Privacy Policy

Last updated: 28 July 2026

PoshLayer Ltd ("PoshLayer", "we") is the data controller for personal data collected on poshlayer.com, desk.poshlayer.com and the PoshLayer client dashboard. Registered in England & Wales, no. 17359605, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Contact:hello@poshlayer.com.

The short version

  • This site sets no tracking cookies. None. No analytics trackers, no advertising pixels, no fingerprinting. We verified this with an automated crawl before writing this policy, and we intend to keep it true.
  • We collect what you type into our forms, and account data if you sign in - nothing collected silently in the background.
  • Your data lives in the EU/UK, is never sold, and is shared only with the service providers who run our stack, listed below.

What we collect, and why

  • Enquiries and audits - name, business name and contact details you submit through our contact and audit forms. Used to respond and, where you have enquired about our services, to follow up. Lawful basis: legitimate interests.
  • Orders and quotes - the details needed to prepare and fulfil a proposal or order, including billing information. Payments are processed by Stripe; card details never touch our servers. Lawful basis: contract.
  • Client dashboard accounts - your email address for sign-in (we use one-time codes, no passwords), and the project records the dashboard exists to show you. Sign-in attempts are rate-limited using your email and IP address; those records self-delete on a rolling basis. Lawful basis: contract.
  • Client service data - where we run services for your business (your site's enquiry forms, your customer records in our CRM), we process your customers' data as your processor, under the data-processing terms in our Terms of Business, and it is your privacy policy that applies to them.
  • Calls - if we arrange a call with you, we may record it for notes and quality, and we tell you at the start when we do. Lawful basis: legitimate interests.
  • Email - if we send you marketing email, every message has a working unsubscribe and we honour it. Transactional email (invoices, project updates) is part of the service.

Cookies

We use no advertising, analytics or tracking cookies on this site, so there is no cookie banner - there is nothing to consent to. The client dashboard stores a small preference and your session in your browser's local storage so it works; that data identifies your session to you and is not used to track you across sites. If this position ever changes, this page changes first.

Where your data lives, and who helps us process it

Our databases run in the EU (AWS Ireland and Frankfurt, via Supabase) and our own servers are in Germany (Hetzner). Providers we use to run the service:

  • Supabase - database and authentication (EU)
  • Hetzner - servers and backups (Germany)
  • Vercel - website hosting (global edge)
  • Cloudflare - DNS and network security
  • Stripe - payments
  • Resend - email delivery
  • AI service providers - where a service includes AI-assisted content production, the material we submit for that work may be processed by our AI vendors (for example Anthropic). We do not submit your personal data to AI services except as needed to deliver work you have asked for.

Where a provider processes data outside the UK, transfers are protected by the UK-US Data Bridge or by standard contractual clauses in our agreement with that provider. A current sub-processor list for client services is available on request.

How long we keep things

Enquiries that go nowhere are deleted within 24 months. Client records are kept for the relationship plus the periods tax and company law require (typically 6 years for financial records). Call recordings and sign-in logs are kept on shorter, rolling schedules. When we no longer need data, we delete it.

Your rights

You can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict our processing, and take your data elsewhere. Emailhello@poshlayer.com - we respond within one month, free of charge.

Complaints

If you think we have got something wrong with your data, complain directly to us athello@poshlayer.com with "data protection complaint" in the subject. We acknowledge complaints within 30 days and aim to resolve them well before that. You also have the right to complain to the Information Commissioner's Office at ico.org.uk, at any time.

Changes

We update this page when our practices change and change the date at the top. Significant changes affecting clients are also notified through the dashboard.