Privacy policy.

Who we are

TomHow is a trading name of HOWCROFTS CONSULTING LTD, a company registered in England and Wales. Registered office and company number are filed at Companies House and available on request.

Contact for privacy matters: [email protected].

What data we collect

• Server logs. IP address, browser type, request timestamps, and URL paths. Stored by the hosting provider for security and abuse prevention.
• Google Analytics 4. Page path, referrer, device and browser information, approximate location, explicit CTA click events, and basic tool interaction events such as generate and copy. Used for aggregate site and conversion reporting only.
• Email enquiries. Your email address and the content of any message you send us, stored for as long as needed to respond and for legitimate business records (typically up to 7 years for HMRC compliance on paid engagements).
• Free snapshot and qualification requests. When the secure form is active, we collect your name, work email, company, website, role, budget band, intended start timing, three buyer queries, stated search problem, fit-call preference and privacy acknowledgement. We use this to prepare the requested snapshot, assess fit and reply. We do not add the request to an automatic marketing list.
• Paid-audit intake. Once the secure intake service is activated, we collect your name, company, email, website URL, audit goal, priority buyer questions, named competitors, access constraints, and privacy acknowledgement. The server also records Stripe-owned payment and product references, payment status, the selected service scope, evidence-readiness status, job state and due date. We do not ask for passwords or store full card details.
• Checkout return reference. Stripe's first return request may include a session_id value in the page URL. It is a confidential order reference, not proof of payment. It can briefly reach the browser and hosting or security request logs before the page script can remove it from the visible URL.
• Client work data. For retainer clients, we process access to your Google Analytics, Google Search Console, and any other analytics tools you grant us. This is governed by a separate Master Service Agreement signed at retainer onset.

What we do not collect

• We do not run third-party advertising trackers, Facebook Pixel, Google Ads tags, or similar.
• We do not use session replay tools.
• We do not sell or share your data with marketing brokers.
• We do not send enquiry message content, payment details, or client data to Google Analytics 4.

Cookies

This site may set first-party analytics cookies through Google Analytics 4 so we can understand aggregate traffic and audit conversion paths. SiteGround or other infrastructure providers may set a small number of strictly-necessary cookies for security or routing purposes. We do not use advertising cookies or remarketing cookies.

Free snapshot and qualification form

The free visibility snapshot form uses a same-origin endpoint and the private TomHow database on SiteGround. A successful form response proves that the request was stored. A page view, button click, browser error or email draft does not count as a lead. The private local connector receives the request through an authenticated feed. The growth dashboard receives only a sanitised record without the buyer's name, email address, query text or problem description.

The stated role, budget band and timing are used by a versioned rule to place the request in qualified, review or nurture. That label only decides the next review step. It is not used for automated rejection or a decision with legal or similarly significant effect.

Analytics consent

On your first visit we show a consent banner asking whether you are happy for us to count your visit through Google Analytics 4 and use Microsoft Clarity to understand aggregate page behaviour. Your choice is stored locally in your browser under the key tomhow-consent-v1 so we do not ask again on the next visit. Clearing your site data resets the choice.

We use Google Consent Mode v2. Before you choose, and also if you choose Reject, analytics storage stays denied. The Google Analytics script still loads and sends an aggregate, cookieless measurement signal covering page path, referrer, approximate location and device or browser type. No analytics cookie is written, and no identifier that would let us recognise you on a later visit is stored on your device. Microsoft Clarity does not load at all, so no session recording takes place.

If you click Accept, analytics storage is granted, a first-party Google Analytics cookie is set so that repeat visits can be counted as one visitor, and Microsoft Clarity loads.

Ad storage, ad user data, and ad personalisation are denied by default and stay denied regardless of your choice, because we do not run ads on this site.

Analytics

Google Analytics 4 is used for aggregate page analytics, audit CTA click reporting, and basic tool interaction reporting. Microsoft Clarity is used for consented session recordings, heatmaps, dead clicks, rage clicks, and script-error signals so we can improve usability. Clarity masks sensitive content by default. Basic server logs are available through the hosting provider. IP anonymisation is enabled where supported. We do not use Google Ads, remarketing, or audience export features.

Paid-audit purchase and intake

The audit return page does not treat a page visit or browser query string as proof of payment. On the first return request, the Checkout Session reference can temporarily appear in the address bar and reach hosting or security logs. After the page script starts, it removes the reference from the visible URL and browser history. The page does not load analytics and keeps the form disabled until a same-origin secure intake service is configured.

When activated, the service will use the intake and Stripe-verified payment record to take steps requested before a contract and to deliver the purchased audit. This includes creating the customer and job record, calculating the due date from confirmed evidence readiness, raising an internal delivery alert, preparing a confirmation draft, delivering the report, and recording follow-up. Intake data is not used for advertising or sold to another organisation.

No live intake processor or customer-data store is configured today. Before the form is enabled, this policy will name the selected processor, storage location, international-transfer position, security controls and sub-processors. The production route must use encrypted storage, access control, backups and a server-held Stripe secret. Until those facts are recorded here, the form remains disabled and no intake is accepted.

Activation also requires a written logging rule for the Checkout return. The full session_id value must be redacted at log ingestion wherever the hosting and intake layers allow it, and it must never be sent to analytics or ordinary application logs. Access to any unavoidable raw first-request log is restricted, and that raw copy must be deleted within 7 days without a longer-lived backup. The verified server-side payment record may retain the Stripe reference under the financial-record rule below. The form stays disabled until these controls are confirmed.

Third parties

This site is currently hosted on SiteGround. Google Analytics 4 provides aggregate site analytics. The font files are self-hosted. The static site is deployed directly to SiteGround. For email, we use Google Workspace as a mail receiver via SiteGround forwarding. For payment, we use Stripe. Each of these providers has their own privacy policy which applies to data they process.

Your rights under UK GDPR

You have the right to access, rectify, erase, restrict processing of, and port any personal data we hold about you. You have the right to object to processing and to lodge a complaint with the Information Commissioner's Office (ICO). To exercise any of these rights, email [email protected].

Retention

General server logs are retained by the hosting provider according to its security and operations policy. Checkout return query values follow a stricter rule: redact the full session_id at ingestion, and delete any unavoidable raw first-request copy within 7 days. Email correspondence: 7 years (HMRC compliance). Free snapshot and qualification requests that do not become a paid engagement are deleted within 90 days. Client work data: duration of the active retainer plus 6 years (commercial records retention). Once the paid-audit intake is activated, rejected verification metadata will be retained for no more than 30 days unless needed for a fraud, security or payment dispute. Working intake details and supplied evidence will be deleted 90 days after audit delivery unless an ongoing engagement, legal claim or written client instruction requires longer. Contract, payment, customer, job and accounting records will be retained for 6 years after the end of the financial year in which the work completed.

Changes to this policy

We may update this policy when the underlying systems change. The "Last updated" date at the top reflects the most recent revision.