Privacy policy
Last updated: 17 August 2026
1. Who is responsible for your data?
online2day.com is the trading identity responsible for the personal data described in this notice when acting as controller. Privacy enquiries and data-rights requests can be sent to hello@online2day.com. Where we process data solely on a customer’s instructions for a hosted or integrated service, that customer may instead be the controller.
2. What we collect
Depending on how you interact with us, we may collect identity and contact information, business details, enquiry and project information, correspondence, billing and transaction references, technical device/log information, and preferences you choose to provide. We aim not to collect information we do not need.
3. Why we use it and our lawful bases
We may process information to respond to enquiries and take steps before a contract; deliver and administer contracted services; operate, secure and improve our website and services based on legitimate interests; comply with legal obligations; and send optional marketing where consent or another lawful basis permits it. We assess and balance legitimate interests against individual rights where required.
4. Project wizard and contact data
When you send a project brief, we process the contact details and requirements you provide so we can respond, assess the work and manage the enquiry. The submission is handled by our website and may be recorded in our Supabase-backed workflow and HubSpot CRM. Please do not include special-category personal data or confidential credentials in the notes field.
5. Payments, cookies and analytics
Launch and Growth checkout is hosted by Stripe, which processes payment and billing information under its own privacy terms. We use Vercel Analytics to understand aggregate site usage. The public site does not require advertising cookies; if non-essential tracking is added, we will update the cookie information and request consent where required.
6. Sharing and processors
We use vetted providers including Vercel for hosting and analytics, Supabase for data and authentication, HubSpot for customer relationship management, Resend for operational email and Stripe for payments. We disclose personal data only where reasonably necessary, contractually appropriate or legally required.
7. International transfers
Some service providers may process data outside the UK. Where UK data-protection law requires safeguards, we will use an approved transfer mechanism or rely on another lawful basis for the transfer and apply appropriate supplementary measures where necessary.
8. Retention
We retain personal data only for as long as reasonably necessary for the purpose collected, including contractual, accounting, security and legal requirements. Retention periods vary by record type and relationship.
9. Your rights
Subject to the circumstances and applicable exemptions, you may have rights of access, rectification, erasure, restriction, objection, portability and rights relating to solely automated decisions. Where processing relies on consent, you can withdraw that consent without affecting earlier lawful processing.
10. Complaints
Please contact us first if you have a privacy concern so we can investigate. You also have the right to complain to the UK Information Commissioner’s Office (ICO) where you believe data-protection law has been breached.
11. Changes
We may update this notice when our services, suppliers or legal obligations change. The date at the top shows the latest published revision.