This page explains what happens to your information when you use theburrito.dev. It is short because the site does very little with your data, and we would rather say that plainly than bury it.

Who we are

BURRITO DEVELOPMENT LTD is the data controller for this site. We are registered in Scotland, company number SC633925, at 17 Prospect Bank Place, Edinburgh, EH6 7PT.

For anything on this page — including a request to see or delete your data — email hello@theburrito.dev.

What we collect, and when

When you fill in the contact form. We collect your name, your email address, your company name if you give one, and whatever you write in the message. We ask for these because we cannot reply to an enquiry without them.

When you load a page. Our web server records the request: your IP address, the page you asked for, the time, your browser’s user-agent string, and the page that referred you. This is standard web server logging. We use it to keep the site running and to spot abuse.

If you accept analytics. We count visits with Matomo, which runs on our own server, so we know which pages are worth keeping. This needs a cookie, so we ask first — see “Cookies” below. Until you accept, nothing of Matomo’s is loaded at all. If you say no, no cookie is set and we do not count you. Nothing about the site works differently either way.

What we do with it

Enquiries from the contact form are stored in our own database and emailed to us so we can reply. We keep them so that if you come back to us in six months we still know what we discussed.

We also apply some basic anti-spam checks to submissions — a hidden field that real people never fill in, and a limit on how many submissions we accept from the same internet connection in a short window. That limit counts by IP address, not by the email address you type, so we briefly process the IP address a submission came from, purely to stop the form being used to send us junk. We hold it in memory for the length of that window and never store it alongside your enquiry.

Server logs are used for diagnosing faults and investigating abuse. Analytics are used to decide what to write more of. Nothing else.

We do not sell your data, share it with advertisers, or use it to build a profile of you. We do not use it to train machine learning models. We do not run advertising trackers, and no third party gets to watch you through our site.

Cookies

We use one kind of cookie, and only if you let us.

Analytics. Matomo, which runs on our own server, sets a cookie so it can tell one visit from the next rather than counting the same person five times. That cookie lasts 13 months. We ask before setting it, and until you accept, Matomo is not loaded and makes no request — the banner is not sitting over a tracker that has already started. If you decline, no cookie is set and no analytics data is collected: declining is a real choice, not a delayed yes, and there is no penalty for it. You can change your mind at any time from the “Cookie choices” link in the footer, which is one click either way, the same as accepting was.

That is the whole list. No advertising cookies, no third-party trackers, no pixels, no cross-site anything. The analytics run on hardware we control, so the data does not leave us.

Separately — and neither of these is a cookie — we keep two small things in your browser’s local storage: whether you switched the site between light and dark mode, and your answer to the analytics question above, so we do not ask again on every page. Neither leaves your device and neither reaches our server. Clearing your browser’s site data removes both, and the banner comes back.

Our lawful bases

Under UK GDPR we rely on three, depending on what is being processed:

Taking steps at your request before entering a contract — you asked us to get in touch about a piece of work, so we process your enquiry in order to reply to it.
Legitimate interests — keeping the site online, keeping the contact form from being abused, and holding a record of past conversations so we can pick one up again. We have weighed this against your interests and consider it proportionate given how little we hold.
Consent — for the analytics cookie, and only that. You give it by accepting, and you can withdraw it at any time from the footer link, which is as easy as giving it was.

Who else touches it

We run this site on our own hardware, which keeps the list of other people involved short.

Our hosting. The site and its database run on a server we control, in the United Kingdom. The database copy of what you send through the contact form is held there and nowhere else — but we are emailed a copy too, which is the next point.
Google. Our email runs on Google Workspace, which both sends our outbound mail and hosts the mailbox it arrives in. So when the contact form emails us about your enquiry, that message passes through Google’s servers on the way to us and stays in a Google-hosted mailbox afterwards — the same as it would if you had emailed us directly. Google may process that mail outside the UK. Where it does, the transfer runs under the UK International Data Transfer Addendum in Google’s data processing terms — the safeguard UK data protection law requires for it.

That is the entire list. Our analytics run on our own server rather than someone else’s, and the typefaces are served from our server rather than loaded from Google Fonts — so simply loading a page here does not announce your visit to anybody. Those were deliberate choices.

How long we keep it

Enquiries that do not become work: 24 months from your last contact with us, then deleted.
Enquiries from people who become clients: kept for the duration of our working relationship and for six years afterwards, which is how long we are required to keep business records.
Server logs: kept for 90 days, then rotated out.
Analytics: Matomo masks the last part of your IP address before it stores anything. The individual visit records are deleted after six months and only the aggregate counts are kept after that. The cookie itself lasts 13 months, and you can delete it from your browser whenever you like.

Your rights

Under UK data protection law you can ask us to show you what we hold about you, correct it if it is wrong, delete it, restrict what we do with it, hand it over in a portable format, or object to us processing it at all. Email hello@theburrito.dev and we will deal with it within one month, as the law requires.

If you think we have got this wrong, you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can fix it.

Changes to this page

If we change how the site handles data, we will change this page and update the date at the top. We will not quietly broaden what we do with information you have already given us.

Privacy