Legal
Privacy Policy
What we collect when you visit this site or send us an enquiry, why we hold it, how long we keep it, who else touches it, and how to get it back or have it deleted. Written to be read once, not skimmed forever.
Who we are
Devdwell is a web design and development studio. We design, build and optimise Webflow websites for growing brands, and we have been doing it since 2022. We are a 100% remote team, there is no office to visit and no phone line to call, and email is the channel we actually answer.
For anything in this policy, write toinfo@devdwell.com. That address reaches a person, and it is the same address every other page on this site gives you.
Still to be completed. The legal entity behind Devdwell, its registered address and any company or tax registration number belong in this section. This draft does not invent them.
What this policy covers
It covers this website, devdwell.com, and the personal data we handle as a result of you visiting it, sending us an enquiry, or engaging us for work.
It does not cover:
- Websites we have built for clients. Those are the client's own sites, governed by the client's own privacy policy.
- Third-party services we link to, including social platforms and review sites. Their policies apply once you are on them.
- Data a client asks us to process inside their own systems during a project. There we act on the client's instructions, and their policy governs what happens to it.
What we collect
Things you tell us
If you send an enquiry, through the form on thecontact page or by writing to us directly, we receive whatever you put in it. That is typically your name, your email address, your company, your current website, a budget range, a timeline, which services you are interested in, and a description of what you want changed.
Everything except a name, an email address, a budget range and a couple of sentences is optional, and the form says so. Please do not send us anything sensitive, health information, political or religious views, anything about a criminal record. We have no reason to hold it and we do not want it.
Things your browser tells the server
Loading any page of this site sends our hosting provider the usual request data: your IP address, your browser and operating system, the page you asked for, the page that referred you and the time. This happens for every visitor to every website on the internet and is what makes serving a page possible.
Things measurement tools tell us
If you allow analytics, we see aggregate figures: which pages get read, roughly what part of the world readers are in, what devices they use, and which search or link brought them. We use it to decide which pages are worth keeping and which need rewriting. It does not tell us who you are.
Things a project needs
If you engage us, a build usually needs more: billing details, access to the accounts and platforms the site depends on, and the content, brand assets and copy that go into it. We ask for the least access that will do the job, and we ask to be removed from those accounts at handover.
How the enquiry form actually works
This is worth a section of its own, because it is unusual and it is in your favour.
The form on the contact page does not post to a server. There is no database behind this website and no third-party form service collecting submissions. When you press send, the page composes an email (subject line, your answers laid out as plain text), and hands it to your own mail client. You see it before it goes. You press send, or you do not.
Two consequences follow. First, until you actually send that email, nothing you typed has left your device; abandoning the form halfway leaves nothing behind. Second, once you do send it, the message travels through your own email provider and arrives in ours, and from that point it is an ordinary email subject to everything else in this policy.
If your browser is set up without a mail client, the form leaves a link to the composed message so you can open it another way, andinfo@devdwell.com always works.
Why we hold it, and on what basis
Six purposes, and the legal basis each one rests on. If a purpose is not on this list, we are not using your data for it, and we do not sell personal data, ever, to anyone.
Answering your enquiry and quoting for work
- What
- Your name, email address, company, website, budget range, timeline and whatever you write in the brief.
- Basis
- Legitimate interests, you asked us to reply, and, once a quote is on the table, steps taken at your request before entering a contract.
Running a project you have engaged us for
- What
- Contact details, billing details, access to the accounts and platforms the build needs, and the content you give us to put on the site.
- Basis
- Performance of a contract.
Invoicing, accounts and tax records
- What
- Company name, billing address, amounts, dates and payment references.
- Basis
- Legal obligation.
Understanding how this website is used
- What
- Aggregate analytics: pages viewed, approximate region, device and browser, and the site or search that sent you.
- Basis
- Consent, and only consent. The analytics script is not loaded and no cookie is set until you accept in the notice, wherever in the world you are, and withdrawing stops it and deletes the cookies.
