, and it is the fastest way to tell whether anything has moved since you last looked.
If a change materially affects people who have already sent us an enquiry or engaged us, we will say so directly rather than relying on you to re-read the page.
Getting in touch
One address covers all of it, questions about this policy, requests to see or delete what we hold, complaints, and anything you think this page has got wrong:
A reply within one business day, from a person. If you would rather start somewhere else, the contact pagehas the form and everything that goes with it.