Privacy notice.

Who is responsible?

Moorlight Digital is an independent web design and development business based in Halifax, West Yorkshire. Moorlight is responsible for the information described in this notice.

For a privacy question or request, use our contact form and select “Privacy request”. You can also use that route to ask for the proprietor’s details before entering into an agreement.

When you get in touch

We collect the name, business name, email address, optional telephone number, optional website and message you provide. We use these to respond, prepare a website review and discuss a potential project. Our legal basis is taking steps at your request before a contract, or our legitimate interest in responding to a general enquiry.

Please avoid including passwords, patient details or other sensitive information in a website enquiry. Sending a message does not subscribe you to a newsletter.

Business research and relevant introductions

We may research publicly available business information to identify businesses that could benefit from our services. This can include the business name, public website, sector, location, corporate identity, trading evidence and relevant business contact information.

Sources may include business websites, public registers and licensed business listings. We keep a record of the source and the reason a contact appears relevant. Where personal data is involved, our basis is a legitimate interest in making a proportionate, relevant business introduction, subject to your rights and the applicable electronic marketing rules.

You can object to direct marketing at any time. Use the unsubscribe link in an email, reply asking us to stop, or send a privacy request. We retain a minimal suppression record so that a later import does not cause us to contact you again.

Who can access information?

Information is used by the person running Moorlight and service providers needed to operate the business, such as hosting, email, payment and business software providers. Access is limited to what is needed for the relevant service. We do not sell your contact information.

If a provider handles personal data outside the UK, appropriate transfer safeguards are required before using it for that purpose. Payment details are handled by the selected payment provider rather than collected through the enquiry form.

How long do we keep it?

Unconverted prospect records are normally removed six months after the last relevant activity. Review enquiries are normally removed six months after completion, unless an ongoing relationship or another legitimate legal purpose requires them.

Isolated recovery backups may retain deleted information for up to 30 additional days. We apply current retention before restored records are used again. Minimal marketing suppression records are retained to honour objections. Different legal retention periods apply to client agreements, invoices and accounting records.

Your choices and rights

Depending on the circumstances, you can ask to access or correct personal information, request deletion, restrict its use or receive a portable copy. You can object to use based on legitimate interests and always object to direct marketing. We may need to confirm your identity before responding.

Contact us using the route above. If you remain unhappy about how we handle personal information, you can raise a concern with the Information Commissioner’s Office.

Cookies and technical information

The public marketing site does not use advertising trackers, email-open pixels or analytics cookies. We keep aggregate daily campaign counts for page visits, shared-review views, submitted enquiries and progression into projects for 90 days. These counts contain no email addresses, raw review tokens, visitor identifiers, IP addresses or browsing histories. A campaign label can stay in page memory and in links as you browse; it is not a visitor identifier. Browser views are not proof that a person read a review. Necessary security or session cookies may be used for private administration. Our hosting infrastructure may process technical request information to serve and protect the website.

If we introduce optional analytics or change how personal information is used, we will update this notice and request any required consent before those tools run.

Reviews shared by email

For outreach, we use the public-page checks and AI-assisted design and wording assessment, then approve the assessment before sharing it. The report contains public website observations and screenshots, not the recipient’s email or our private notes. New emailed sharing links last 30 days from the initial dispatch attempt; manually shared links last 30 days from publication. Older links retain their original expiry. Anyone with the link can read the review, but it does not verify identity or provide portal access. You can contact us to withdraw a shared review.

Short enquiry forms create a follow-up task and queue an acknowledgement email. An enquiry about an emailed review pauses further automated follow-ups while we respond. An acknowledgement confirms receipt; it does not create a contract or add marketing permission.

Your client portal

For a website review, you can enter a public website address and read the automated results before providing contact details. A necessary browser cookie gives this browser access to its reviews. It is HttpOnly and lasts up to seven days; we store a keyed hash of its identifier. We also use keyed request-limit markers to manage demand and prevent abuse. The review checks public pages only, without logging in or submitting forms.

When AI-assisted reviews are enabled, we send a bounded sample of public website text, screenshots and automated check results to OpenAI to prepare a short review. For these reviews, we do not send your enquiry details, account information, messages or our private notes. AI suggestions can be mistaken and are separate from measured checks. We disable response application storage; OpenAI may retain abuse-monitoring content for up to 30 days, subject to its exceptions. API data is not used to train models by default. Our seven-day deletion schedule does not shorten OpenAI’s retention.

Anonymous results and captures may be reused for the same website for seven days. Other visitors who submit that website can receive the same public-page observations, but never your name, email, enquiry, messages, private reports or owner notes. Anonymous results and browser grants expire after seven days. A review does not establish ownership of the website.

If you ask to discuss a better website, we collect your name, email address and message, and create a private enquiry and follow-up task with a saved copy of the review. You do not need to verify your email to enquire. An enquiry does not establish ownership of a business or grant access to a client workspace. This request is not marketing consent. We email you an acknowledgement and keep your enquiry and report privately under the retention rules below. Your client portal becomes available only when Moorlight explicitly starts your project.

For a new project, you can describe your idea and receive an instant outline before providing contact details. We send your description to OpenAI to prepare that outline; the monthly estimate comes from Moorlight’s approved pricing rules. Later name, company and email fields, account records, messages and private notes are not included in this request. Personal information you write in the description itself will be included, so please leave out passwords and sensitive information. The OpenAI storage and retention information above also applies to these outlines. An outline is provisional and is not an accepted quote.

Project descriptions, outlines and their necessary HttpOnly browser grants are kept privately for seven days and are never shared or reused between visitors. We keep keyed request-limit markers and minimal AI cost records separately to protect the service and account for spending. If you submit an enquiry, we save a private copy under the enquiry retention rules and email you a short acknowledgement. Replies go to our contact inbox until your project starts.

Unfinished project briefs, names, company names and your place in the form are saved in this browser for seven days after your last edit, then discarded when accessed. Clear them using “Start again”. Email addresses, sign-in codes and session credentials are excluded from these device drafts.

The client portal requires verified email, workspace membership and explicit project activation by Moorlight. It uses messages, files, approvals and billing references to discuss and deliver started projects. Confirmation and invitation emails are necessary service messages; optional activity-email preferences do not suppress them. Necessary session cookies keep you signed in; sign-in codes are short-lived and stored as hashes. Minimal hashed allowance markers from the previous verified-email review offer remain separate from the anonymous review cache for the duration of that earlier offer’s records.

Inactive unsigned portal enquiries and their project content expire after six months. Signed project agreements, acceptance evidence, billing and necessary client records follow the business retention periods described above. Private backups include portal records and shared files. You can mute optional activity and unread-message emails in Settings; necessary sign-in and essential billing notices remain available. Replies to project notifications should be made inside the portal.