How I handle your data.

1. Who is responsible

ODUEX is a one-person consultancy run by me, Daniel. For anything you send through this site, ODUEX is the data controller: the one who decides what is collected and what happens to it afterwards. Those decisions are mine, so anything you want changed comes straight to me and does not go through a support queue.

ODUEX (sole trader)
enquiries@oduex.com
+44 7428 431562
UK-based, working with businesses across the UK, entirely remotely.

There is no data protection officer, because a business this size is not required to appoint one and I am not going to invent a department. Data questions come to the address above and I answer them myself.

2. What this site collects

Six things happen on this site that involve you. Here is what each one takes.

The enquiry form

Your name, your work email, your business name and your description of what you are trying to fix. Optionally a phone number, the kind of work you think you need and a timeline. Phone is never required. There is no budget field and nothing asking how you heard about me.

The operations teardown

Your name, your email and your answers about how work currently moves through your business. Those answers are the point of the exercise: I read them to write the map I send back. They arrive as an enquiry and are treated exactly the same way as one.

Ask ODUEX, the assistant

The assistant is software I built. What you type is sent to a language model to produce the reply, and the conversation is held in your browser’s session storage so it survives you moving between pages. Your browser clears that when you close the tab.

If you leave an email address, or if the conversation gets far enough to be worth a person seeing, the transcript is sent to me as an enquiry, tagged with the page you were on when it started. The assistant says so in its own footer. Treat it as a conversation with a business, not a private notebook, and do not paste anything confidential into it.

The workflow demo on the home page

The home page carries a small working demo: you type what a customer might say and it sorts the message in front of you. That sentence is sent to a language model so the sort is a real one rather than a recording, and the answer comes straight back to your screen.

It is not written to storage and it does not reach my inbox. It is a demonstration rather than a form, so put a realistic sentence into it and nothing confidential.

Booking a call

The calendar on the contact page is embedded from Cal.com. If you book, the name, email and any note you type go to Cal.com and then to me. That happens under Cal.com’s own privacy notice as well as this one.

Technical information every website receives

When a page loads, the server receives your IP address, the country it resolves to, your browser’s user agent and the address of the page you asked for. Every website receives this; nothing is placed on your device to obtain it.

When you submit a form, the IP address, country and user agent are stored alongside your enquiry. That is what makes spam and abuse traceable, and it is the only reason it is kept.

3. Why, and the lawful basis

Under UK GDPR every use of your data needs a lawful basis. Mine, in plain terms:

Replying to your enquiry: legitimate interests

You contacted a business about work. Reading it and replying is the obvious use of what you sent and it is exactly what you expected when you pressed the button. You get a reply from one person. No list, no sequence, no resale.

Writing your teardown: steps taken at your request

You asked for the map. I cannot write it without the answers.

Running the assistant: legitimate interests

Answering questions about the work without you having to wait for me, and passing on anything that genuinely needs a person.

Keeping the site up and the spam out: legitimate interests

Rate limits, the anti-spam check and a traceable abuse record exist so that the form still works for people with real problems.

Keeping my books: legal obligation

Once you become a client, HMRC requires records of the work I invoice. That is the law rather than a choice of mine.

Anything else: consent

Asked for plainly, in words, and withdrawable by replying to any message I have sent you.

I do not send marketing email. There is no newsletter, no drip sequence and no list to be added to. If that ever changes it will be a separate opt-in that you choose, not a tick box you have to find and clear.

4. Who else handles it

Four companies process data on my behalf. Each is bound by terms that limit them to my instructions and stop them using what you sent for their own ends.

Cloudflare

Hosts the site, runs the code behind the forms, stores enquiries in its key-value storage, and provides the Turnstile anti-spam check on the form. It also sees the standard technical information above as part of serving you the page.

Resend

Delivers the two emails an enquiry produces: the one that reaches my inbox at enquiries@oduex.com and the confirmation that reaches yours. It handles your name, your email and the message body in transit.

Anthropic

Generates the assistant’s replies and sorts the sentence you type into the home page demo. What you send is passed to its API so the model can answer, under commercial terms that do not permit that content to be used to train models. If that service is unavailable, Cloudflare’s own model service answers instead, on the same footing.

Cal.com

Runs the booking calendar embedded on the contact page, and receives only what you type into it.

That is the whole list, and nobody outside those four names receives anything. Nothing is sold. Nothing goes to an advertiser or a data broker. There is no advertising pixel and no social embed on any page of this site, which is unusual enough to be worth stating plainly. The only measurement is the cookieless page counter in clause 6, and that is Cloudflare’s, so it adds no fifth company.

I will also disclose something if the law requires it, such as a court order or a genuine legal obligation. If that ever happens and I am allowed to tell you, I will.

5. Where it lives, and for how long

Keeping data forever because storage costs nothing is not a policy. These are the actual periods.

