Privacy

This is how I look after what you share with me through this site, and through afd.net, the site of AFD, my creative studio: what I collect, why, who helps me, how long I keep it, and what you can ask me to do with it.

The short version.

• I only collect what you choose to give me, plus what any website needs to run safely.
• I never sell your details, and I never hand them to anyone to market to you.
• The notes by email only come if you ask for them and confirm it, and one click stops them.
• Meta and LinkedIn only learn about your visit here if you allow Advertising in the cookie choices.
• You can ask me what I hold about you, or to delete it, whenever you like.
• All of this covers afd.net too. It sets no cookies, and its forms are handled here.

Who I am.

This site is mine, Alexio Ferrao, and I run it through my company, AFD Multimedia Limited. The company is responsible for your personal data here; in the law’s words, it is the controller.

AFD Multimedia Limited
Registered in England and Wales, company number 05055697
Registered office: 28 Belgravia Gardens, Bromley BR1 4TB
Email: alexio@afd.net

The same company runs afd.net, the site of AFD, my creative studio, and this policy covers it too. What you send through afd.net’s forms comes to this site, so each part below applies to it in the same way.

Anything about your data comes straight to me. A business this size does not need a data protection officer, so you deal with me directly.

What I collect, and why.

Each part of the site collects something different. Here is each one: what it takes, what I do with it, the legal reason I rely on, and how long I keep it.

When you start a conversation

The form on the Contact page asks for your name, your email, where you are with your idea, what you have in mind, the kind of help you are after, your timing and, if you like, your website. When you choose Next, what you have entered so far is saved, so I can reply even if you stop halfway. The form tells you this before you start. Until you send it, your browser also keeps your answers for that tab, so a reload does not lose them.

I use it to reply, to talk about your idea, and to keep track of our conversation. It is kept privately on this site, where only I can see it, and in Brevo’s CRM, the tool I use to keep track of conversations. An email with the details also comes to my inbox. If you reached the form from an advert, or from a link tagged with where it came from, I note that too, so I know which of my efforts work.

Legal basis: the steps you have asked me to take before we might work together, and my legitimate interest in answering people who get in touch.
How long: an enquiry you start and do not finish is removed after 90 days without activity. A finished enquiry is kept while we talk. If we go on to work together, it becomes part of the project record; if we do not, I delete it within two years of our last contact.

When you send a brief through afd.net

The Start a project form on afd.net asks for your name, what needs making, what it involves, when you need it, your website and your email. Nothing is saved while you answer, and nothing is kept in your browser: your answers stay in the page until you choose to send them, and if you leave first, they are gone. When you send, your brief is saved privately on this site, where only I can see it, marked as coming from afd.net. An email with the details comes to my inbox, and a copy goes into Brevo’s CRM, as with a conversation started here.

To keep out automated spam, the form notes how long it took to fill in, and this site counts sends from each connection for an hour, using a scrambled code in place of your IP address. The address itself is never stored. At the end of the form you can also ask for my notes by email; the box starts empty, and it works exactly as described under notes by email. If you choose WhatsApp instead of sending, the WhatsApp part applies.

Legal basis and how long: the same as a conversation started here.

When you use Ask AFD on afd.net

The Ask AFD box on afd.net answers typed questions with an AI model, Claude, made by Anthropic. Your question, and the earlier questions and answers in the same conversation, are sent from afd.net’s server to Anthropic, which writes the answer using only afd.net’s own pages. Anthropic processes the text to produce the answer under its commercial terms, which do not allow it to train its models on it, and may keep it for a limited time for safety and abuse monitoring. The listed questions are answered by me, in advance, and send nothing to Anthropic.

To learn what visitors need, afd.net keeps the questions typed into the box, which listed questions are chosen, whether an answer was marked useful, and any answers you give to the questions the box asks you, such as what you think of the site or the challenges your business faces. They are kept without your name, your IP address or any way to contact you, and email addresses and phone numbers are removed before anything is saved. Please leave out personal details; if you want me to know who you are, send a brief instead. I read them to improve the site and the studio’s work, and I may use an AI model, also Claude, to summarise them.

Under each answer you can choose Send to Alexio. Only if you do, the conversation you had in the box, with the first name and email address you give and anything you add, is sent to me as an enquiry, so I can reply. From then on it is handled like any other enquiry (see enquiries), including the copy kept in my CRM. Ticking the box to get my notes as well joins the mailing list only after you confirm by email (see email).

To keep the service fair, afd.net counts questions from each connection for an hour, using a scrambled code in place of your IP address, and counts the day’s total. The address itself is never stored, and counts more than a day old are cleared whenever the Ask box is used.

