How we handle your data.

What we hold. Your name, email address, the organisation you act for, your sign-in credentials (a hashed password, and any passkeys you register), your profile photo if you add one, your preferences in the admin (theme, language, how many rows a list shows, which columns you have turned off), billing details held by our payment provider, and a record of what you do in the admin - the activity log that lets you see who changed what.

Why. To run your account and let you sign in; to bill you; to secure the platform (sign-in alerts, unusual-activity checks); to support you when you ask; to tell you about changes to the service. The lawful basis is the contract between us, and our legitimate interest in keeping the service secure and improving it.

How long. For as long as you hold an account, and for thirty days after it ends so you can export your data, then deleted - except invoices and payment records, which we keep for six years as tax law requires, and backups, which expire within ninety days.

When someone buys from your shop, joins as a member, donates, applies for a job, books a place, sends an enquiry through one of your site's forms, or joins a mailing list, their details are stored on your install. We do not use that data for anything of our own: we do not sell it, build profiles from it, or contact those people except to deliver what you asked (an order confirmation, a campaign you sent, a booking reminder).

What we do with it, on your behalf:

• Store it in the database and file storage of your install, with nightly backups.
• Record enquiries submitted through your site's forms, together with any advertising click identifier or campaign tags the visitor arrived with (see section 3), so that you can see which advertisement produced an enquiry. Enquiries stay in your admin until you delete them.
• Send it to systems you connect, on your instruction. Where the proposal or order agreed with you includes it, we connect your install to systems you operate - for example a CRM such as Zoho, accounting software such as QuickBooks Online, or your own Google Ads account - send each one the data it needs, and read back what it returns: an enquiry can be created as a lead or quote in your CRM and its status read back, and the outcome of an enquiry can be reported to your Google Ads account as a conversion. What each connection reads and writes is set out in that proposal or order. Anything we extract from a connected system is kept for the duration of the engagement, then deleted or returned to you, unless you agree otherwise or the law requires us to keep it.
• Send email you initiate - transactional messages and the campaigns you write - through our email delivery provider, and record whether each one was delivered, opened or bounced, so you can see that in your admin.
• Take payment through our payment provider when someone pays on your site; card details go to the provider directly and never touch the platform.
• Answer subject access requests with you: the People tool lets you produce everything your install holds about one person, and delete it, so you can respond within the time the law gives you.
• Delete it when you delete it (records go to your admin's Trash first, then are removed) and when your account ends.

Your Instagram account. If you connect an Instagram Business or Creator account to your site, you sign in on Instagram itself and choose what to allow; your Instagram password never reaches us. Through Meta's Instagram API we then read the account's ID, username and profile picture and the posts it publishes (their pictures and videos, captions, links and dates), and - only for the features you switch on - its post and account insights, the comments on its posts, and the direct messages people send it. We use this only to do what you asked: show your posts on your site, report how they perform in your admin, let you answer comments and messages there, and publish posts you create in the admin. We keep Instagram's access key encrypted on the platform, a copy of your latest posts and their pictures on your own site (Instagram's own picture links stop working after a few days), and the insights, comments and messages your admin shows, for as long as the account is connected. We never sell this data, use it for advertising, or combine it with anything outside your install. It is deleted when you press Disconnect in your admin, when you remove "codanomiq" from your Instagram account (Settings > Website permissions > Apps and websites) - Meta then tells us and every site holding that account forgets it - or when you ask Meta, or us, to delete it; we delete it at once and confirm a request made through Meta with a reference you can check.

You are responsible for telling the people your site knows how you use their data, and for having a lawful basis for each thing you do with it - in particular for the emails you send them.

Sites we host count their page views without cookies and without keeping anyone's address: each visit is counted from the page itself, and what we keep is a daily total per page and an estimate of visitors that cannot be traced back to a person. Where you turn on journey tracking, it runs on the server and is switched on only for visitors who have consented through the site's cookie banner.

