Privacy.

This site is run by James Graham, trading as AutomatedPanda, a one-person studio, not a registered company. I decide what happens to the information described here, which in data protection terms makes me the controller for it.

For anything on this page, including a request to delete what I hold, write to hello@automatedpanda.com.

The form on the contact page asks for five things, and it does not quietly collect a sixth:

Your name

So I know who I am replying to.

Your email

So I can reply. It is the only way I contact you.

The project

What you type about what you are building. It is stored exactly as you wrote it, so please do not paste anything confidential you would rather discuss on a call.

Budget band

One of five ranges. Not a number you type.

Timeline

One of a few options.

There is also a hidden field a human never sees, which exists to catch automated spam. If it is filled in, the submission is discarded.

When you submit the form, three things happen and nothing else:

1. 01It is turned into a project brief, the same document you can download, and emailed to me, with the brief attached as a PDF.
2. 02The same brief is saved to my database so I can find it again when we talk.
3. 03You see a confirmation. No account is created and you are not added to any list.

I do not sell it, share it for anyone else’s marketing, or use it to email you about anything other than the project you asked about.

You sent me a project enquiry, so handling it is a step taken at your request before we might enter into a contract. That is the lawful basis for the enquiry details.

Analytics is different and rests on your consent alone, which is why it is a question rather than a notice, and why nothing loads until you answer it.

Enquiries

While we are talking, and for 24 months after our last exchange. Then deleted.

Client project records

For as long as the work runs, and for 6 years after it ends, because that is how long tax and contract records need to survive.

Analytics

Retained by Google for 14 months. Only exists if you agreed to it.

If you want your enquiry gone sooner, ask and I will delete it. I do not need a reason from you.

I run this on other people’s infrastructure, so four companies process some of it on my behalf. They may not use it for their own purposes.

Vercel

Hosts the site. Like any web server, it records requests, including your IP address, in logs used to keep the site up and to spot abuse.

Supabase

Stores the enquiry and the brief made from it.

Resend

Delivers the enquiry email to me.

Google Analytics

Only if you agreed. Nothing is sent to Google before that, and turning it off clears its cookies.

These are US companies, so your information reaches the United States. Transfers rely on the contractual safeguards each provides.

Worth stating plainly, because most sites do at least one of these and you cannot tell from the outside:

• No advertising or tracking pixels. No Meta pixel, no LinkedIn tag, no retargeting.
• No fonts fetched from Google. They are downloaded when the site is built and served from this domain, so your browser never calls Google for them.
• No session recording, heatmaps, or scroll tracking.
• No cookies at all unless you accept analytics.

You can ask me for a copy of what I hold about you, to correct it, to delete it, to restrict what I do with it, or to object to it. You can also ask for it in a portable format. Where something rests on your consent, you can withdraw that at any time. For analytics, use the cookies page.

Email hello@automatedpanda.com and I will deal with it within a month. There is no charge.

If I get it wrong, you can complain to the UK Information Commissioner’s Office at ico.org.uk. I would rather you told me first so I can fix it, but you do not have to.

If this changes materially I will update the date at the top. There is no archive of previous versions. If you need to know what it said on a particular day, ask me.