Builds By Luke

Legal

Privacy Policy

Effective July 31, 2026

The short version

I collect as little as possible. If you fill in the contact form or open the chat, I get what you typed so I can reply, and nothing else. No advertising technology, no tracking pixels, no cross-site tracking and no profiling are used on this site. I do not sell, rent or trade personal information to anyone, ever.

Who is responsible

This site is operated by Builds By Luke, based in Canada. For the purposes of Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the EU/UK General Data Protection Regulation (GDPR), Builds By Luke is the organisation accountable for the personal information described here, and is the "data controller".

The person accountable for this policy is the Privacy Contact at Builds By Luke. Questions, access requests and complaints all go to one place:

What is collected, and why

The contact form

When you submit the form on the contact page, I receive your name, email address, project type, budget range, timeline and the message you wrote. It is used for one purpose: to read your enquiry and reply to it. Providing this information is voluntary, but without an email address I have no way to answer you.

Submissions are delivered by a third-party form-delivery service, which processes the message and forwards it to my inbox on my behalf.

The chat widget

If you open the chat and send a message, I receive your email address (required so I can reply), your name if you choose to give it, the messages you send, and the page you were on when you started. Messages are held briefly by a cloud service and relayed to me through a secure messaging service so that I can answer promptly.

The chat also keeps a session identifier in your own browser's local storage, and whether the panel is open in session storage. That is what keeps your conversation attached to you between pages. It is not a cookie, it is never shared with anyone, and it stays on your device. See "How long it is kept" below.

Hosting, fonts, and technical logs

The site is served by a cloud hosting and edge-network provider, and typefaces are loaded from a third-party web-font provider. Because the fonts are requested when a page loads, that provider receives your IP address and browser user-agent as part of the request.

The hosting provider processes technical request data, including your IP address, user agent and the page requested, in order to deliver pages and to detect and block abuse. That is ordinary server-side infrastructure logging, retained by the provider under its own policies. It is not analytics, and it is not used to build any profile of you.

What is deliberately absent

  • No advertising networks, retargeting, or third-party marketing pixels.
  • No cross-site tracking, and no profiling or automated decision-making.
  • No mailing list, and no marketing email. I only reply to people who contact me first.
  • No account system, and no payment details are ever handled by this site.
  • As at the effective date above, no analytics or visitor-measurement tool is in use on this site. If that ever changes, this policy will be updated to describe it before it is switched on.

Legal basis for processing (GDPR)

Where the GDPR applies to you, the legal bases are:

  • Steps taken at your request prior to entering into a contract (Art. 6(1)(b)): replying to an enquiry about hiring me or about a product.
  • Legitimate interests (Art. 6(1)(f)): operating and securing the site, and responding to general correspondence. My interest is in running a functioning business; it is balanced against your interests by collecting the minimum, keeping it briefly, and never using it to market to you.

I do not rely on consent for any processing described here, so there is no consent for you to withdraw.

Who it is shared with

Personal information is disclosed only to the categories of service provider that make the site work, each acting on my behalf:

  • a form-delivery service, for contact-form submissions;
  • a cloud hosting and edge-network provider, which serves the site and runs the chat service;
  • a secure messaging service, which relays chat messages to me so I can reply;
  • a web-font provider, which serves typefaces and receives your IP and user-agent on page load.

Separately, if you purchase a paid plugin, that sale is made by Freemius, Inc. as authorised reseller and merchant of record. Freemius, not this site, collects and handles your payment and billing details, under its own privacy policy. It is named here because it is the party you actually contract with when you buy.

I do not sell, rent or trade personal information, and I do not disclose it to anyone else except where I am legally required to.

Where your information goes

I am based in Canada, and the service providers above operate internationally, so your information may be processed outside your own country, including in the United States. While it is held outside your jurisdiction it may be accessible to courts and authorities there under local law.

For transfers from the European Economic Area: the European Commission has decided that Canada provides an adequate level of protection for personal data handled by commercial organisations subject to PIPEDA, which is the basis on which information reaches me.

