Privacy policy.

Who we are

TomHow is a trading name of HOWCROFTS CONSULTING LTD, a company registered in England and Wales. Registered office and company number are filed at Companies House and available on request.

Contact for privacy matters: lab@tomhow.co.uk.

What data we collect

• Server logs. IP address, browser type, request timestamps, and URL paths. Processed by Cloudflare, which hosts and delivers this website, and by SiteGround for form and booking requests, for security and abuse prevention.
• Google Analytics 4. Page path, referrer, device and browser information, approximate location, explicit CTA click events, and basic tool interaction events such as generate and copy. Used for aggregate site and conversion reporting only.
• Email enquiries. Your email address and the content of any message you send us, stored for as long as needed to respond and for legitimate business records (typically up to 7 years for HMRC compliance on paid engagements).
• Website enquiries. When you submit the contact form, we collect your name, email address, message, optional company and website, and privacy acknowledgement. We use these details to review and reply to your request. The form creates a private stored enquiry and a reference; it is not a marketing sign-up. Unconverted enquiries are deleted within 90 days. If you become a client, the separate paid-engagement retention periods below apply. Do not include passwords or sensitive customer records.
• Call bookings. When you book a call, we collect your name, email address, the time you chose, any optional company, website and note, and your privacy acknowledgement. We use these details to hold the slot, confirm the call by email and prepare for it. Booking details are deleted about 90 days after the call unless you become a client.
• Free snapshot and qualification requests. When the secure form is active, we collect your name, work email, company, website, role, budget band, intended start timing, three buyer queries, stated search problem, fit-call preference and privacy acknowledgement. We use this to prepare the requested snapshot, assess fit and reply. We do not add the request to an automatic marketing list.
• Paid-audit intake. After you pay for the audit, the intake form collects your name, company, the email used for payment, website URL, audit goal, up to three priority buyer questions, named competitors, access constraints, and privacy acknowledgement. Tom matches the intake to the Stripe payment record before work starts. We do not ask for passwords or store full card details.
• Checkout return reference. Stripe's first return request may include a session_id value in the page URL. It is a confidential order reference, not proof of payment. It can briefly reach the browser and Cloudflare's delivery and security systems before the page script removes it from the visible URL. It is never sent with the intake form or to analytics.
• Client work data. For retainer clients, we process access to your Google Analytics, Google Search Console, and any other analytics tools you grant us. This is governed by a separate Master Service Agreement signed at retainer onset.

What we do not collect

• We do not run third-party advertising trackers, Facebook Pixel, Google Ads tags, or similar.
• Session recordings and heatmaps run only through Microsoft Clarity after you accept analytics, as described below.
• We do not sell or share your data with marketing brokers.
• We do not send enquiry message content, payment details, or client data to Google Analytics 4.

Cookies

This site may set first-party analytics cookies through Google Analytics 4 so we can understand aggregate traffic and audit conversion paths. Cloudflare, SiteGround or other infrastructure providers may set a small number of strictly-necessary cookies for security or routing purposes. We do not use advertising cookies or remarketing cookies.

Free snapshot and qualification form

The free visibility snapshot form uses a same-origin endpoint and the private TomHow database on SiteGround. A successful form response proves that the request was stored. A page view, button click, browser error or email draft does not count as a lead. The private local connector receives the request through an authenticated feed. The growth dashboard receives only a sanitised record without the buyer's name, email address, query text or problem description.

The stated role, budget band and timing are used by a versioned rule to place the request in qualified, review or nurture. That label only decides the next review step. It is not used for automated rejection or a decision with legal or similarly significant effect.

Analytics consent

On your first visit we show a consent banner asking whether you are happy for us to count your visit through Google Analytics 4 and use Microsoft Clarity to understand aggregate page behaviour. Your choice is stored locally in your browser under the key tomhow-consent-v1 so we do not ask again on the next visit. Clearing your site data resets the choice.

We use Google Consent Mode v2. Before you choose, and also if you choose Reject, analytics storage stays denied. The Google Analytics script still loads and sends an aggregate, cookieless measurement signal covering page path, referrer, approximate location and device or browser type. No analytics cookie is written, and no identifier that would let us recognise you on a later visit is stored on your device. Microsoft Clarity does not load at all, so no session recording takes place.

If you click Accept, analytics storage is granted, a first-party Google Analytics cookie is set so that repeat visits can be counted as one visitor, and Microsoft Clarity loads.

Ad storage, ad user data, and ad personalisation are denied by default and stay denied regardless of your choice, because we do not run ads on this site.

Analytics

Google Analytics 4 is used for aggregate page analytics, audit CTA click reporting, and basic tool interaction reporting. Microsoft Clarity is used for consented session recordings, heatmaps, dead clicks, rage clicks, and script-error signals so we can improve usability. Clarity masks sensitive content by default. Basic server logs are available through the hosting provider. IP anonymisation is enabled where supported. We do not use Google Ads, remarketing, or audience export features.

Paid-audit purchase and intake

The audit return page does not treat a page visit or browser query string as proof of payment. On the first return request, the Checkout Session reference can appear in the address bar and reach Cloudflare's delivery and security systems. After the page script starts, it removes the reference from the visible URL and browser history. The page does not load analytics, and the reference is never sent with the intake form.

The intake form sends your answers through the same secure enquiry service as the contact form. They are stored in the private TomHow database on SiteGround, with a reference shown to you on the page. Tom checks the intake against the Stripe payment record, then uses it to plan and deliver the purchased audit and to confirm the start date by email. Intake data is not used for advertising or sold to another organisation.

Third parties

Cloudflare hosts and delivers the public website through Cloudflare Pages, and passes form and booking requests to TomHow's form service. SiteGround hosts that form service and the private TomHow enquiry and booking storage. Google Analytics 4 provides aggregate site analytics, and Microsoft Clarity provides consented session recordings and heatmaps. The font files are self-hosted. For email, we use Google Workspace as a mail receiver via SiteGround forwarding. For payment, we use Stripe. Each of these providers has their own privacy policy which applies to data they process.

Your rights under UK GDPR

You have the right to access, rectify, erase, restrict processing of, and port any personal data we hold about you. You have the right to object to processing and to lodge a complaint with the Information Commissioner's Office (ICO). To exercise any of these rights, email lab@tomhow.co.uk.

Retention

General request logs are retained by Cloudflare and SiteGround according to their security and operations policies. Checkout return references are not stored by TomHow or sent to analytics. Email correspondence: 7 years (HMRC compliance). Website enquiries, free snapshot and qualification requests that do not become a paid engagement are deleted within 90 days. Call booking details are deleted about 90 days after the call. Client work data: duration of the active retainer plus 6 years (commercial records retention). Paid-audit intake details and supplied evidence are deleted 90 days after audit delivery unless an ongoing engagement, legal claim or written client instruction requires longer. Contract, payment, customer, job and accounting records are retained for 6 years after the end of the financial year in which the work completed.

Changes to this policy

We may update this policy when the underlying systems change. The "Last updated" date at the top reflects the most recent revision.