What this site knows about you.

Last updated 15 August 2026

Who is responsible

This site is run by Jared Bangal, a freelance web designer working with businesses. There is no company behind it, no team, and no third party administering it — the person who built the site is the person who receives whatever it collects.

Questions about anything on this page, including requests to see or delete what I hold, go to hello@jaredbangal.com. That address reaches me directly and is not monitored by anyone else.

What is collected

The contact form

Three things, and only if you type them: your name, your email address, and an optional note about your project and budget. Name and email are required because a reply is impossible without them; the note is optional and you can leave it blank.

There are no hidden fields. The form does not capture your IP address, your location, which page you came from, how long you spent filling it in, or anything you typed and then deleted. If you start filling it in and change your mind, nothing about that attempt exists anywhere.

The budget field is a free-text box, not a set of brackets. Whatever you write in it is used to work out whether I can help at that level and nothing else — it is not stored against you, compared with other enquiries, or used to price your project differently.

The newsletter form

One thing: an email address. No name, no company, no preferences. The list is used for occasional notes about new work and availability. It is not segmented, not scored, and not analysed — there is no tracking of who opened what.

Email you send me directly

If you email rather than using the form, that message sits in my email account like any other message, under the terms of my email provider. It contains whatever you chose to put in it.

Server logs

This site is hosted by Vercel, which keeps standard server logs of requests: IP address, the page requested, the time of the request, and the browser's user-agent string — which typically identifies the browser, its version and the operating system. That is ordinary infrastructure logging, generated automatically by the act of serving a page, and every website on the internet does some version of it.

I do not read those logs routinely, I cannot connect them to a name, and I do not export or process them. They are retained by Vercel under Vercel's own retention schedule, which is theirs rather than mine.

Fonts and scripts loaded from elsewhere

Two things on this site are served by other companies. Because your browser has to fetch them, those companies can see your IP address and the fact that a page on this site requested a file:

• Google Fonts (fonts.googleapis.com and fonts.gstatic.com) serves the typeface the whole site is set in.
• Cloudflare cdnjs (cdnjs.cloudflare.com) serves the 3D library that draws the moving particle field behind the page.

Neither is under my control, and both operate under their own privacy policies rather than this one. I mention them by name because a policy claiming "no third parties" while loading files from two of them would be untrue.

Both are optional to the site working. If you block them — with a browser extension, a strict privacy mode, or a network-level blocker — the page will render in a fallback typeface and without the particle field. Everything you came for still works: the text, the navigation, the links and the forms.

How long it is kept

• A live enquiry — kept for as long as the conversation and any project that follows are running, plus a reasonable period after for records.
• An enquiry that goes nowhere — kept about a year, then deleted. Long enough that if you come back I remember the context, short enough not to be a filing cabinet.
• Newsletter addresses — kept until you unsubscribe, at which point the address is removed rather than marked inactive.
• Server logs — retained by Vercel on their schedule, not mine.

You can ask for any of it to go sooner. See Your rights.

What is not collected

This list is longer than the one above, which is the point.

• No cookies. This site sets none at all — not analytics cookies, not preference cookies, not session cookies. There is no cookie banner because there is nothing to consent to.
• No analytics. No Google Analytics, no Plausible, no Fathom, no Hotjar, no Microsoft Clarity. Nothing counts visits, measures how far you scrolled, records your session, or builds a heatmap of where you clicked.
• No advertising or social pixels. No Meta pixel, no LinkedIn insight tag, no TikTok pixel, no Google Ads conversion tracking, no retargeting of any kind. You will not see an advert for this site because you visited it.
• No local storage. Nothing is written into your browser's storage between visits. Close the tab and the site has no memory of you at all.
• No fingerprinting. No canvas fingerprinting, no device fingerprinting, no attempt to identify you across sites or sessions.
• No profiling and no automated decisions. Nothing here scores, categorises, ranks or decides anything about you without a human involved.
• No sale or sharing of personal information as those terms are used in California and comparable laws. Nothing is sold, rented, licensed or traded — not to advertisers, not to data brokers, not to anybody.
• No special-category data. Nothing here asks about health, race, religion, politics, sexuality or biometrics, and none of it should be sent to me.

