Privacy Policy

Last updated: 9 September 2026

This is written in plain English, to be fair and clear rather than to win an argument. It describes what this business actually does with information, but it is not a substitute for advice from a qualified solicitor. If you handle a large volume of personal data, or anything sensitive, it is worth a professional review.

1. Who we are

For the purposes of UK data protection law, the "data controller" is Jonah Quartey, trading as Qp Digital, a sole trader based in England. Contact: contact@qp-digital.co.uk.

We work from a private address rather than a public premises, so it isn't listed here. If you need it in order to write to us (to make a data request, for instance), email us and we'll send it to you.

For most of what follows we are the controller: we decide what is collected and why. But for the CRM, Booking System and AI Reception services, we hold information about our client's own customers on their behalf. There we are a processor, and our client is the controller. Section 7 covers that separately, because your rights in that situation are exercised against them, not us.

2. What we collect, and when

When you send an enquiry

• Your name, business name and business address (address is optional)
• Your email address and phone number (phone is optional)
• Which service you're interested in, and any project details you type in

When you apply for a job through the Careers page

• The role you're applying for, your name, email address and phone number
• Anything you write in the message box

We don't ask for a CV. Please don't include information you'd rather we didn't hold (health details, for instance) in the message box, as there's no reason for us to have it.

When you become a client

• Your account number, an encrypted copy of your activation code, and the service, price and payment status agreed with you
• Your email address, and a password you set yourself for the Members Portal (we never see the password, it is handled by our identity provider)
• The answers to the short onboarding questions: your contact name, business name, industry, ideal customer and main goal
• Any change requests or landing-page requests you submit from the portal

When you use the site assistant

The chat assistant sends what you type to OpenAI to generate a reply. Don't put anything confidential into it. The conversation is kept in your own browser, not on our servers.

3. Cookies and browser storage

We use no analytics, no advertising trackers and no third-party cookies. Nothing here follows you to other websites. We do store a few things in your own browser that are needed for the site to function:

• qpTheme: whether you chose the light or dark theme
• qpMemberSession, qpMemberPurchases, qpMemberProfile: keeps you signed in to the Members Portal and remembers which services you have
• qpAgentChat: your site-assistant conversation, so it survives a page reload
• A sign-in cookie set by Netlify Identity when you log in to the portal

These are strictly necessary to provide a service you've asked for, so they don't require a cookie banner. You can clear them at any time in your browser settings; doing so signs you out.

4. Why we collect it, and our legal basis

We use this information to respond to your enquiry, prepare a quote, deliver the service you've agreed to, process payment and activation, run your Members Portal, and send the transactional emails involved in that. Our legal basis is that this is necessary to take steps at your request before entering into a contract, and to perform that contract once we have one.

For general enquiry handling and job applications, our basis is our legitimate interest in responding to people who contact us and in recruiting, weighed against your right to privacy, which is why we ask for as little as we do.

5. Who we share it with

We use a small number of third-party providers to actually run this business. Each only receives what it needs to do its job:

• Netlify: hosts this site, stores our records, and provides the Members Portal sign-in.
• Stripe: processes payments. We never see or store your card details.
• Resend: sends transactional email (enquiry confirmations, account and code emails).
• OpenAI: generates replies in the site chat assistant, from what you type into it.
• Anthropic: generates replies for the AI Reception service, from what a caller says.
• Twilio: provides the phone numbers and call handling behind AI Reception.
• Supabase: holds client accounts and subscription status for the CRM and Booking apps.

Two further providers serve files to your browser rather than receiving anything we send them. Because your browser fetches those files directly, your IP address reaches them as part of the request:

• Google Fonts: serves the typefaces this site is set in.
• esm.sh: serves the sign-in library used by the Members Portal.

Neither is used to track you, and neither sets a cookie here. They are listed because your IP address is personal data and you are entitled to know where it goes.

All of these are based outside the UK/EU (primarily the United States), so your data may be processed there under that provider's own safeguards. We don't sell your data, we don't share it for advertising, and we don't give it to anyone beyond what's needed to run the service you've asked for, unless we're legally required to.

6. How long we keep it

If you enquire but don't become a client, we keep your enquiry for a reasonable period in case you follow up, then delete it. Job applications are kept while we're recruiting for that role and for a short period afterwards, then deleted. Ask us and we'll delete yours sooner. If you become a client, we keep your account record for as long as needed to deliver and support your service, and afterwards for as long as UK record-keeping rules require (commonly up to 6 years, for tax and accounting).

7. Data belonging to our clients' own customers

If you are a customer of a business that uses our CRM, Booking System or AI Reception, we may hold information about you, but on that business's instructions, not our own:

• CRM: the contact details and notes our client records about you: name, email, phone, where the lead came from, and the value and stage of any deal.
• Booking System: your name, contact details and the date, time and service of your appointments.
• AI Reception: if you call a client's AI-answered number, we store the number you called from and a written transcript of what was said, so the business can follow up. Calls are answered by an automated assistant, not a person.

Here the business you dealt with is the data controller, and we act only as their processor. We don't use this information for our own purposes, and we never sell it. To see, correct or delete it, contact that business directly. They decide what happens to it. If you're not sure who that is, email us and we'll point you to them.

Each client's workspace is separated by their signed-in account. One client cannot read another client's records.

8. Your rights

Under UK data protection law, you have the right to:

• Ask what personal data we hold about you, and get a copy of it
• Ask us to correct anything that's inaccurate
• Ask us to delete your data, where we're not required to keep it for another reason (e.g. tax records)
• Ask us to restrict or object to how we use it
• Ask for your data in a portable format

To use any of these, email contact@qp-digital.co.uk. We'll respond within one month. If you're not satisfied with how we've handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk.

9. How we protect it

Concretely, rather than as a general reassurance:

• Every page is served over HTTPS, and browsers are told to refuse an unencrypted connection to this site.
• The Members Portal is protected by a password you set, verified by our identity provider. We never see or store it.
• Your CRM and Booking workspaces are keyed to your verified signed-in account on the server, so no one can reach another client's data by asking for it.
• Activation codes are stored encrypted, not in plain text.
• The admin tools are behind a separate signed session, and are excluded from search engines.
• A Content Security Policy restricts what code is allowed to run on the site, and the site cannot be embedded in another page.

No system is perfectly secure and we can't promise absolute safety. If we ever discover a breach affecting your data, we will tell you and the ICO where the law requires it.

10. Children

Our services are intended for businesses and adults, not children. We don't knowingly collect personal data from children.

11. Changes to this policy

We may update this policy as the business changes, and the "Last updated" date at the top will change when we do.