Privacy & cookies
How Design by Raf handles your information and cookies, in plain English.
How I handle your information, in plain English. Whether you've used this website or had an email from me, it's all below.
Who I am
I'm Raf Mitchell. I run Design by Raf, a creative and AI studio based in Cardiff. I'm the data controller for everything on this page; there's no one else behind it.
Contact: privacy@rafmitchell.com
If you use this website
What I collect, and why
| When you… | I keep | Why I'm allowed to | How long |
|---|---|---|---|
| Send an enquiry | Your name, email, business, website, what you need, your budget band and your message | To reply and talk about the work you asked about (steps before a contract) | For as long as we're talking or working together, then 3 years after we last spoke, then deleted. Projects can take years to get going, so every new conversation restarts that clock. If we work together, invoices and business records are kept for 6 years, as tax law requires |
| Use the Trust Score | Your email, first name if you give it, the website, Instagram handle or business name you typed, your answers, what the check found and your scores | To work out your score and email you the report (you asked for it). I also use it to follow up about your report (legitimate interests). More below | 3 years after we last spoke, then deleted |
| Download a free pack | Your email, which pack, and when | To send you the pack (you asked for it). Pressing Join also signs you up to my weekly email: that's the deal for a free pack (your consent) | 24 months, then deleted. The newsletter: until you unsubscribe |
| Buy a resource or send an enquiry | Your email and that you didn't say no | UK "soft opt-in": I may send my weekly email to customers and people asking about my services, unless you say no (on the checkout page, or the tick box on the enquiry form). More below | Until you unsubscribe |
| Tick the newsletter box | Your email and the date you said yes | Your consent. You can take it back any time: every email has an unsubscribe link | Until you unsubscribe |
| Buy a pack | Your name, email, what you bought, what you paid and when, and your tick to get the download straight away. Card details go to Stripe, never to me | To deliver it, show you agreed to instant download, and keep tax records (contract, legal obligation) | 6 years (tax law) |
| Visit the site | Pages viewed and buttons used, counted without cookies unless you accept them (see Cookies) | To see what works on the site (legitimate interests) | 12 months |
With every form, I also keep which page you sent it from, any campaign tags in the link you arrived by, your browser type and a scrambled (hashed) version of your internet address. That's for spam checks and to see which pages bring enquiries.
Every form is checked for spam (Cloudflare Turnstile and a few simple tests). Submissions that look automated are set aside and never acted on.
Partly automated: when an enquiry or a finished Trust Score arrives, it's added to my own system and I get a notification. Your Trust Score is worked out automatically from what the check finds and what you tell it. It's advice about your brand, nothing more: nothing about you is decided automatically.
The Trust Score
The Trust Score checks how your brand looks and works online, then emails you a report. Here's what happens to what you give it.
- The check. If you give a website address, my server visits your homepage and a few of its public files, the way a search engine would, and tries any logos it finds there so the logo tests can run in your browser. Your website address is also sent to Google PageSpeed Insights, which tests how fast the page loads on a phone. If you give an Instagram handle or a business name, it's only recorded, not checked.
- Your answers. The questions cover your type of business, how customers find you, the tools you already use, time spent on admin, your goal, how soon you want it and your budget. If you played the coffee cup game on this site, your result is added too (it's kept in your browser until then).
- Nothing leaves your browser until the last step. Your email, name, answers and scores are only sent when you press Show my score.
- The report. Your scores are saved in my own system along with what the check found and your answers, and the report is emailed to you through Resend.
- I hear about it. I get a notification on Telegram with your name, business, website, scores, budget answer and email, and your result goes into my system as a possible lead, so I may follow up personally about your report. If you'd rather I didn't, reply "stop" or email privacy@rafmitchell.com and I won't.
- No mailing list unless you tick. You're only added to my weekly email if you tick the box. I don't share your report with anyone.
The weekly email (soft opt-in)
If you buy a pack or send an enquiry, you'll get my weekly email (insider tips on the cutting edge of design and AI) unless you say no: on Stripe's checkout page, set "Weekly email" to No, skip the tips; on the enquiry form, tick the box that says you'd rather not. UK law (PECR) allows this "soft opt-in" for customers and people asking about my services, as long as you get a clear chance to say no at the time, and in every email after.
Saying no is easy, at any point:
- choose No, skip the tips on the checkout page, or tick "rather not" on the enquiry form
- click unsubscribe at the bottom of any email
- reply "stop" to any email, or email privacy@rafmitchell.com
If you buy without joining, Mailchimp still holds your email and that you're a customer, marked so it only gets order emails, never marketing.
Free downloads, the Trust Score and the newsletter form don't use the soft opt-in: you only join if you press Join for a free pack or tick the box.
