Privacy policy

This is written in plain English on purpose. If anything here is unclear, email us at hello@daydreamlabs.co.uk and we will explain it properly.

Who we are

DayDream Labs Ltd is a company registered in England and Wales under company number15967412, with its registered office at 20 Wenlock Road, London N1 7GU. We trade as DayDream Labs. We are the data controller for the personal information described on this page.

You can reach us at hello@daydreamlabs.co.uk or on 07795 664840.

What we collect

The project brief is the main place we collect information about you. As you work through it we store your answers about the project itself — what you want built, roughly when you need it, the budget band you are working to, and anything you type into the free-text boxes. At the last step we ask for your name, your email address, your company name if you have one, and your phone number if you choose to give it. With your brief we also keep a note of how you found us: the utm_source value from the link you arrived on, if there was one, and the address of the page that sent you to the brief, if your browser passes it on. We use it only to see which of our listings and adverts bring enquiries.

The brief saves your progress as you go, so answers you give at step two are stored before you reach the step where we ask who you are. If you leave without finishing, we hold the project answers and nothing that identifies you.

The contact form collects your name, email address, an optional company name, your message, and the utm_source value from the link you arrived on, if there was one. We also keep the emails and messages you send us in the ordinary course of talking about a project.

Why we are allowed to use it (lawful basis)

Legitimate interests. When you send a brief or an enquiry, we use your details to reply to you, to prepare a quote, and to run the project if you go ahead. You asked us a question about our services; answering it is the interest, and it is one you would reasonably expect.

Consent. If we send you marketing — occasional emails about what we build, rather than a reply to your own enquiry — that is because you ticked the marketing box. The box is never ticked for you, it is separate from the enquiry itself, and saying no to it makes no difference to the reply you get. You can withdraw that consent at any time by replying to any email from us or writing to the address above.

Contract and legal obligation. Once you become a client, we use your details to perform the contract between us, and we keep records where accounting and tax law requires it.

How long we keep it

Partial briefs — where somebody started the brief and left before giving us any contact details — are deleted after 90 days. There is nothing in them that identifies you, and they are of no use to us after that.

Briefs and enquiries that do include contact details are reviewed once a year. If there is no live project, no live conversation, and no legal reason to keep the record, we delete it. Records tied to work we actually carried out are kept for as long as accounting and tax rules require, and then deleted.

Who else handles it

We keep the list of companies that touch your data short and deliberate. Each of them acts on our instructions and none of them may use your data for their own purposes.

• Supabase — stores the brief and enquiry records in our database.
• Resend — sends the confirmation email containing your brief, and alerts us that it arrived.
• Plausible — measures site traffic. It sets no cookies and collects no personal data.
• Google — advertising and conversion measurement, loaded only if you accept advertising cookies.
• Meta — advertising and conversion measurement, loaded only if you accept advertising cookies.

Some of these providers process data outside the UK. Where that happens, the transfer is covered by the safeguards those providers put in place — standard contractual clauses or an adequacy decision — so the protection travels with your data.

Cookies and the choice you made

Our traffic measurement runs on every visit and needs no permission from you, because it sets no cookies and does not identify anybody.

Advertising tags from Google and Meta are different. They store an identifier on your device, so UK law says we must ask first and they stay switched off until you say yes. The banner offers accept and reject as equally weighted choices, nothing is pre-ticked, and rejecting leaves the whole site working exactly as it does otherwise.

You can change your mind at any time. The "Cookie settings" control at the bottom of every page reopens the banner and lets you switch your answer either way. We also ask again after 12 months, so a decision you made a long time ago is never treated as permanent.

Your rights

You can ask us for a copy of the personal data we hold about you, ask us to correct it if it is wrong, ask us to delete it, ask us to restrict what we do with it, ask for it in a portable format, or object to us using it at all. You can also withdraw consent for marketing whenever you like.

To make a request, email hello@daydreamlabs.co.uk and say what you want. We do not need a special form or particular wording. We will respond within one month, and we will not charge you for it.

If you are not happy with how we have handled your data, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk. We would rather you came to us first so we can put it right.

Changes to this policy

If we change how we handle your data, we will update this page and change the date at the top. This version replaces any earlier one.