Keeping the site up, fast and secure
- What
- Server and CDN logs: IP address, user agent, the page requested, the response and a timestamp.
- Basis
- Legitimate interests, a website that cannot be defended or debugged is not a website.
Showing our work
- What
- The finished site, the client name, and results that are already public or that the client has agreed we can publish.
- Basis
- Legitimate interests, and the portfolio clause in our terms. Any client can ask us to stop and we will.
How long we keep it
The honest general rule is that we keep things for as long as they are useful for the reason we were given them, and then we get rid of them. In practice that means:
- Enquiries that do not become projects
- Up to 24 months
- They sit in the mailbox in case you come back, then they are deleted. Ask sooner and we will delete sooner.
- Project records and correspondence
- The life of the engagement, plus 12 months
- So we can answer a question about a build after handover without asking you to re-explain it.
- Invoices and financial records
- As long as tax law requires
- Commonly six years. This is not a period we get to choose.
- Analytics
- No more than 14 months
- Aggregate figures. Nothing in them identifies an individual visitor to us.
- Server and CDN logs
- Days to weeks
- Set by the hosting provider and rotated automatically.
- Credentials and access you give us
- Removed at handover
- We ask to be taken off the accounts at the end of a project rather than keeping standing access.
You can shorten any of these except the financial records by asking. Seeyour rights.
Your rights
Which of these the law grants you depends on where you live. We will honour all of them for everyone regardless, because working out which ones apply to which visitor is more effort than simply doing the right thing.
- Access
- Ask what we hold about you and get a copy of it.
- Correction
- Have anything inaccurate fixed.
- Deletion
- Have it erased, unless we are legally required to keep it, invoices, mostly.
- Restriction
- Tell us to keep it but stop using it while something is in dispute.
- Portability
- Get the data you gave us in a machine-readable format, or have it sent elsewhere.
- Objection
- Object to anything we do on the basis of legitimate interests, including marketing of any kind.
- Withdrawing consent
- Where consent is the basis, withdraw it at any time. It does not undo what was lawful before you did.
- Complaining
- Take it to the data protection authority where you live. We would rather you came to us first, but it is your call.
How to use them
Email info@devdwell.com and say what you want. You do not need to use any particular form of words, quote a regulation or explain why. We may ask a question to confirm you are who you say you are, usually just replying from the address we hold is enough, and we will answer within one month. There is no charge.
If you are unhappy with how we handle it, you can complain to the data protection authority in your country. We would rather you told us first, but you are not obliged to.
How it is kept
- Everything on this site is served over HTTPS, so what you send is encrypted in transit.
- Accounts that hold client or enquiry data are protected with strong, unique passwords and two-factor authentication.
- Access is limited to the people who need it for the work in front of them, and client credentials are handed back at the end of a project rather than kept.
- We do not store card details. Payment providers handle those and we never see the full number.
No system is perfectly secure and anyone who tells you otherwise is selling something. If we ever discover a breach that puts your data at meaningful risk, we will tell you and the relevant authority as quickly as we can, with what we know and what we are doing about it.
Children
This is a business-to-business website and nothing on it is directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has sent us personal data, tell us atinfo@devdwell.com and we will delete it.
Links to other sites
This site links out to client websites, to social platforms, to review sites and to Webflow. Following any of those links takes you somewhere we do not control and where this policy stops applying. Their own terms and privacy policies take over, and they are worth a glance if you are about to type anything into them.
Changes to this policy
We will update this page when what we do changes, a new provider, a new tool, a new reason for holding something. The date at the top of the page is the date of the current version, and it is the fastest way to tell whether anything has moved since you last looked.
If a change materially affects people who have already sent us an enquiry or engaged us, we will say so directly rather than relying on you to re-read the page.
Getting in touch
One address covers all of it, questions about this policy, requests to see or delete what we hold, complaints, and anything you think this page has got wrong:
A reply within one business day, from a person. If you would rather start somewhere else, the contact pagehas the form and everything that goes with it.