Your enquiry, in my inbox

Kept while there is any real prospect of us working together, and for 24 months after our last contact if there is not. Then deleted.

Your enquiry, in storage

The same record is written to Cloudflare’s storage before the email is sent, so that a mail failure can never lose your message. The same 24-month rule applies, and I clear it on the same pass.

An unfinished assistant conversation

Deleted automatically 30 days after it stops. That one expires on its own rather than waiting for me.

Anti-spam and rate-limit counters

Twenty minutes or less for the counters behind the forms, and up to 24 hours for the one that limits how much of the assistant a single visitor can use. Each holds a number counted against your IP address, never anything you typed, and each expires on its own.

Client records

Six years after the end of the tax year the work was invoiced in, because HMRC requires it. Only what the books actually need, not the whole conversation.

Whatever is in your own browser

Not mine to keep. Your device clears it when you close the tab, and you can clear it sooner from your browser settings.

If you ask me to delete something before those periods are up, I delete it, unless the law says I have to keep it. In that case I will tell you which record I am keeping and why.

6. Cookies, and why there is no banner

This site sets no cookies for analytics, advertising or tracking. There is no consent banner because there is nothing here to consent to. That is a deliberate choice, not an oversight: a banner is a toll charged on every visitor for the benefit of the site owner, and I would rather build a site that does not need one.

Two things do store something, and neither is tracking:

• Session storage. The assistant conversation and your teardown answers are held by your own browser so they survive you moving between pages. They stay on your device, they are not readable by anyone else, and they are gone when the tab closes.
• Strictly necessary security. The protection in front of the site and the anti-spam check on the form may set a short-lived cookie to tell a person from a bot. That kind of cookie is exempt from consent under the Privacy and Electronic Communications Regulations, and it carries no profile of you.

Where I measure traffic, it is with a cookieless counter that records page views without a cookie, without a device fingerprint and without following you to any other site. If that ever stops being true, this page changes before the script does.

7. Data leaving the UK

Some of the companies in clause 4 are based in the United States, and all of them route traffic through servers in more than one country. Where your data leaves the UK it is covered by the safeguards UK law requires: either an adequacy decision, or standard contractual clauses with the UK addendum, agreed with that provider.

If you want to know which applies to which, ask and I will tell you.

8. Keeping it secure

Everything is served over HTTPS under a strict content security policy that names the handful of origins allowed to run anything at all. No page loads a script from an ad network. Form submissions are rate limited and spam checked. Every enquiry is written to storage before the email is sent, so a delivery failure loses nothing. Access to the inbox and to the stored records is mine alone, on accounts with two-factor authentication.

No system is perfect, and a page claiming otherwise would be worth less than nothing. If something went wrong and your data was genuinely at risk, I would tell you and the ICO inside the time the law allows, and I would tell you what actually happened rather than a sentence about taking security seriously.

9. Your rights

UK GDPR gives you these, and they are not favours:

Access

Ask for a copy of everything I hold about you.

Rectification

Have anything wrong corrected.

Erasure

Have it deleted, where I have no legal reason to keep it.

Restriction

Tell me to stop using it while something is being sorted out.

Portability

Get what you gave me in a machine-readable file.

Objection

Object to any use I have based on legitimate interests, including anything you would consider marketing.

Withdrawing consent

Where consent is the basis, take it back at any time. That does not undo anything done while it stood.

Ask for any of these at enquiries@oduex.com. I will do it within one month, at no cost, and I will not ask you to justify it. I may need you to confirm you are who you say you are, which for an emailed enquiry usually means replying from the address you used.

One honest note on automated decisions. The assistant reads what you write and suggests where I would start. That is a suggestion in a chat window: it does not score you, it does not decide anything about you, and nothing that affects you happens without me reading it myself.

10. Complaining to the ICO

If you think I have handled your data badly, tell me first at enquiries@oduex.com and I will put it right if I can. You are under no obligation to come to me first.

You can complain directly to the Information Commissioner’s Office, the UK regulator, at ico.org.uk. It costs nothing and it does not affect anything else between us.

11. Children

This site is for people running businesses. I do not knowingly collect anything from anyone under 18, and none of the forms are aimed at them. If you believe a child has sent something through this site, email me and I will delete it.

12. Changes to this policy

When this changes, the version and date at the top change with it. A material change (a new processor, a new purpose, a longer retention period) gets a line here saying what changed. Silent edits to a privacy policy are how trust gets spent.

The rules covering the site itself, rather than your data, are in the terms.

13. How to reach me

Data questions go to the same place as everything else, because there is one person here.

ODUEX (sole trader)
enquiries@oduex.com
+44 7428 431562
WhatsApp me

I reply to every enquiry personally within one working day. If I can’t help, I’ll say so and point you at someone who can.