Privacy Notice

Who we are

Oakready is a trading name of Transport Concierge Limited, a company registered in England and Wales under company number 05348983, with its registered office at 7 Grove Court, Marr, Doncaster, South Yorkshire, DN5 7AL. Transport Concierge Limited is the controller of the personal data described in this notice, which means it decides why and how that data is used. Contact us about anything in this notice at hello@oakready.com.

What this notice covers

This notice covers the oakready.com website and every service we offer through it: the free website audit, accounts and sign-in, buying and hosting a website, the websites we host for customers, the AI Copywriter, enquiries about custom builds and AI automation, and the analytics and advertising measurement we use with your permission. Each service has its own section below, followed by the parts that apply to all of them: cookies, the providers we use, where data goes, how long we keep it and your rights.

Where a customer uses Oakready to run their own website, we process that website's visitor data on the customer's behalf. The section on websites we host for customers explains that separately.

Website audit

When you request an audit, we collect the website address and email address you provide, confirmation and delivery times, and limited security and delivery records. We turn the requesting network address into a private keyed hash for rate limiting and the daily free-report limit. We do not store the raw network address in the audit request.

We fetch the website's public homepage and record bounded public information such as its response, page title, page summary, language, visible text, security headers and mobile PageSpeed results. We do not ask for or use private website login details.

We use these details to verify your email, prepare the audit you requested, send the PDF and deal with delivery questions. That is necessary to provide the service you asked for. We also use limited security records for our legitimate interests in preventing fraud, abuse, duplicate free audits and excessive provider costs. Requesting an audit does not subscribe you to marketing; the verification and report messages are transactional emails for the audit you requested.

The report is generated from automated checks. Oakready calculates the measurements and grades using fixed rules. OpenAI receives a bounded set of public website evidence, without your email or network address, to help explain the findings in plain language and suggest possible website automations; it cannot set the measurements or grades. The audit does not make a legal or similarly significant decision about you.

Audit request controls

An accepted request reserves one free report allowance for 24 hours. The limit applies independently to your network, recognised browser, email address and website. We store private keyed hashes of these details to enforce the limit. We use an essential, signed cookie to recognise a browser for up to 90 days and help prevent repeated free requests; it gives no account access and is not used for advertising. People using the same office, home, hotel or mobile network may be treated as one network. If you have already verified an audit email address, we may send a newly requested report to that address without another confirmation, and we may resend an existing approved report for the same website instead of generating it again. Contact hello@oakready.com if you think a restriction has affected you incorrectly.

Accounts and signing in

You can create an Oakready account with Google or with an email link. A Google registration stores your lower-case email address, your Google account identifier, the time your email was verified and the account creation and update times. An email sign-in stores your email address and the times a sign-in link was requested and used; links expire quickly and work once. We do not receive or store your Google password.

Session records store a hash of the session token, its authentication method and security timestamps; the database does not store the raw session token. We keep you signed in across browser visits and renew your session while you use Oakready, with no fixed limit from your original sign-in. Each renewal remembers this browser for up to 400 days. Logging out, clearing browser data or revoking access ends the session; browser settings may remove cookies sooner. Sensitive account changes may still require a fresh sign-in or passkey confirmation. Cloudflare Turnstile is checked before registration starts, and we store keyed hashes, not the raw network address, for request rate limits. A keyed registration capability hash expires after five minutes, and expired capability and rate-limit rows are removed as later requests are processed.

The AI Copywriter has its own sign-in with the same choices, Google or an email link, and the same renewable sessions. Its records are kept in a separate database from the website and audit services.

Buying and hosting a website

Payment

Payment is taken by Stripe on Stripe's own checkout pages. Oakready never sees or stores your full card number. We store the order: what was bought, the price and currency, the terms and privacy versions you accepted, Stripe's identifiers for the customer, checkout and payments, invoice and subscription status, and the dates of each event. For the new website contract we also keep your business/personal-use choice, separate immediate-start choices, their exact wording version, contract digest and acceptance time. We send the accepted contract and order summary as a purchase confirmation. Hosting renews monthly through Stripe until you cancel.

