Skip to content
GMR Studio

Legal

Privacy notice

What I hold about you, why, for how long, and how to make me stop. Last updated 6 October 2026.

Who I am

I’m Graeme Rae, a sole trader trading as GMR Studio from Edinburgh. I decide what happens to the personal details described here, which makes me the controller of them under UK data protection law. The quickest way to reach me about any of it is graeme@studiogmr.co.uk.

If you get in touch

If you use the form on this site or email me, I get your name, your email address, any phone number you choose to give, and your message. I use them to reply and to talk about the work you’re asking about, because you’ve asked me to, and for nothing else: no mailing list, and I never sell or share them for anyone else’s marketing. I need an email address to reply; the rest is up to you. If it doesn’t turn into work, I delete them 12 months after we last spoke.

If you hire me

I keep your contact details, our agreement and sitemap, invoices, payments and our correspondence, because I need them to do the work we agreed and because the law requires me to keep business records. I keep them for as long as HMRC requires a sole trader to: five years after the 31 January tax-return deadline for the year the work fell in. Then I delete them.

If I’ve contacted you

I build websites for local businesses, so I sometimes get in touch with a business first: an email, an Instagram message, a note through the door, or by calling in. Before I do, I look the business up. If you’ve heard from me, or yours is a business I’ve looked at, this is what I hold and why.

What and where from. Mostly what your business has made public: its name, address, phone number, website and category from its Google listing; for a company, its number, type and date of incorporation from the Companies House register; its Google rating, number of reviews and at most two general themes from them, never a quote or a reviewer’s name; and, from your own website, booking page or social profiles, read one page at a time, your services and price range, how you take bookings, roughly how many people do the work, whether you work from home or premises, whether you’re hiring, and a contact email if one is published there. I never guess an email address. If you have a website I check it (what’s on it and how fast it loads), and I note where and when I read each detail. Then there are my own notes: how I came across you, what I think a website could do for you, a score I use to decide who to contact first, what I sent, and anything you tell me, such as what you’d want, the budget you have in mind and any price I quote.

Why. To offer you a website, which is in my legitimate interests as a small business finding customers; to remember that I’ve been in touch, so I don’t pester you; and to learn what businesses like yours want and would pay, so my prices are fair.

How long. I delete your business’s details 12 months after I last contacted you, or 12 months after I looked you up if I never did. If you agree to work with me, “If you hire me” applies instead. What you told me about budget, what you wanted and how you took a price is kept after that with your name and contact details removed, as a record of what businesses ask for. You can ask me to delete everything sooner, and I will.

Your right to say no. You can object to direct marketing at any time. It’s absolute: no reason needed, and I stop. Reply “no” to any message, or email graeme@studiogmr.co.uk, and I won’t contact you again by any channel. So that it sticks, I keep a do-not-contact list holding only what I need to recognise you again: your business name and postcode, the email, phone, Instagram and website I had for you, and when and how you told me. That list is kept for good, because deleting it is how someone gets contacted twice.

Who else handles it

These services handle these details as part of how I work: Vercel hosts this site and my research records, and Turso stores those records in a London data centre; Resend delivers the contact form to my inbox; Google Workspace holds my email; I use Anthropic’s Claude to help research businesses, draft messages and keep client records, and I check and send every message myself; Google supplies business listings and website speed scores. Vercel, Turso, Resend, Google and Anthropic are US companies, so your details may be handled in the US. Where they leave the UK, the transfer is covered by the UK–US data bridge or by contract terms the UK approves for the purpose; ask me and I’ll tell you which, and send you a copy. No decision about you is made by software alone.

Cookies and analytics

This site sets no cookies. If you switch between light and dark, your browser remembers the choice on your own device and nothing is sent to me. It counts visits with Vercel Web Analytics and measures page speed with Vercel Speed Insights; neither sets a cookie, follows you to other sites, or tells me who you are.

Your rights

You can ask for a copy of what I hold about you, ask me to correct or delete it, ask me to limit what I do with it, or object to my using it; and for anything you gave me as a client, ask for it in a form you can take elsewhere. Email graeme@studiogmr.co.uk and I’ll answer within a month. If you’re unhappy with how I’ve handled it, tell me first and I’ll try to put it right; you can also complain to the Information Commissioner’s Office at ico.org.uk.