Your details.

What we collect, why, and what you can ask us to do with it. In plain English.

Last updated 15 October 2026.

You asked us for a free concept

What we collect

When you ask for a free concept we collect what you type into the form: your business name, your current website (if you have one), your type of business, your town, your mobile number and your email address.

This website uses no advertising or tracking cookies or scripts. The only outside script is Cloudflare’s spam check (Turnstile) on the concept form. It loads only when you start filling the form in, and it’s used only to stop spam, never for advertising or tracking.

Why we use it

• To design your free concept and send you the link.
• To get in touch about your concept by phone, text, WhatsApp or email.
• If you become a client, to run the service you’ve signed up for.

We use your details because you’ve asked us to do something for you. We never sell them or pass them to anyone for their own marketing.

Where it’s kept

When you send the form, your enquiry is saved in our database on Cloudflare, sent by Resend (an email delivery service) to our business inbox at Microsoft 365, and sent as a private push notification to our phone through ntfy. If you gave us an email address, Resend also sends you one email to confirm we’ve got your details. If you gave us a mobile number, we may confirm on WhatsApp instead. This website is hosted by Cloudflare. If you use a speed check on this site, the web address you type is sent to Google PageSpeed Insights to run the test.

How long we keep it

If you don’t go ahead, we delete your enquiry within 12 months, or sooner if you ask. If you become a client, we keep your details for as long as you are one, plus the time the law requires for business records.

We contacted your business about a free concept

Sometimes we design a free concept for a business before it has asked us, and send the owner a short email with the link.

What we use, and where it comes from

Only business details that are already public: your business name, town and type of business, the business email address or phone number shown on your website or listings, your website address, and public facts about your business online, such as your Google Maps listing, your number of Google reviews and how fast your website loads on a phone. We find these on your own website, on Google Maps and other public business listings, and on Companies House.

Why, and on what basis

To show you what a new website for your business could look like. We do this under “legitimate interests”: we have a genuine interest in offering our service to local businesses, we only use business contact details, and you can tell us to stop at any time.

Your concept page

Your concept is on a private link that isn’t listed anywhere and is hidden from search engines. It’s taken down after 30 days. We use stock or made-for-purpose images, never your own photos, logo or customer reviews without your permission.

Stopping us

We email you at most twice. Every email has a one-click link to stop us contacting you, or just email [email protected]. When you opt out we stop straight away, and keep only your business email address on a do-not-contact list so it doesn’t happen again. If you don’t reply, we delete your details within 12 months.

You’re a Nordmark client

We keep your name, business details, contact details, the photos and words you send us for your website, your plan and your billing history, so we can run your service and bill you. Card payments are handled by Stripe; we never see or store your full card number. We keep these for as long as you’re a client, plus the time the law requires for business records.

You called a business that uses our AI receptionist

We run websites, an AI receptionist and a dashboard for local businesses (our clients). When a client’s phone isn’t answered, the call can come through to our AI receptionist, which answers in that business’s name.

Who’s in charge of your details

The business you called is in charge of your details (the “data controller”). We handle them only on its behalf and on its instructions (as its “data processor”).

What happens on the call

• The AI receptionist says at the start of every call that it’s an AI assistant and that the call is recorded.
• We record the call and turn it into a written transcript using AI. We use xAI for the voice and the transcript.
• We note your phone number, your name, your postcode and what you need, and text that to the business so it can call you back.
• We text you to confirm your message has been passed on.

Why calls are recorded

So the business gets your message exactly as you said it, can check the details if something was missed, and can sort out any disagreement about what was said.

How long we keep it

The voice recording of a call is deleted after 90 days.

The written summary and transcript of the call, and your name, number and postcode in the business’s call list, are kept while the business’s account with us is active, so its call history and monthly figures stay complete. The business can ask us to delete them sooner. When the business leaves us, we delete them or hand them over, as it tells us.

Asking for a copy or deletion

Contact the business you called, or email [email protected]. We’ll act on it with that business straight away.

Website enquiries and visitor counting

We also handle what you type into a contact form on a client’s website, on the client’s behalf. Our clients’ websites count visits and taps on call and WhatsApp buttons with Umami, which we host ourselves. It uses no cookies and doesn’t build a profile of you. We never sell any of these details or use them for our own marketing.

Who helps us run the service

These companies (our “sub-processors”) handle details for us, only to provide their service to us.

Umami, which counts visits on our clients’ websites, runs on our own server, not a third party’s.

Details processed outside the UK

Some of these companies, including xAI, Twilio, Stripe, Resend, Google and Meta, are based in the United States and may process details there. Before we use any of them for your details, we put in place the safeguards UK data protection law requires: the UK International Data Transfer Agreement (IDTA), or the EU standard contractual clauses with the UK Addendum, or the UK–US Data Bridge where the company is certified under it.

Your rights

You can ask us for a copy of your details, to correct them, or to delete them. You can also object to us using them, including to us contacting your business about a free concept. Just email [email protected] or send a WhatsApp to 07901 294023. If you’re unhappy with how we’ve handled your details, you can complain to the Information Commissioner’s Office at ico.org.uk.