Paying and downloading
Payment happens on Stripe's own secure checkout page. Stripe collects your card details, name and email. I never see your card number. Stripe tells me the order is paid, and I keep your name, email, what you bought and what you paid. Your tick to get the download straight away, with the exact wording and the time, is saved with the order. See the terms of sale for what that tick means.
Your download link is emailed to you through Resend. Paid links work for 30 days (up to 10 downloads); free pack links work for 7 days. The files are stored with Cloudflare R2, and each download uses a private link that expires after five minutes.
Cookies
Nothing that sets a cookie runs until you choose. You'll see a banner with Accept all, Reject all and Choose, and you can change your mind any time with Cookie settings at the bottom of every page.
| Type | What it does | Who provides it | Runs |
|---|---|---|---|
| Essential | Remembers your cookie choice | This site (stored in your browser) | Always (it has to, to remember you said no) |
| Preferences | Remembers if you joined or closed the 30%-off pop-up, so it doesn't keep appearing, and your coffee cup game result for the Trust Score | This site (stored in your browser, never sent anywhere unless you finish the Trust Score) | When you use those features |
| Analytics | Which pages and buttons people use, heatmaps and session recordings so I can improve the site | PostHog (EU), Google Analytics | Only if you accept analytics |
| Marketing | Measures whether my ads work | Meta (Facebook/Instagram) Pixel | Only if you accept marketing |
If you reject cookies, PostHog still counts visits without cookies or anything stored on your device.
Who else sees it
Only the services the site needs to work. They handle your information on my behalf:
- Vercel (hosting: every visit passes through it) · Supabase (my database, where forms, orders and Trust Scores are saved) · Sanity (the site's content and images)
- Resend (sends download, order and Trust Score report emails) · Mailchimp (the weekly email, and order-only records for customers)
- Cloudflare (spam protection on forms, and stores the download files) · Stripe (payments)
- Google PageSpeed Insights (the Trust Score speed test: it gets the website address you typed)
- Adobe Fonts (serves the site's typefaces, so it sees your internet address when a page loads)
- Telegram: notifications to me about enquiries and finished Trust Scores
- Calendly: only if you choose to book a call after sending an enquiry
- PostHog, Google Analytics, Meta: only with your consent, as above
- My email provider, when you write to me or I reply
I don't sell your details or share them for anyone else's marketing. Some of these services are based outside the UK, including in the United States. Where that's the case, transfers are covered by the safeguards in UK data protection law, such as approved contractual clauses.
If you've had an email from me
If you just want me to stop emailing: reply to any email with "stop" and I'll remove you straight away, across every address I send from. You don't need to explain yourself, and I won't email again to check. You can also email privacy@rafmitchell.com.
What I hold about you. Your name, job title and work email address. About your business: its name, website, location, social accounts, publicly listed activity and its registered company details from Companies House. My own notes: publicly available research about the business, so an email to you isn't generic. Contact records: whether I've emailed you, whether you replied, and whether you asked me to stop. Nothing about your personal life, no payment details, no ID documents, nothing sensitive.
Where I got it. Not from you, which is exactly why this section exists and why the first email tells you so: your business's own website, listings and social accounts; business contact data providers; Companies House, which is a public register; press coverage and public industry sources.
Why I'm allowed to email you. My lawful basis is legitimate interests: running and growing a small design studio by contacting the people who'd actually decide whether to hire one. I only write to named people in marketing, management or ownership roles at registered companies, about design work directly relevant to their job. I don't email sole traders or ordinary partnerships, and I don't email personal addresses. I've weighed that against your privacy: it's a small number of emails, to a work address, about something within your remit, and you can stop it with one word. If you'd like a copy of that assessment, ask and I'll send it.
What I use it for. Contacting you by email about design services for your business, and keeping a record of that contact so I don't approach you twice or after you've asked me not to. Choosing which businesses to contact is partly automated: a system checks public information against a set of criteria. It doesn't profile you personally, and nothing it decides has any legal effect on you or affects you in any significant way.
How long I keep it. Your name and email: 24 months, then deleted. The business information: kept (it's about a business, not a person). If you opt out: just your email address, kept permanently on a suppression list. It's the only way to guarantee you're never contacted again, and it's never used for anything else.
Who else sees it. Only the services I need to send an email and keep records: my email provider, an email sending platform, and the business data providers above.
Your rights
You can ask me to: tell you what I hold about you and give you a copy · correct anything that's wrong · delete it · stop using it, or restrict what I do with it · object to it entirely (where my basis is legitimate interests you can object at any time, and for direct marketing I have to stop, no justification needed) · withdraw consent any time, where I rely on it.
Email privacy@rafmitchell.com and I'll deal with it within a month. It's free.
If you're not happy
Tell me first and I'll try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.
Changes to this page
If I change how any of this works, I'll update this page and the date at the top.
Buying something? The terms of sale cover prices, downloads, refunds and the licence.
Design by Raf · Cardiff, United Kingdom · privacy@rafmitchell.com