Your brief

After payment we build a brief for your website. If you give us your current website address, we read its public pages and record what we find, such as your business name, services, contact details and page structure, for you to confirm or correct. We store your answers to the brief questions, the design references you choose, the fonts and colours you pick, and the logos and imagery you upload. Uploaded images are checked, resized and stripped of embedded metadata such as location data before they are stored. The contact details you give for enquiries are held in encrypted form, and the frozen brief that reaches our build tools carries only a hashed form of the notification address.

Design references come from a licensed design library. Our searches to that library use only the business category and approved search terms; your name, brief text and uploads are never sent to it. Where an AI model helps prepare questions or suggest fonts from the designs you chose, it receives bounded brief content and the chosen design images only, never your notification address or payment details.

Your website, content and media

Your website content, pages, media library, form settings and publication history are stored so we can build, host and let you edit your website. Private hosted media files use Cloudflare R2 storage in the European Union; authorised initial-build processing is described separately below. Your account and workspace memberships record who may edit each website. When you export or leave, we prepare a copy of the compiled website, content and media for you to download; export files are kept for a limited period and then removed.

Service messages

We send transactional emails about your account, order, brief, preview, publication, billing and hosting. These are part of the service, not marketing. We do not sell your details.

Websites we host for customers

When Oakready builds and hosts a website for a customer, the customer is the controller of the personal data that website collects from its own visitors, and Oakready processes it on the customer's instructions. If you are visiting a website hosted by Oakready, that website's own privacy notice describes how its owner uses your data; contact the website owner first with any questions.

For hosted websites we process visitor requests and the usual server records needed to serve pages securely and detect abuse, and we deliver enquiry form submissions. Form submissions are protected by Cloudflare Turnstile and stored encrypted. Detailed notifications go to the owner's verified recipients; configured connections can receive the authorised enquiry. A website-branded acknowledgement may also go to the visitor's submitted email address, subject to eligibility and abuse controls. It does not repeat the enquiry content or subscribe the visitor to marketing. Enquiry content normally expires 30 days after acceptance and enters cleanup, subject to justified holds or active delivery. Delivery and security records have separate retention purposes, and deleting our copy does not recall mailbox or connected-system copies. Hosted websites may offer owner-only visit statistics after the visitor accepts analytics in that website's privacy controls. Counts include public pages, referring websites, device category, approximate country inferred from browser time zone, enquiries and brochure clicks. A daily key derived from a network address and browser information distinguishes visits for that day; we do not retain the raw address or browser information for this purpose. The key and its salt normally expire after two days; counts normally expire after 400 days. A justified legal hold can suspend deletion. The website owner controls the purpose and must describe it in the website's own notice. Oakready's advertising tags are not added to customer sites.

AI Copywriter

Free trial

You can try the Copywriter once without an account. We store the text you enter, the website address you optionally give, the writing we generate and its scores, and the times involved. To keep the trial to one per recognised browser we store a keyed hash of your network and set a signed browser cookie; neither identifies you to us by name. Cloudflare Turnstile checks that the request comes from a person. If you give a website address we fetch its public homepage and up to two relevant same-origin pages, within a short time limit, to give the writing some context. A completed free response stays readable and copyable in that browser for 180 days after completion. You can save it to an account without buying a subscription; further writing requires paid access. Already deleted responses cannot be restored.

Using the Copywriter with an account

With an account we store your conversations, briefs, generated drafts, versions, scores, saved outputs and usage records, together with any business or website details you add so the writing fits your business. If you upload a document, it is checked by a separate scanning service before it is used and is processed only to extract the text you asked us to work from.

Writing is produced by OpenAI models in a project dedicated to the Oakready Copywriter. OpenAI receives the text needed for your request, a bounded amount of context and our licensed writing guidance; it does not receive your account email, payment details or network address. We do not use your content to train our own AI models. Contact us for the applicable provider processing and retention arrangements. Each request is metered so that provider spend is bounded per request, per day and per account.

Billing

Subscriptions and credit top-ups are paid through Stripe. We store the Stripe customer, checkout, invoice, subscription and payment identifiers, the credits granted, spent, expired or revoked, and any refund, dispute or hold, so that your balance is correct and disputes can be answered. Card details stay with Stripe.

