Privacy notice

Contact form. When you submit the form on /contact/, the fields you fill (name, email, company if provided, and your message) are sent to me so I can reply. Lawful basis: legitimate interest in responding to enquiries about my services, and — where you're asking me to prepare a quote — steps taken at your request before entering a contract.

Strategy-call booking. If you book a paid strategy call, you'll provide payment details to Stripe and a name, email and preferred slot to Google Calendar. I only see the confirmation that payment succeeded and the booking that lands in my calendar. Lawful basis: performance of a contract.

Engagement work. If we work together, I'll process the information you share to deliver the engagement (correspondence, working documents, agreed deliverables). Lawful basis: performance of a contract.

Server logs. Basic access logs (IP address, request path, timestamp, user agent) are retained for a short period for security and abuse-prevention. Lawful basis: legitimate interest in keeping the site available and safe.

There is no marketing list, no third-party analytics, no behavioural profiling and no resale of personal data.

I use the following third parties as data processors. Each is bound by their own published terms and data-processing agreements, and each has been chosen for its security posture and minimal data footprint.

• Formspree (US) — receives and forwards contact-form submissions. Data: the form fields you send. Formspree does not resell submissions. See formspree.io/legal/privacy-policy.
• Stripe (US/UK) — handles strategy-call payments. Data: your payment method, billing name and email, transaction metadata. I never see full card numbers. See stripe.com/gb/privacy.
• Google (Google Calendar / Workspace) — hosts my calendar and email. Data: booking details, name, email and any correspondence you send. See policies.google.com/privacy.
• Lovable (Sweden/EU) — hosts this website. Data: server access logs only. See lovable.dev/privacy.

International transfers rely on the UK's data adequacy decisions and, where those don't apply, standard contractual clauses in the processor's terms.

Contact enquiries: up to 24 months after last contact, then deleted, unless they've become part of an active engagement record.

Engagement records and invoices: retained for 6 years to meet UK accounting and tax requirements, then deleted.

Server logs: up to 30 days.

You have the standard UK GDPR rights: access, correction, deletion, restriction, objection and portability, plus the right to withdraw consent where processing relies on it. Email hello@stevehooperai.com and I'll respond within one working week. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

Material changes to this notice will be dated and summarised at the top of the page. This version: July 2026.