Legal basis and how long: legitimate interests, answering your questions and improving the site and the studio’s work. The questions and answers kept are deleted after twelve months, and the counts after a day.

When you send a voice note

The voice note page, and the voice note in the card that opens from the video in the corner, take your name, your email and the recording you choose to send. Nothing is recorded until you press record. When you send a note, I first email you a link, through Brevo, to a private page where you can listen back and press Yes. Nothing reaches me until you do, and that Yes is how you confirm the address is yours and that you are happy for me to listen and reply. The email carries a link, never the recording. If you do not confirm within 48 hours, the note and its recording are deleted. The recording is stored on this site’s server, outside its public part: until you confirm, you can play it through your link, and after that I am the only person who can. Once you confirm, I get an email saying a note has arrived, with your name and email but not the recording, and the same goes into my CRM.

Legal basis and how long: the same as a written enquiry. When an enquiry is deleted, its recording goes with it.

When you ask for the notes, or a guide, by email

You give me your email address, and your name where a form asks for it. An email then asks you to confirm, so nobody can sign you up but you. When you do, I record when and where you joined and that you agreed. A short welcome follows over the first week, then new notes when there is something worth saying. If you ask for a guide or another download, it works the same way: you confirm first, it arrives by email, and so do a few emails over the following weeks about putting it to use.

You can also join from afd.net, in the foot of its pages or at the end of its brief form. It is the same list, and it is mine: the notes come from me at alexioferrao.com, not from AFD, and afd.net says so where you sign up. When you join there, I record afd.net as where you joined.

These emails are sent by Brevo. Like most email services, it tells me whether an email was opened and which links were clicked, using a tiny image and links that pass through Brevo on the way. It helps me send fewer, better emails. If you would rather I did not know, set your email app not to load images.

Legal basis: your consent. Withdraw it with the unsubscribe link in every email, or by telling me.
How long: until you unsubscribe. After that, I keep your address on a do-not-email list, so you are never emailed by mistake. If you never confirm, nothing more is sent.

When you comment on a note

A comment asks for your name, your email and what you want to say. Your name and comment are published once I have read and approved them. Your email is never shown. WordPress, which runs the site, would normally keep your IP address with a comment; this site does not.

Legal basis: my legitimate interest in hosting a discussion under the notes, and keeping it free of spam.
How long: a published comment stays until you ask me to remove it. Comments I do not publish are deleted.

When you visit

Every visit to every website sends your IP address and some technical detail, such as your browser, your device and the page you asked for, to the servers that deliver it. It is needed to send you the page and to keep the site safe.

• The site is hosted by SiteGround, in London. Its servers keep short-lived logs of requests, for security and to fix faults.
• A firewall called Wordfence checks each request for attacks, keeps a short record of recent visits and blocked attempts, and checks addresses against a list of known threats run by its maker, Defiant, in the United States.
• Some pages show films I have made, which stream from Vimeo, in the United States. Nothing loads from Vimeo until you press play. When you do, its player loads with its do not track setting on, so Vimeo keeps no record of what you watched and sets none of its own tracking cookies. Cloudflare, which protects Vimeo’s player from bots, does set its own security cookies on vimeo.com, listed below, and like any site Vimeo sees your IP address and browser.
• The typefaces come from Adobe Fonts. Your browser fetches them from Adobe, which counts page views for its licensing. Adobe Fonts sets no cookies.
• afd.net is hosted by SiteGround too. It loads the same typefaces from Adobe Fonts, sets no cookies of its own and keeps nothing in your browser. Its films stream from Vimeo only when you press play, as described above. When you send its brief form or join the notes there, the request comes to this site and passes the same Wordfence checks. Ask AFD runs on afd.net’s own server, as described above.

Legal basis: my legitimate interest in running a site that works and is safe.
How long: these logs are kept briefly and cleared on a rolling basis.

When you message me on WhatsApp

Wherever the site offers WhatsApp, such as the WhatsApp me link in the card that opens from the video in the corner, or Use WhatsApp at the end of the brief form on afd.net, it opens WhatsApp, which Meta runs. If you message me there, WhatsApp carries it under its own privacy policy, and I see your name, your number and what you send. Nothing from WhatsApp loads on this site; the link simply takes you there.

Legal basis: my legitimate interest in replying to you.
How long: as long as the chat is useful to our conversation, and no longer than a written enquiry.

Adverts, if you allow them

I may advertise on Facebook, Instagram and LinkedIn. To see whether those adverts work, and to show my work again to people who have already visited, the site can use two small pieces of code: the Meta Pixel and the LinkedIn Insight Tag. afd.net carries neither.

