Privacy

Last updated 6 August 2026

Draft. Leah needs to confirm this notice before go-live.

Who is responsible

Leah-Marie Bakes, 67 High Street, Laleston, Bridgend, CF32 0HL, is the data controller for anything you send through this site. You can reach me at hello@leahmariebakes.co.uk.

What the enquiry forms collect

There are three enquiry forms on this site: the contact form, the cake enquiry form and the wholesale menu request. When you submit one of them, the following is recorded:

• your name
• your email address
• your phone number, if you give one
• your message, together with the other details that form asks for, such as the occasion, date, rough servings, flavours or your business name
• your IP address and browser user agent string, recorded only so that spam and abuse can be spotted and blocked
• the date and time you sent it

There is nothing else. The site has no analytics, no advertising trackers and no newsletter sign up, and it does not take payment.

Why

Your name, contact details and message are used to reply to you and to fulfil your order, which is the performance of a contract or, before an order exists, my legitimate interest in answering an enquiry. Your IP address and user agent are kept under my legitimate interest in keeping the forms free of spam and abuse.

Where it is stored

Enquiries are stored in a Cloudflare D1 database, which is the SQL database that runs alongside this site on Cloudflare's network. Access is limited to me.

Who else sees it

• Cloudflare hosts this site, stores the enquiry database, and runs the Turnstile anti-spam check that appears above the submit button. Turnstile sees your IP address and some technical signals from your browser in order to tell people from bots.
• Resend sends the two emails that follow a submission: an acknowledgement to you and a notification to me. Your name, email address and enquiry details pass through Resend to do that.

Nothing is sold, and nothing is shared with anyone else unless the law requires it.

How long it is kept

Enquiries are kept while I need them to deal with your order and for a reasonable period afterwards in case you come back, and no longer than three years. The IP address and user agent recorded for spam prevention are kept with the enquiry and removed at the same time. Rate limiting counters, which are keyed on IP address, are discarded automatically after one hour.

Cookies

I do not set analytics or advertising cookies. Cloudflare Turnstile may store a token in your browser so that it does not have to challenge you repeatedly. That is the only browser storage involved.

Your rights

You can ask to see the information I hold about you, to have it corrected, or to have it deleted. You can also object to my processing it, or ask for it in a portable form.

How to have your details deleted

Email hello@leahmariebakes.co.uk with the subject line "delete my details", from the address you used to contact me, or tell me through the contact form. I will delete your enquiry and everything stored with it, and confirm once it is done, within one month. If an order is still in progress I may need to keep a record of the transaction itself for accounting purposes.

Complaints

If you are not happy with how I have handled your information, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.