Your rights

Depending on where you live, you have legal rights over the personal data anyone holds about you. The UK and EU (under the GDPR), California (under the CCPA/CPRA), and a growing number of other places all grant a similar set. I extend all of the following to anyone who asks, wherever you are, because the alternative is checking your jurisdiction before answering an email and that is not a good use of anyone's time.

What you can ask for

• Access. A copy of everything I hold about you, and an explanation of where it came from and what it is used for.
• Correction. Anything wrong or out of date put right.
• Deletion. Everything about you erased. Where a live project makes that impossible — I cannot deliver work for someone whose email address I have deleted — I will say so and delete what I can.
• Portability. What you gave me handed back in a machine-readable form you can take elsewhere.
• Objection and restriction. A stop on a particular use, or on all of it, while a question is being sorted out.
• Withdrawing consent. Where something rests on your consent — the newsletter, principally — you can withdraw it at any time. That does not undo anything done before you withdrew, but it stops everything after.
• Freedom from retaliation. Exercising any of these rights will not get you worse service, a higher quote, or a slower reply.

How to exercise them

Email hello@jaredbangal.com and say what you want in plain words. "Delete everything you have on me" is a perfectly valid request and needs nothing else attached.

• There is no form to complete and no charge.
• I will confirm receipt and, given how little is held, most requests are completed within the same week. The legal ceiling in most places is 30 days, and I will tell you if anything is going to take close to that.
• Identity. I will normally act on a request sent from the same email address the data is held under. If it comes from a different address I may ask one question to confirm it is you — not to obstruct the request, but because deleting or disclosing someone's data to the wrong person is the worse failure.
• An authorised agent may make a request on your behalf where the law allows it; I will ask for evidence of that authority.

If you are not satisfied

Tell me first — most problems are a misunderstanding and are quicker to fix directly. If that does not resolve it, you have the right to complain to your data protection regulator: the Information Commissioner's Office in the UK, your national supervisory authority in the EU, or your state Attorney General in the US. You do not need my permission to do that and you do not have to come to me first.

The legal basis, if you want it

For readers under the GDPR: replying to your enquiry and carrying out work you asked for rests on performance of a contract or steps taken at your request. The newsletter rests on consent. Keeping ordinary business records rests on legitimate interests, balanced against the fact that almost nothing is kept.

Children

This site sells web design to business owners. It is not aimed at children, has nothing on it directed at children, and is not the kind of site a child would have a reason to use.

I do not knowingly collect personal information from anyone under 16. Nothing here asks a visitor's age, because nothing here needs to know it. If you believe a child has sent me their details through this site, email hello@jaredbangal.com and I will delete it on being told — no proof of guardianship required, no process to go through, and I would rather over-delete than argue about it.

Changes to this policy

Websites change, and a privacy policy that never changes is usually one nobody is reading.

• The date at the top always reflects the current version. If it has not moved, nothing has.
• Material changes get described, not absorbed. A new third party, a new category of data, or a new purpose will be written into the relevant section in plain words rather than folded into a general clause.
• The next change is already known. When the contact form is connected to a service that can actually deliver it, that service will be named under "Forms" and added to "Who else sees it", and the status note at the top will come down.
• Nothing is applied backwards. A change in what I collect applies from the date it is published, not to what you sent before it.

There is no mailing list for policy updates. If this matters to you, the honest advice is to check the date at the top when you next get in touch.

Who else sees it

Nobody buys, rents or receives your details for marketing. The only other parties involved are the ones that make the site work: Vercel, which hosts it, and the font and script providers named above. If a form submission arrives by email, my email provider handles it the way it handles any other message.

I would disclose information if the law genuinely required it — a court order, for example. That has never happened.

Where it is held

Vercel and the providers above operate globally, so serving this page may involve servers outside your country, including in the United States. That is a property of using ordinary web hosting rather than a decision made about your data specifically. Each of those companies publishes its own terms for international transfers.