Custom builds, AI automation and enquiries

When you tell us about a custom build or automation project, we collect your name, business, email address, website, requirements, budget and target date. The form is protected by Cloudflare Turnstile and the details are stored encrypted and sent to us by email so we can reply. The Help form collects your name, email address and message. We send a confirmation email when your enquiry or support message is saved. We use these details to understand your request, prepare a proposal and keep in touch about it. When you agree that we may contact you about the enquiry, we create or reuse a Resend contact record for that follow-up. A new record is marked as unsubscribed from Resend Broadcasts and is added to no marketing segment. We do not change an existing marketing choice. This is not a marketing subscription. We also use emails you send directly to hello@oakready.com to respond to and follow up on that message; direct emails do not create this form's contact work item.

Live chat with our team

The Speak to Sophie button opens a live chat with a person on our team. When you send your first message we set an essential signed cookie so the same chat follows you between pages for up to 30 days, and the first message is protected by Cloudflare Turnstile. We keep what you write, the page you were on, where you came from, and the name and email address required to start the chat so we can reply if you step away. A phone number is optional. Our team sees your messages in a private inbox; replies you miss while away are emailed to the address you gave. To protect the chat from abuse we keep short-lived counters made from a private keyed hash of the network address, not the address itself. You can clear the chat at any time from the window, and you can ask us to delete it by emailing hello@oakready.com.

Your browser remembers your sound and desktop-alert choices, whether a chat has started, and a limited list of conversation identifiers and message numbers to avoid repeating alerts across tabs. These local settings contain no message text and remain until cleared in your browser. Desktop alerts require your browser permission and show a generic message while Oakready is open.

Businesses we contact

We sometimes research independent businesses that we think could benefit from a better website, using publicly available sources such as a business's own website, listings and public registers. We may record the business name, website, public contact details, the person's role and notes about the website, and we may contact the business by email or post. We rely on our legitimate interest in marketing our services to businesses. You can ask us to stop at any time by replying or emailing hello@oakready.com, and we will not contact you again.

Cookies and your choices

Essential cookies keep you signed in, remember your currency, protect forms and enforce the free audit and trial limits. They are set without asking because the site does not work without them. We ask every visitor before setting analytics or marketing cookies; we do not grant them automatically based on location. Your choice is stored for one year, and you can change or withdraw it at any time with the button below or the Cookie settings link in the footer. A Global Privacy Control signal denies marketing measurement when we observe it.

An essential browser identifier lets Oakready keep the same consent record across tabs. The server stores an opaque identifier and an ordered history of your choices. To protect the choice form from abuse, we keep short-lived counters made from a private keyed hash of the network address; we do not store the address itself for this purpose. These records are not advertising identifiers.

When you save or withdraw a choice, non-essential tools are switched off in this browser until Oakready confirms the change. Other open Oakready tabs receive the same update. If you are offline or the save fails, the banner stays open, tells you that the change has not been saved and retries later. Browser measurement remains off, but an offline browser cannot update Oakready's server until it reconnects. To carry that unconfirmed choice between oakready.com and www.oakready.com, we keep an essential retry marker for up to 24 hours. It contains random decision references, the expected choice order, retry time, locale and category choices, not an advertising identifier.

Cloudflare Turnstile, which protects our forms, may set its own cookies on challenges.cloudflare.com while it checks that a request comes from a person. An embedded video player can connect to its provider when it loads, before you press Play. A privacy-enhanced YouTube address alone does not establish that no information is shared before playback. Hosted customer sites can also use Vimeo. Payment pages use Stripe's own cookie policy.

Analytics and advertising measurement

With analytics permission saved after this purpose was published, we remember how you first and most recently arrived at Oakready: the referring website, campaign tags, ad network and public landing page. If you order a website, we keep that note with the order for 90 days and include it in our internal order email to hello@oakready.com. We do not keep the arrival query string or advertising click identifiers. Please do not put personal information in campaign tags. Withdrawing permission removes the browser record and deletes the order-source record within an hour. It cannot recall an email already delivered to our team; mailbox copies follow our restricted business correspondence and privacy-request process.

