Privacy, clearly.
Last updated 23 September 2026. This notice covers the Northbound website, enquiries, customer communications and separately supplied payment links.
Who is responsible
Che Walker, trading as Northbound is responsible for the personal information described here. Contact Che Walker at hello@northboundweb.co.uk about your information or to exercise your rights.
You can also write to Che Walker, trading as Northbound, 32 Ryland Road, Erdington, B24 8JJ, United Kingdom.
Information we collect
- Website enquiries: your name, email, selected package and message. Your business name is optional. We also record a reference, submission time and notification status.
- AI interest: your email, registration date and your explicit choice to receive Northbound AI updates. The signup form does not ask for your name or business name. Older registrations may include those details.
- Customer work: contact details, agreed scope, correspondence, approvals and information you supply for the project. Please only send material you are authorised to share.
- Payments: Stripe handles card details on its hosted payment page. Northbound receives payment status, amount, currency, customer contact information, project references and receipt or invoice information. This website does not collect card numbers.
- Security: hosting providers may process IP addresses, browser details, requested pages and request times. The application uses a hashed connection identifier for rate limits.
Your name, email and message allow us to respond to a website enquiry; your business name is optional. The separate AI signup needs only an email and your choice to receive updates. You are not legally required to send an enquiry or sign up; without an email we cannot reply or send requested updates. Avoid sending health information, passwords, payment-card details or other sensitive information in the forms. File uploads, client-portal access and automatic AI processing of enquiries are currently disabled.
Why we use it
- Individual quotes and contracts: steps you request before a contract and performance of the contract.
- General enquiries and business representatives: legitimate interests in answering requested communications and administering a business relationship.
- Financial records: legal obligations where records must be retained for accounting and tax.
- AI updates: your consent. Website enquiries do not subscribe you to marketing. Consent is optional and can be withdrawn at any time.
- Security, troubleshooting and duplicate prevention: legitimate interests in keeping the website and enquiry service reliable and protecting information.
- Marketing objections: compliance with the obligation to respect your preferences. We keep a limited suppression record so an objection is not accidentally undone.
Who receives information
Che Walker reviews enquiries through the private Northbound Studio and business email. Access is limited to what is needed for the work. We do not sell enquiry details.
- OpenAI Sites and Cloudflare: website hosting, protected owner access and the Cloudflare D1 enquiry database.
- Resend: sends enquiry and AI-registration notifications to Northbound. These notifications include submitted details and the enquiry reference. Email open and click tracking are disabled.
- Cloudflare Email Routing and Google Gmail: forward and store incoming business emails in the inbox Northbound uses to reply.
- Stripe: processes separately agreed payments, receipts and payment administration. Stripe also uses some information for its own fraud-prevention, legal and regulatory purposes.
We may share relevant information with professional advisers or authorities where necessary for legal obligations or a specific claim. If a client project needs another provider, we identify it before that processing begins.
Processing outside the UK
Our providers operate internationally, including in the United States. Resend stores email content and delivery information in the United States; selecting a European sending region does not keep stored data in Europe. Resend and Cloudflare publish processing terms that include standard contractual clauses and the UK Addendum for relevant transfers. Google, Stripe and OpenAI describe their own international processing in the notices linked below.
You can ask Northbound for information about the safeguards relevant to your records and how to obtain a copy. Provider notices explain their own processing and do not replace Northbound’s responsibilities.
Resend processing terms · Cloudflare processing terms · Google privacy · Stripe privacy · OpenAI privacy.
How long we keep it
- Enquiries that do not become a project: normally up to 12 months after the last meaningful contact, to handle follow-up questions. We then delete them unless there is a documented ongoing enquiry, complaint or legal reason to retain them.
- Customer correspondence and agreements: for the project and ongoing service, then only the information needed for financial records, unresolved complaints or legal claims. Retention for a claim is reviewed when it is resolved.
- Tax records: normally at least five years after the 31 January filing deadline for the relevant tax year, and longer if required by HMRC or an ongoing enquiry.
- AI interest registrations: until you withdraw consent or the interest list closes. Registrations reaching 24 months are reviewed; we delete them unless you renew your interest or another documented reason requires limited retention. We do not use an old registration indefinitely as permission to send updates.
- Marketing suppression: a hash of the email and the withdrawal date, retained while needed to prevent renewed unwanted marketing. It is reviewed if the mailing activity ends. A hash is still personal information.
- Application security records: rate-limit records become eligible for removal 24 hours after their limit window expires and are cleaned up on subsequent requests. Expired portal sessions are also removed on subsequent requests.
Retention reviews and enquiry deletion are carried out by Northbound, with older records flagged in Studio. Deleting a form record also deletes its local notification record, but does not recall an email. Corresponding inbox copies, downloaded files and provider-held copies must be considered separately. Providers may retain their own service, security or financial records under their applicable terms.
Cookies and browser storage
Our public pages do not load analytics, advertising trackers or third-party embeds. The enquiry and interest forms do not set cookies or save your entries or package choices to local or session storage. Package choices stay in the contact page URL; form answers and discount codes do not go in that URL.
Hosting still receives technical request information and can set security cookies, including Cloudflare’s __cf_bm cookie. The website framework can use a temporary page-address record in session storage to prevent reload loops after a loading failure. Browser caching and protected owner sign-in are separate from public form behaviour. Read the Cookies & Storage explanation for details, including external social and payment links.
Your choices and rights
Depending on the processing and applicable law, you can request access, correction, deletion, restriction or a portable copy of your information.
Your right to object: you may object to processing based on legitimate interests. You have an absolute right to object to direct marketing.
To stop AI updates, email hello@northboundweb.co.uk and identify your registered address. Withdrawal does not affect processing that was lawful before you withdrew. No automated marketing campaign is currently connected.
We normally respond to rights requests within one month. We may need proportionate information to verify your identity or clarify the request. Where the law permits additional time, we explain why. No solely automated decisions with legal or similarly significant effects are made through this website.
Contact or complain
Email hello@northboundweb.co.uk with enough detail to identify your enquiry. Do not send passwords or access codes. You can also complain directly to the Information Commissioner’s Office.