How long it is kept

  • Contact-form enquiries: kept in my email while a project is live and for a reasonable period afterwards for business and tax records, then deleted. If an enquiry leads nowhere, I delete it once the conversation is plainly over.
  • Chat transcripts: chat sessions are automatically deleted seven days after they go idle. Anything I have already answered by email is retained as ordinary correspondence.
  • Browser storage: the chat session identifier lives on your device, not on mine, so it is under your control. Clearing your browser's site data removes it immediately, and it also stops being usable once the session expires.

Your rights

Under PIPEDA you have the right to access the personal information I hold about you, to know how it has been used and who it has been disclosed to, and to challenge its accuracy and have it corrected. Under the GDPR (and, in substance, under other modern privacy laws including Quebec's Law 25 and the UK GDPR) you additionally have the right to erasure, to restrict or object to processing, and to receive your data in a portable form.

On deletion requests: I will delete what I hold about you on request, except where I need to keep it, for example to complete or support work in progress, to meet tax, accounting or other legal record-keeping obligations, or for the establishment, exercise or defence of legal claims. Where I cannot delete something, I will tell you what I am keeping and why. Information held on your own device, such as the chat session identifier described above, is not something I can reach. You remove that by clearing your browser data.

To exercise any of these rights, email the address above. I will confirm receipt and respond within 30 days, which is the PIPEDA time limit and comfortably inside the GDPR's one month. There is no charge. I may ask you to confirm your identity, but only enough to be sure I am not disclosing your information to somebody else.

If you believe information I hold is inaccurate, tell me what is wrong and I will correct it, or record your disagreement if we cannot agree.

Complaints

If you are unhappy with how I have handled your information, please raise it with me first. Most things are a misunderstanding I can fix quickly. If that does not resolve it, you have the right to complain to a privacy regulator: in Canada, the Office of the Privacy Commissioner of Canada; in the EEA or the UK, your national supervisory authority or the UK Information Commissioner's Office.

Cookies, tracking, and Do Not Track

This site sets no cookies of its own, and runs no advertising technology. The only browser storage used is the chat session described above, which is strictly necessary for the chat to function.

Because nothing here tracks you across websites or over time, there is no behavioural tracking for a Do Not Track signal to switch off. The site behaves identically whether or not your browser sends one. For the same reason, no third party collects personally identifiable information about your activity across different websites through this site.

A note about the WordPress plugins

The plugins published under Builds By Luke run on your WordPress site, on your own server. Any data they process (orders, form entries, logs) stays in your database and is never transmitted to me. Where a plugin contacts an outside service, that is disclosed in full in its readme on WordPress.org. This policy covers this website; it does not describe the plugins, and installing one sends me nothing.

A note about the monday.com apps

The monday.com apps published under Builds By Luke run on monday code — monday.com’s own infrastructure, inside monday’s security boundary. There is no external database, and no board data, item values or personal information is copied to any server of mine.

Each app reads the data it needs from the monday.com API, acts on it, and writes the result back within the same request. Where an app must remember something between runs — a schedule definition, a form’s editable-column list, a one-way fingerprint used to prevent duplicate automations — that record is written to monday’s own app storage, inside your account, and is removed when you uninstall the app.

Every app requests the narrowest set of OAuth permissions it can function with, and each app’s page on this site lists those permissions individually alongside the reason it needs each one. Uninstalling an app revokes them immediately.

One app deserves a specific note. Form to Edit generates links that let someone without a monday.com seat update a single item. Those links are cryptographically signed and carry the exact item and the exact list of columns they may write; altering any part of the link invalidates it, and columns outside that list are refused. Links can be given an expiry or made single-use, and every successful submission is recorded as an update on the item itself.

Security

The site is served over HTTPS, and the providers above are reputable services with their own security programmes. I keep what I collect to a minimum and delete it when it is no longer needed, which is the most effective safeguard available. No method of transmission or storage is perfectly secure, and I will not pretend otherwise. Please do not send anything highly sensitive through a web form or a chat box.

Children

This is a business site for business clients. It is not directed at children, and I do not knowingly collect personal information from anyone under 16. If you believe a child has sent me information, email me and I will delete it.

Changes to this policy

If this policy changes in any material way, the revised version will be posted on this page with a new effective date at the top, and the change will take effect when it is posted. The date above is the authoritative record of the current version. Material changes will never be applied retroactively to information already collected without telling you.

Contact

Privacy Contact, Builds By Luke, Canada