With your permission, Google Analytics 4 counts visits and shows us which pages help people; the data we see is aggregated and does not identify you to us. With your separate permission, the Meta Pixel tells Meta when our advertising brought someone here so we can measure what works. Each loads only after its own permission, sends the consent signals Google and Meta expect, and neither runs until Oakready has configured it. Google and Meta process this data under their own privacy policies, and each may combine it with data they hold about you if you have a Google or Meta account. Withdrawing permission stops further collection but does not delete data those companies already hold; their policies explain how to ask them.

Meta's Conversions API can record one completed purchase from Oakready's server. We do this only after you save a marketing choice that allows it, and only after the same choice is still current immediately before sending. We ask every visitor to choose, including where local law may not require a banner. If we observe a Global Privacy Control signal, we save a marketing denial. Withdrawing permission suppresses an unsent event, but cannot recall an event already accepted by Meta.

The purchase event contains the purchase time, a stable event ID, the fixed Oakready purchase page address, order value and currency, the browser user agent, and optional Meta browser identifiers named _fbpand _fbc. It does not contain your name, email address, phone number, network address, Stripe customer or payment identifiers, account details or free text. Test and production test payments are excluded. Browser and consent lookup data is removed after a terminal delivery result, and abandoned precheckout attribution is removed after 30 days. The Oakready server consent record expires after one year. Meta's Business Tools Terms permit event data retention for up to two years.

Services we use

These services support Oakready. Their roles depend on the relevant feature; a provider is not sent every customer's information merely because it is listed. Contact us for the processing arrangements relevant to your service.

International transfers

Our production application and database run in the European Union, and the private R2 media storage is configured in the European Union. The controlled local build workflow can handle permitted temporary copies outside that hosting boundary. Some providers, including Google, OpenAI, Stripe, Resend and Meta, process data in the United States or other countries outside the United Kingdom. An agreed alternative initial-build model route may involve other countries. We must have an applicable lawful transfer mechanism and any required assessment and safeguards for restricted transfers. Contact hello@oakready.com for the arrangements applying to your service and how to obtain their details. A storage region alone does not describe every provider operation or support access.

How long we keep data

Our legal bases

Under UK GDPR we rely on performance of a contract, or steps you ask us to take before one, for the audit, accounts, website purchase and hosting, the Copywriter and enquiries you send us. We rely on our legitimate interests for security, abuse prevention, rate limits, service records, product improvement using aggregated data and marketing to businesses; we balance those interests against your rights before relying on them. We rely on your consent for analytics and marketing cookies, which you can withdraw at any time. We rely on legal obligation for tax, accounting and responding to lawful requests.

Your rights

Depending on the circumstances, you have the right to ask for access to your personal data, to have it corrected or erased, to restrict or object to its use, to receive a portable copy, and to withdraw consent where we rely on it. Contact hello@oakready.com to make a request or ask a question; we will respond within one month. You can also complain to the UK Information Commissioner's Office at ico.org.uk, and, if you are in the European Economic Area, to your local supervisory authority.

Deleting your website and account

You can request website deletion from Billing or contact hello@oakready.com. We save the request for review before removing anything. Requesting deletion does not cancel your hosting subscription or immediately delete your website. Manage your subscription in Billing and contact us first if you need an export.

Before account deletion, we resolve outstanding purchases and email deliveries, remove the live data for linked websites and record safeguards to prevent deleted data being restored from backups. Your account page explains any remaining steps. Once these checks are complete, you can confirm deletion there. This revokes every session, replaces the email with a non-identifying deletion address and removes the Google identifier and other account sign-in details.

Billing distinguishes removal of live website data from completion of deletion for retained copies. Backups and copies held by providers are checked separately and may remain until their removal is verified. Deleted data is excluded from restoration. We retain required financial records and limited security records under internal identifiers. Copies already received by someone else, such as an emailed report, remain under that recipient's control.

Children

Our services are for businesses and the people who run them. They are not directed at anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact hello@oakready.com and we will remove it.

Changes to this notice

We update this notice when our services or the law change. The date at the top shows the current version. Orders record the version you accepted at the time. Our terms of service and accessibility statement sit alongside this notice.