Privacy Policy

01Who we are

Voicsk is a content marketing agency. This policy covers the website at voicsk.com and the enquiry forms on it. It does not cover work carried out under a signed engagement — that is governed by the agreement for it.

For any question about this policy, or to exercise any right described in it, write to voicsk.agency@gmail.com. A person reads that inbox.

02What we collect

Two things, and nothing else: what you type into a form, and a small amount of technical information that arrives automatically with any request to any website.

When you submit the enquiry form on /contact or /book, we receive the fields you filled in:

• Your name, work email address and company
• Your website, if you give one — that field is optional
• Your industry and company stage
• Your main growth goal and your biggest content challenge, in your own words
• The services you are interested in, an estimated monthly budget range and a desired start date
• Anything you add to the free-text “anything else” box
• Confirmation that you agreed we may reply to you
• The page you submitted from, the page that referred you, and any utm_source, utm_medium or utm_campaign values in the link you arrived through
• A shortened browser user-agent string, and the two-letter country code your network resolves to

03What we do not collect

Stated plainly, because absence is the part of a privacy policy a reader cannot verify for themselves:

• We set no cookies at all unless you accept the banner. If you decline, none are set — no analytics cookie, no advertising cookie, no session cookie.
• We do not put anything you send us into Google Analytics. Your name, email address, phone number and the text of your enquiry are never uploaded there, and there is no identifier linking an enquiry to a browsing session.
• We do not store your IP address. It is hashed the moment it arrives, purely to count requests per sender so the forms can be protected from automated abuse, and only the hash is kept.
• We do not sell, rent, trade or share personal data for anyone else's purposes, and we will not.
• We do not use anything you send us to train machine-learning models.
• We do not track you across other websites, and have no mechanism that could.
• We ask for no special category data — health, beliefs, biometrics or similar. Please do not put any into the free-text fields.

04Why we use it, and on what basis

Each purpose is tied to the basis we rely on, using the language of the UK and EU GDPR. Where your local law uses different terms, the substance is the same.

• To read and answer your enquiry, and to work out whether we are a sensible fit — performance of a contract, or steps taken at your request before one exists.
• To keep a record of business enquiries and of the consent you gave — our legitimate interest in running the business and being able to evidence that.
• To protect the forms from automated abuse using hashed request counts — our legitimate interest in keeping the service available.
• To understand which pages and links lead to enquiries, and to build advertising audiences — consent, and only once you have given it. Decline and no cookies are set and no profile is built.
• To meet a legal, tax or accounting obligation where one applies — compliance with a legal obligation.

05Analytics, advertising, and the choice you get

There are two measurement systems here and one switch governs both. Nothing that identifies you runs before you answer the banner.

Google Analytics 4 is the first. Accept and it sets cookies that recognise your browser across visits, records which pages you saw and how you arrived, derives an approximate location from your IP address, and allows Google to include you in advertising audiences so we can show later adverts to people who have visited. Decline and it sets no cookies and creates no identifier: it still counts the visit anonymously, with nothing that can be linked to you, to your earlier visits, or to any other site.

Our own first-party analytics is the second. It records that an event happened — a booking button pressed, for instance — the page path, and the referring page. It uses no cookie and no identifier of any kind, and it runs only if you accept.

Your choice lives in your browser's local storage under the key voicsk-consent. It is a single word, it never leaves your device, and clearing your browser storage resets it and shows the banner again. The cookies page lists every cookie by name, what it holds and how long it lasts.

06Who else is involved

We keep this list as short as we can, and it is complete. Each one is a processor acting on our instructions, not a party we hand data to for their own purposes.

• Cloudflare — hosts the site and stores the data. Enquiries are held in a Cloudflare D1 database and uploaded media in Cloudflare R2 object storage, both in the Western Europe region.
• Google — in two separate roles. The mailbox we read your enquiry in is a Gmail account, so the contents of your message reach Google's servers the way any email does. Separately, Google Analytics measures use of the site and builds advertising audiences, but only if you accept, and it never receives anything from an enquiry form. For the advertising part Google acts for its own purposes as well as ours, not purely on our instructions.
• Video platforms, and only if you press play — a page may embed a video from YouTube in its no-cookie mode, Vimeo, or Loom. Nothing loads from them until you interact with the player; once you do, that platform's own privacy policy governs what it collects.
• That is the whole list. There is no CRM, no email marketing platform, and no advertising network beyond Google's own, which runs only on your consent.

07Where it is stored, and transfers

Enquiry records and uploaded media are stored in the Western Europe region of Cloudflare's platform. Cloudflare and Google are global providers, so administrative access, email delivery and — if you accept — analytics processing can involve transfers outside your country, including to the United States.

Where those transfers are covered by data protection law they rely on the transfer mechanisms those providers make available, including the European Commission's Standard Contractual Clauses. We make no onward transfers of our own.

08How long we keep it

• Enquiries that do not lead to a conversation — deleted within 24 months.
• Enquiries that become a client relationship — kept for the relationship, then for as long as tax and accounting rules require, commonly six to seven years.
• Consented first-party analytics events — 14 months, then deleted.
• Google Analytics data — retained by Google under the property's own setting, currently 14 months, then deleted by them.
• Hashed rate-limit records — minutes. They exist only for the length of the window they measure.
• Anything you ask us to delete — removed on request, except records we are legally required to keep. See below.

09Your rights

Depending on where you live you have some or all of the rights below. We honour all of them for everyone who asks, wherever they are — it is simpler than checking, and it is the right way round.

• Access — ask what we hold about you and get a copy of it.
• Rectification — have anything inaccurate corrected.
• Erasure — have it deleted.
• Restriction and objection — tell us to stop a particular use, including any use that rests on our legitimate interests.
• Portability — receive it in a structured, machine-readable format.
• Withdraw consent — for analytics, at any time, from the banner or by clearing your browser storage. Withdrawing does not undo anything already lawfully done.
• Complain — to your local data protection authority. We would rather you came to us first so we can put it right.

10How to make a request

Email voicsk.agency@gmail.com and say what you want. There is no form to fill in.

We answer within 30 days. We may ask you to confirm something only you would know — usually just that you can receive mail at the address the enquiry came from — so that we do not hand your data to somebody else. There is no charge for any of this.

11How we protect it

• The whole site is served over HTTPS with HSTS, and insecure requests are redirected.
• The administrative area sits behind an identity check at the network edge, before the application sees the request, and requires a cryptographically signed assertion rather than a password.
• Every administrative action on content or on leads is written to an audit log against the account that performed it.
• Uploaded media is held in private object storage and is not publicly listable.
• A strict Content Security Policy blocks scripts, images and frames from any origin not explicitly allowed.
• No security is absolute. If a breach ever affects your data and the law requires us to tell you, we will, without waiting to be asked.

12Children

This is a business-to-business website and is not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has sent us something, tell us and we will delete it.

13Changes to this policy

If we change how we handle data we change this page and move the date at the top of it. If a change is significant and we hold your contact details from an enquiry, we will tell you directly rather than relying on you to re-read this page.