Privacy Policy.

This page explains what personal data this website collects, why, who sees it, how long we keep it, and what your rights are. It describes the site as it is today and is updated when the site changes.

Who we are

Fabli Ltd, trading as Evenlit, is the data controller for personal data collected through this website. Fabli Ltd is registered in England and Wales, company number 17512092. Registered office: 61 Bridge Street, Kington, HR5 3DJ. You can reach us about anything on this page at hello@evenlit.co.uk.

What we collect

The only personal data this site collects is what comes through the contact form, plus a small amount of technical data around the submission. The site itself collects nothing from you just for browsing; our hosting provider’s request logs are covered below.

The contact form asks for:

• your name (required)
• your email address (required)
• business name (optional)
• phone number (optional)
• what you need — a free-text message (optional)
• budget range (optional)
• how you heard about us (optional)

Recorded alongside the enquiry when you send it:

• the page you sent it from (for example /contact)
• if you arrived on a link carrying a referral or campaign code (ref, utm_source, utm_medium or utm_campaign in the address), the first value of each seen during your visit. The referral code is shown to you in the “How did you hear about us?” box before you send, and whatever you leave in that box is what is stored.

Separately from the enquiry, to limit automated abuse of the form, we store a one-way, keyed hash of your IP address with a count of recent submissions. The address itself is never stored, the hash cannot be turned back into it without a secret only our server holds, and it is not linked to your enquiry.

The form also contains a hidden field that a person cannot see or fill in, and it notes how long the form was open before it was sent. These two checks tell automated submissions from real ones. A submission that fails either check is not stored anywhere; our server records only which check it failed and the timing, with none of the details that were entered.

How we collect it

Only when you fill in and send the contact form. Referral and campaign codes are read from the page address when you arrive and held in the page’s memory while you browse; they are never saved to your device and are gone when you close the tab or reload. Your IP address is taken from the request at the moment you submit, hashed immediately, and the original is discarded.

Why we use it, and the legal basis

• To reply to your enquiry and take the steps you ask for before any contract — your name, contact details, message and budget range. Legal basis: Article 6(1)(b) UK GDPR (steps at your request before entering a contract).
• To prevent spam and abuse of the form — the hidden-field and timing checks and the hashed-IP rate limit. Legal basis: Article 6(1)(f) UK GDPR (our legitimate interest in keeping the form usable and our records free of automated junk).
• To know where enquiries come from — the page you sent from and any referral or campaign code, so we can credit the right referrer and see which pages lead to enquiries. Legal basis: Article 6(1)(f) UK GDPR (our legitimate interest in understanding how people find us).

Who receives it

We use a small number of service providers to run this site and handle enquiries. Each processes your data only to provide its service to us.

• Supabase stores enquiries and the rate-limit hashes in a database in its London region (eu-west-2). The database cannot be reached from your browser; it is written by our own server and read by us.
• Vercel hosts the site; the code that handles your submission runs in its London region (lhr1). Vercel is a US company and keeps its standard request logs for the site.
• Resend sends us an email notification of each enquiry, from its Ireland region (eu-west-1). That email contains the details you entered, the page you sent from and any referral or campaign code. Resend is a US company.
• Namecheap provides email forwarding for hello@evenlit.co.uk, and Microsoft hosts the Outlook mailbox those notifications are delivered to and stored in.

We do not use analytics services, advertising networks or any other third party on this site. We do not sell your personal data, and we do not use it for marketing.

Transfers outside the UK

Some of these providers are US companies. Where personal data is transferred outside the UK, we rely on the safeguards that UK data protection law requires for such transfers.

How long we keep it

• Enquiries: 12 months from the day you send them, after which they are deleted automatically. If you become a client, your enquiry is kept with our client records and is not deleted automatically.
• Rate-limit hashes: deleted automatically no more than 24 hours after they are recorded.
• Notification emails: kept in our mailbox for up to 12 months, then deleted. An erasure request (see below) covers these too.
• Hosting logs: kept by Vercel under its own retention period.

Your rights

Under UK data protection law you can ask us for access to the personal data we hold about you, to correct it, to erase it, to restrict how we use it, to object to our use of it where we rely on legitimate interests, and to receive the data you gave us in a portable form. To use any of these rights, email hello@evenlit.co.uk. We will reply within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk/make-a-complaint. We would appreciate the chance to put things right first.

Cookies and storage on your device

This site sets no cookies and stores nothing in your browser’s local or session storage. It loads no analytics, no tracking, no third-party scripts and no embedded content, and its fonts are served from our own domain rather than a font service.

Automated decisions

We do not make decisions about you by automated means that have legal or similarly significant effects. The only automated step is the spam check described above, which decides whether a submission is stored.

Children

This site and our services are aimed at businesses, not at children, and we do not knowingly collect personal data from anyone under 18.

Changes to this policy

If we change how this site handles personal data, we will update this page and the date below.

Last updated: 10 October 2026