Last updated 29 October 2026

Privacy policy

Plain English on what I collect, why I need it, and how you stay in control of it.

The short version

  • I only collect what I need to talk to you and deliver your project.
  • I never sell your details or add you to a mailing list without asking.
  • Only I can see your information. There’s no team, no subcontractors.
  • Your project data is stored on servers in the UK.
  • Ask me to delete your details at any time and I will.

01Who I am

axolot is the trading name of Abraham Hernandez Zaidi, a sole trader based in the United Kingdom. It’s a one-person design and development studio, so when this policy says “I”, “me” or “axolot”, that’s who it means.

I’m the data controller for the personal information described here, which means I decide how it’s used and I’m responsible for looking after it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For anything to do with your data, email me at abrahamzaidi.codes@gmail.com. I’ll reply within a working day, and deal with any formal request within one month.

02What I collect

When you send an enquiry

Your name, email address and, if you add them, your company, what you need, your timeline and your message. I also note which page of the site you sent it from.

When we work together

Your contact details, including a phone number if you share one, along with what we create together: files, comments, project updates, notes from our catch-ups and tasks.

When you use the client portal

Your email address and sign-in details, so you can access your projects. Passwords are stored securely and I can never see them. I also keep track of things like which comments you’ve read, so the portal can show you what’s new.

When you visit the website

Anonymous statistics such as which pages are viewed, the type of device and the country a visit comes from. These don’t identify you. Like any website, my host also briefly processes your IP address to deliver pages and protect the site from abuse.

I don’t ask for sensitive information, such as health details or bank details, and I’d ask you not to send it to me.

03How I use it

The law requires a reason, called a “lawful basis”, for every way personal information is used. Here’s each one:

WhyWhatLawful basis
Replying to your enquiry and discussing your projectEnquiry details, name, email, phone numberTaking steps at your request before a contract, and my legitimate interest in answering enquiries
Planning, building and delivering your projectContact details, project files, comments, meeting notes, tasksPerforming our contract
Running your client portal account and keeping it secureEmail address, sign-in details, activity in the portal, and your name and profile picture from Google if you sign in with itPerforming our contract, and my legitimate interest in keeping accounts secure
Following up after a project about support or similar servicesName, email, phone number, project historyLegitimate interests, with the option to opt out at any time
Featuring your project, name or testimonial in my portfolioWhatever you approve, nothing moreYour consent, which you can withdraw at any time
Understanding how the website is used, in aggregateAnonymous page views, device type, countryLegitimate interest in improving the website
Meeting legal, tax and accounting dutiesRecords of work and paymentsLegal obligation

Your information is only used for the work we do together. I never sell it, rent it out or use it to build profiles of you.

04Staying in touch

After a project, I may get in touch personally to check in, offer help with what I’ve built or suggest related services. Every message makes it easy to say no thanks, and if you do, I won’t contact you about new work again.

I don’t run a newsletter. If I ever start one, you’ll only receive it if you’ve opted in, and you can unsubscribe in one click.

I’ll never feature your name, logo, project or testimonial on my website or social media without your approval.

05Who I share it with

I work alone, so no one else at axolot sees your information. To run the studio I use a small number of trusted service providers. They act on my instructions only, under data protection agreements, and can’t use your data for their own purposes.

  • Supabase

    Database, file storage and client portal sign-in, including sign-in emails

    UK

  • Vercel

    Hosts the website and provides cookie-free visitor statistics

    Global network, including the US

  • Google

    Email conversations with you (Gmail), and Continue with Google sign-in if you choose it

    Global, including the US

  • Anthropic

    Claude, the AI assistant I use to help run the studio. It reads enquiry and project details only when I ask it to

    US

If we talk by video call, the call service we agree on (for example Google Meet or Zoom) will process the call. I don’t record calls without asking first.

Beyond that, I’d only share your information if the law required it, for example a valid request from a court or HMRC. If axolot becomes a limited company, your information would move to that company and this policy would continue to apply.

06Where it’s stored

Enquiries, client records and project files are stored on servers in the UK.

Some providers, such as my website host, email service and AI assistant, are international and may process data in other countries, including the United States. When that happens, your information is protected by UK adequacy regulations (such as the UK–US Data Bridge) or by the ICO-approved contract terms for international transfers.

07How long I keep it

I keep information only as long as it’s useful to you or I’m legally required to.

Enquiries that don’t go ahead
Up to 12 months from our last contact. Often sooner: once an enquiry is dealt with I may delete it straight away.
Enquiries that become projects
Become part of your client record (below).
Client contact details
3 years after our last project or contact, unless we’re still working together.
Project files and portal content
2 years after the project is completed, so you can come back to them.
Financial records, such as invoices
6 years, because HMRC requires it.
Website statistics
Aggregated and anonymous, so they don’t identify you.

When a period ends, the information is deleted for good.

08Keeping it safe

Everything is sent over an encrypted connection (HTTPS). Access to studio data is limited to my account, and each client portal account can only see its own projects. I use strong, unique passwords and two-factor authentication on the services that hold your data.

No system is perfectly secure, but if something did go wrong I’d act quickly. Where the law requires it, I’d report it to the Information Commissioner’s Office within 72 hours and tell you directly if you were at risk.

09Your rights

Under UK data protection law you can:

  • See your dataAsk for a copy of everything I hold about you.
  • Correct itHave anything inaccurate or incomplete fixed.
  • Delete itAsk me to erase your information completely.
  • Restrict itAsk me to pause using it while something is sorted out.
  • ObjectObject to how I use it, and stop any marketing outright.
  • Take it with youGet your data in a common, machine-readable format.
  • Withdraw consentChange your mind about anything you agreed to.
  • A human decidesI never make automated decisions about you. A person, me, does.

Want everything deleted?

Email abrahamzaidi.codes@gmail.com and I’ll permanently delete your enquiry, client record, portal account and project files within one month, usually much sooner. The only exception is anything I’m legally required to keep, such as invoices for tax purposes. If that applies, I’ll tell you exactly what and for how long.

Making a request is free. I may need to confirm who you are before acting on it, so I don’t hand your information to someone else.

10Cookies and analytics

This website doesn’t use advertising or tracking cookies. The visitor statistics I collect are cookie-free and anonymous.

The only cookies are the essential ones that keep you signed in to the client portal. They’re strictly necessary for the portal to work, so they don’t need your consent, and they don’t track you anywhere else.

If I ever add tools that use non-essential cookies, such as Google Analytics, I’ll update this policy and ask for your permission before any are set.

11Children

My services are for adults and businesses. I don’t knowingly collect information from anyone under 18. If you’re under 18 and would like to work with me, please ask a parent or guardian to get in touch.

12Wherever you are

I work with clients wherever they are. This policy applies to everyone, and I give everyone the same rights and protections described above, wherever you live.

If you’re in the European Union or European Economic Area, you have equivalent rights under the EU GDPR, and you can also complain to the data protection authority where you live.

13Complaints

If you’re unhappy with how I’ve handled your information, please tell me first at abrahamzaidi.codes@gmail.com and I’ll do my best to put it right.

You also have the right to complain to the UK’s data protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

14Changes to this policy

I’ll update this policy when the way I work changes, for example when I start sending invoices through an accounting service. The date at the top always shows the latest version. If a change significantly affects you, I’ll let current clients know by email.