They only load if you choose Advertising in the cookie choices. If you do, they tell Meta and LinkedIn that your browser visited, which pages it saw, and when you did something that matters to me, such as sending an enquiry or joining the notes. They can connect that to your Facebook, Instagram or LinkedIn account, if you have one. I never send them your name, your email or anything you type into a form, and I only ever see totals and trends, never who did what.

For the moment the data is collected and sent, Meta and LinkedIn share responsibility for it with me; the law calls us joint controllers. What they do with it afterwards is covered by their own policies: Meta’s privacy policy and LinkedIn’s privacy policy. Both let you control the adverts you see from your account settings.

If you answer one of my adverts through a form inside Facebook, Instagram or LinkedIn, they pass me what you entered, and I treat it like any other enquiry, or like a request for the notes or a guide.

Legal basis: your consent. Change your mind at any time under Cookie choices, at the foot of every page.

Who helps me.

A few companies help me run things, and so handle some of your data. I choose them with care, and each is bound to protect it.

• SiteGround hosts this site and its database, and afd.net, in London.
• Brevo (Sendinblue SAS, France) sends my emails and runs my CRM, with your data kept in the EU.
• Google runs the email inbox where enquiry notifications arrive.
• Defiant, the maker of Wordfence, checks visits for security threats.
• Adobe serves the fonts.
• Anthropic (Anthropic PBC, United States) provides the AI model that answers questions typed into Ask AFD on afd.net.
• Vimeo streams the films, only when you press play.
• Meta and LinkedIn, only if you allow Advertising, as above.

Beyond these, I would only share your data if the law required it, or to protect the site or someone’s safety.

When data leaves the UK.

Some of these companies are based in, or use servers in, the European Union or the United States. UK law recognises the EU as protecting data properly. Data only goes to the United States to companies signed up to the UK Extension to the EU-US Data Privacy Framework, or under contract terms approved for this by the UK’s Information Commissioner.

Your rights.

You can ask me, at any time and free of charge, to:

• tell you what I hold about you, and send you a copy;
• correct anything that is wrong;
• delete it;
• pause using it while something is put right;
• stop using it for something, including marketing, which always stops at once;
• give it to you, or to someone else, in a form a computer can read.

You can also withdraw any consent you have given, which does not undo what happened before. I make no decisions about you by automated means.

Email alexio@afd.net. I will reply within a month, and I may first need to check that you are you. If you are unhappy with how I have handled your data, tell me and I will do my best to put it right. You can also complain to the UK regulator, the Information Commissioner’s Office, at ico.org.uk or on 0303 123 1113.

Cookies.

Cookies are small files a site leaves in your browser, and the same rules cover other storage in your browser. This site uses as little as it can. These are always on, because the site needs them to do what you ask:

Name	What it does	How long
af_consent	Remembers your cookie choices	6 months
af-conversation-v1	Holds your enquiry answers in that tab until you send them	Until the tab closes
af-narration, af-mark-drawn	Remember the narration and that the logo has drawn itself, for this visit	Until the tab closes
af-music-off	Remembers that you turned the music off	Until you clear it
__cf_bm, cf_clearance, __cf_ob (Vimeo, through Cloudflare)	Set on vimeo.com only once you press play on a film, to tell people from bots	30 minutes to 1 year

These only arrive if you allow Advertising:

Name	What it does	How long
_fbp, _fbc (Meta)	Recognise your browser for Meta’s adverts and their measurement	Up to 3 months
li_fat_id, and on LinkedIn’s own site bcookie, lidc, UserMatchHistory and others (LinkedIn)	The same, for LinkedIn	Up to 1 year

afd.net sets no cookies of its own and uses no other storage in your browser, so there is nothing to choose there. Pressing play on one of its films brings Vimeo’s player, and with it the Cloudflare cookies listed above.

If I ever add a tool that measures how the site is used, it will only run if you allow it, and it will be listed here first. Change your mind whenever you like with Cookie choices, at the foot of every page. Saying no changes nothing about how the site works for you.

Children.

The site is not meant for children, and I do not knowingly collect anything from anyone under 13.

Keeping it safe.

The site only talks to you over an encrypted connection. Enquiries and recordings are stored where only I can reach them, and I hold the services I use to the same standard. No system is perfect, but if something ever went wrong in a way that put you at risk, I would tell you.

When this changes.

I update this page when something changes, along with the date at the top. If a change affects how I use your email address, I will tell you by email before it applies. The terms cover the rest of how the site works.