Privacy

Privacy policy

How Crucible Studio collects, uses, stores and protects personal data when you use our website.

Last updated: 25 September 2026

1. Introduction

This privacy policy explains how CRUCIBLE STUDIO LIMITED (“Crucible Studio”, “we”, “us”, “our”) collects, uses, stores and shares personal data when you use our website.

Crucible Studio is an AI capability, service design and integration consultancy. We do not operate a product with user accounts, and we do not collect case data, documents or payment details through this website.

This policy covers the website at cruciblestudio.co.uk, including our contact form and the analytics we run. It does not cover data we process for clients under separate engagement terms.

2. Who we are

We are CRUCIBLE STUDIO LIMITED, a private limited company registered in England, company number 16734160, with our registered office at 94 Floodgates Cottages, Castle Lane, West Grinstead, Horsham, England, RH13 8LH.

We are the data controller for the personal data described in this policy.

We have assessed whether Article 37 UK GDPR requires us to appoint a Data Protection Officer and concluded that a formal DPO appointment is not required.

For any privacy or data protection questions, contact us using the details in section 9.

3. What data we collect

We collect only the following categories of personal data.

3.1 From our contact form. Name, email address, and the message you send us.

3.2 Technical and usage data. When you visit the site we receive, via our web server and self-hosted analytics:

• IP address
• Browser and device type
• Page visited and the page you came from
• Date and time of the visit

To group your pageviews into a single visit, our analytics stores a random session identifier in your browser's local storage. It is a random value not connected to any personal data, and it is removed when you clear your site data. We do not set a cookie for this purpose. We do not buy personal data from data brokers.

4. How we use your data

4.1 To respond to enquiries. When you use the contact form we use your details to reply to you and to follow up on what you have asked about.

Lawful basis: Article 6(1)(b) performance of a contract (the steps leading to it), and Article 6(1)(c) legal obligation where records are required of us.

4.2 To operate and secure the website. We use technical and usage data to keep the site working, to monitor for abuse or attack, and to understand which content leads to enquiries so we can improve the site.

Lawful basis: Article 6(1)(f) legitimate interests.

We do not send marketing communications to people who contact us, and we do not sell or share your personal data with third parties for marketing purposes.

5. How we share your data

We do not sell personal data. We share personal data only with:

Cloudflare. Cloudflare provides DNS, traffic delivery and security services for the site and acts as a data processor for us under UK GDPR Article 28. In providing these services Cloudflare may process limited categories of personal data, such as IP addresses and request metadata. Where Cloudflare transfers personal data outside the UK, it does so under the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.

We do not use any third-party analytics or marketing services. Our analytics tooling is self-hosted on systems we operate ourselves and does not transfer personal data to third parties.

We may also disclose data where required by law, court order or regulatory obligation, or where necessary to protect rights, safety or property.

6. Where your data is stored

Enquiry data and analytics data are stored on our own systems, which we operate ourselves. Apart from the Cloudflare services described in section 5, your data is not processed by any third party.

7. How long we keep your data

We keep personal data only for as long as necessary for the purposes described in this policy.

Backups and disaster recovery copies may persist for a limited period before secure deletion.

8. Cookies

We use no cookies that require your consent. We do not set advertising or tracking profiles, and we do not run cookie consent banners. Our analytics tooling is self-hosted and does not use cookies; it stores only the random session identifier described in section 3.2, in your browser's local storage, which you can remove at any time by clearing your site data.

9. Your rights

Under UK GDPR you may have the right to:

• access your personal data;
• correct inaccurate data;
• request erasure;
• restrict processing;
• object to certain processing;
• request portability; and
• request review of certain automated decisions, where applicable.

To exercise any of these rights, email [email protected]. You do not need an account to make a request, because we operate no accounts. We will respond in accordance with applicable law. If we are unable to action a request, we will tell you and explain the reason.

10. Data security

We use appropriate technical and organisational measures to protect personal data, including:

• encryption of data in transit (TLS);
• the site is fronted by Cloudflare, which provides protection against attacks and unauthorised access;
• access controls restricting who can reach the systems that hold your data;
• logging and monitoring;
• backup and recovery procedures; and
• an incident response process.

No internet-based service can guarantee absolute security.

11. Personal data breaches and complaints

If a personal data breach occurs, we will assess it and take appropriate action. Where required by law we will notify the Information Commissioner's Office and, where the breach is likely to result in a high risk to you, affected individuals.

If you have concerns about how we use your data, please contact us first. You also have the right to complain to the Information Commissioner's Office:

• https://ico.org.uk
• 0303 123 1113

12. Changes to this policy

We may update this policy from time to time. If we make material changes, we will update the effective date above.