Advertising click identifiers. When a visitor arrives from a Google advertisement, the link carries a click identifier (Google's gclid), and a campaign link may carry campaign tags (utm_source, utm_medium, utm_campaign, utm_term and utm_content). The page keeps them in a first-party cookie on your site (cdnmxAttr) for ninety days from the visitor's last visit, and adds them to any form the visitor then submits, so that the enquiry can be traced to the advertisement that produced it. This respects your site's consent settings: while the cookie banner is on - as it is by default - the identifiers are recorded only for visitors who have allowed marketing cookies, and not at all if your banner does not offer the marketing category. If you turn the banner off, no visitor is asked, the identifiers are recorded for everyone, and you are responsible for having a lawful basis for that.

Links in emails. Links in emails you send from the platform's Mailer work the same way: a link to a page of your site carries tags naming the campaign (utm_source, utm_medium, utm_campaign and utm_id), so an enquiry can be credited to the email that produced it. Without marketing consent no cookie is written: the campaign's number alone - the same for everyone the email went to - is passed between the site's own pages for up to thirty days.

Our servers keep standard access logs (IP address, the page requested, the browser type, the time) for thirty days, for security and to diagnose faults. They are not used for analytics.

The Instagram feed. The Instagram feed on a hosted site shows pictures stored on that site, so a visitor's browser does not contact Instagram to see them, and Meta sets no cookies through it. Only a visitor who follows a link to Instagram reaches Instagram.

Payment pages, embedded videos and maps, and other third-party content on a site may set their own cookies once a visitor has consented; the site's cookie banner tool lets you gate those, and says which ones a site uses.

We use these sub-processors to provide the service. Each is bound by contract to protect the data and to process it only for the purpose stated.

AI features in your admin. The assistant and writing-help features stay off until your admin chooses a provider - Anthropic, OpenAI, Google (Gemini), Groq or xAI, each based in the United States, or Ollama running on a server you choose - and enters your own organisation's key for it. That provider is your choice and your supplier, working under your agreement with it: it is not our sub-processor, and we neither maintain nor train its models. Whether it may use what it receives to train them is decided by its terms and your settings with it, so check those before you turn the features on. It receives data only when the features are used: the question asked and the page it was asked on, the page or template being edited, or - where you let the assistant act for you - the records and reports it is asked to read, which can include personal data.

Contractors. Access to your data is limited to Circus Consulting's own staff: we do not use contractors who can access it. If that changes we will list them here and give you notice as described below.

Systems you connect. Systems you operate and connect to your install - your CRM, your accounting software, your Google Ads account, your Instagram account (Meta), the AI provider your admin chooses and the like - are not our sub-processors. We send data to them on your instruction, and your own agreement with their provider governs what they do with it.

We share data with nobody else, except where the law requires it (a court order, a tax authority) or to a successor of our business, who would take over these obligations. We will give you at least thirty days' notice before a new sub-processor handles your data, and you may object, as set out in your terms (7.7).

The platform runs in the United Kingdom and the European Economic Area. Where a sub-processor above moves data outside them, it does so under the UK's adequacy regulations or standard contractual clauses.

Every connection is encrypted in transit. Passwords are stored hashed; passkeys never leave your device. Access to production systems is limited to the people who run them, is logged, and needs more than a password. Each customer's install is separated from every other. Backups are encrypted and kept for ninety days.

If we become aware of a personal data breach that affects data we process for you, we will tell you without undue delay, with what we know and what we are doing about it, so that you can meet your own obligations to the people affected.

If we hold personal data about you as an account holder, you may ask us for a copy of it, ask us to correct it, ask us to delete it (which will end your account), object to a use of it, or ask for it in a portable form - most of which you can do yourself from your profile and the export tool in your admin. You may complain to the Information Commissioner's Office (ico.org.uk) if you think we have handled your data wrongly, though we would rather hear from you first.

If you are one of the people a hosted site knows, please contact the organisation that runs that site: they are the controller, and their admin has the tools to answer you. If you cannot reach them, contact us and we will help.

The admin uses a session cookie to keep you signed in, a cookie that remembers your sign-in on this device if you ask it to, and a small number of preference cookies (your theme, how many rows a report shows). None of them track you anywhere else, and none are used for advertising.

We will update this notice when what we do changes; the version and date at the top say which one applies, and a material change is announced in your admin. Questions go to the support address shown in your admin, or through the tickets tool there.