Privacy Policy

1. Who we are

Drift and Forge Limited(“Drift and Forge”, “we”, “us”) is a consultancy registered in England and Wales. Our website is https://driftandforge.io and our contact email is info@driftandforge.io.

2. Information we collect

We collect personal data only when you give it to us. Specifically:

• Information you provide via contact forms or email (name, email address, business details, anything you choose to write).
• Booking information when you schedule a discovery call (name, email, time zone, calendar metadata).
• Usage data via Vercel Analytics and Google Analytics 4 (anonymised, aggregated visitor behaviour, no personal identifiers).

3. How we use it

• To respond to enquiries and schedule calls.
• To deliver engagements you have commissioned.
• To improve the site and understand which content is useful.
• To comply with legal obligations (e.g. invoicing, tax records).

We never sell personal data. We never share it with third parties for marketing. Where we use third-party processors (Resend for email, Supabase for database, Vercel for hosting) we use them only as data processors under written agreements.

4. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccuracies in it.
• Request deletion of it (subject to legal retention obligations).
• Object to processing for marketing.
• Withdraw consent at any time.
• Lodge a complaint with the Information Commissioner's Office (ICO).

To exercise any of these rights, email info@driftandforge.io. We respond within 30 days, usually within 48 hours.

5. Cookies

This site uses essential cookies only by default. Analytics cookies (Vercel Analytics, GA4) are loaded with consent where required by your region. You can disable cookies in your browser at any time.

6. Security

Personal data is encrypted in transit (HTTPS) and at rest (provider-level encryption with Vercel and Supabase). Access is restricted to operators who need it to deliver work. We log access to client data and review logs quarterly.

7. Retention

We keep enquiry data for 24 months unless you ask us to delete it sooner. Engagement data is kept for the legally required retention period (7 years for accounting records under UK law) then deleted.

8. Changes to this policy

We update this policy when our practices change. The “Last updated” date at the top of this page reflects the most recent change. We do not retroactively apply changes to data we have already collected.