Privacy Policy
Last updated 27 August 2026
The short version
- We collect what you type into our forms, and nothing else unless you accept analytics.
- We do not run a database of you. Submissions arrive as email; a CV is also filed privately so we can read it again.
- We do not sell your data, and we do not use it for advertising.
- The site sets no cookies at all until you make a choice in the banner.
- Email hello@whstd.com and we will delete everything we hold about you.
Who we are
WildHands is the data controller for the personal data described on this page. That means we decide what is collected and why, and we are responsible for looking after it.
For anything about this policy, or to exercise any of the rights below, email hello@whstd.com. A person reads that address.
What we collect
There are only four ways we end up with your personal data.
- You contact us. Your name, email address, your phone number if you give one, what you write about your project, and how you heard about us if you tell us.
- You apply to work with us. Your name and contact details, links to your professional profiles, your CV, and your answers to the application questions. Freelance applications also ask where you are resident for tax, what you are available for, and how many hours a month you want. Your CV is also stored as a private file so we can read it again during the process; everything else stays in the email.
- You subscribe to the freelance newsletter. Your email address.
- You accept analytics. Which pages you visited, roughly where in the world you are, and what browser you used. Analytics do not load unless you accept them.
We do not ask for anything sensitive, and we would rather you did not send it. Please do not put health information, financial details or identity documents into a form on this site.
Why we collect it, and our lawful basis
Under the UK GDPR we have to have a lawful basis for each thing we do with your data. Here is ours, in full.
| What we do | What that uses | Lawful basis | Why that one |
|---|---|---|---|
| Replying to an enquiry you send us | Name, email, phone, what you write | Legitimate interests | You contacted us about working together, and you expect a reply. |
| Assessing a job or freelance application | Name, contact details, profile links, CV, your answers | Steps prior to a contract | We cannot consider you for work without reading what you sent. |
| Keeping an application on file for future roles | The same application | Consent | Only if you tick the box. You can withdraw it at any time. |
| Sending the freelance newsletter | Email address | Consent | You asked for it, and you can tell us to stop at any time. |
| Understanding which pages are useful | Page views, browser and country | Consent | Analytics stay switched off unless you accept them. |
Where we rely on legitimate interests, we have weighed our interest in running the business against your privacy. Replying to an enquiry you chose to send us is not something we think you would object to. If you disagree, you can object. See your rights below.
How long we keep it
Form submissions arrive as email rather than going into a database, so deletion means removing the message and its attachments from our mailbox, and, for an application, deleting the stored copy of the CV. These are the periods we work to.
| What | How long |
|---|---|
| Enquiries sent through the contact form | 24 months from your last message to us |
| Applications for a role we advertised | 12 months from the decision |
| Applications you asked us to keep on file | 24 months, then we ask again or delete |
| CVs, stored as private files | Deleted with the application they arrived with |
| Newsletter subscriptions | Until you unsubscribe |
| Analytics | 12 months, then aggregated |
If a project starts, the enquiry stops being an enquiry and becomes part of the client record, which we keep for as long as the law requires us to keep business records. Ask us and we will tell you exactly what we still hold.
Who else touches it
Four companies process data on our behalf. Each is bound by a contract that limits them to acting on our instructions.
- Resend delivers every form submission to us by email, including any CV you attach. Without Resend, the form does not reach anyone.
- Cloudinary stores CVs sent with an application. They are kept as private files, not on a public address. Reaching one needs a signed link that we generate and that expires.
- PostHog processes analytics, and only if you accept them.
- Vercel hosts the site and serves every page. Its access logs record IP addresses for a short period as part of running the infrastructure.
Nobody else gets your data. We do not sell it, we do not trade it, and we do not hand it to advertisers. We would disclose it if a court or the law required us to, and we would tell you unless we were forbidden from doing so.
Where it goes
Our providers operate internationally, so your data may be processed outside the UK and the EEA, in practice in the United States. Where that happens it is covered by the UK International Data Transfer Addendum and the EU Standard Contractual Clauses, which are the safeguards the law provides for exactly this. You can ask us for a copy of the relevant terms.
Cookies, and what we store in your browser
This site sets no cookies. Nothing at all is stored in your browser until you choose Accept or Decline in the banner.
- Your choice. We save it in your browser's local storage so we do not ask again on every page. Nothing about it is sent to us.
- If you accept analytics, PostHog stores an identifier in local storage so that a returning visitor is not counted as a new person. It is switched off entirely if you decline, and it never loads before you decide.
Analytics here are deliberately narrow. We record page views. We do not record clicks, keystrokes, form contents, or session replays.
To change your mind, clear this site's data in your browser settings. The banner will appear again on your next visit and you can choose differently.
Keeping it safe
The site is served only over HTTPS. Form endpoints are rate-limited to make abuse expensive, which involves holding your IP address briefly in memory. It is never written to disk and never sent anywhere. Uploaded CVs are checked by file type and size and renamed on our side, so a filename can never be used to attack our systems. A stored CV is uploaded as a private file, not a public one, so it has no address anyone can guess. Reaching it needs a signed link that expires. Access to the mailbox holding enquiries is limited to the people who need it, and protected by two-factor authentication.
No system is perfect. If we ever suffer a breach that puts you at risk, we will tell the Information Commissioner's Office within 72 hours and tell you without undue delay.
Your rights
You can ask us to do any of the following, free of charge.
- See it. Get a copy of everything we hold about you.
- Fix it. Correct anything that is wrong or incomplete.
- Delete it. Have it erased where we have no overriding reason to keep it.
- Limit it. Have us pause using it while a dispute is sorted out.
- Object to it. Tell us to stop, where we are relying on legitimate interests.
- Move it. Get it in a portable format, or have us send it somewhere else.
- Withdraw consent. Where consent is the basis, you can take it back at any time. That does not undo anything we did lawfully beforehand.
Email hello@whstd.com. We will reply within one month. We may ask you to confirm who you are first, so that we do not hand your data to somebody else.
If you are unhappy
Please tell us first, because most things are quicker to fix directly. If we do not put it right, you have the right to complain to the UK's data protection regulator, the Information Commissioner's Office. Complaining to them does not affect your right to a legal remedy.
If you are in the EEA, you can also complain to the supervisory authority where you live or work.
Children
This site is aimed at businesses and at people looking for professional work. It is not intended for anyone under 16, and we do not knowingly collect their data. If you believe a child has sent us something, email us and we will delete it.
Changes to this policy
When we change how we handle data, we update this page and move the date at the top. If a change matters to you, such as a new processor or a new purpose, we will say so clearly here rather than burying it.
Contact
Email hello@whstd.com for anything on this page: questions, corrections, deletions, or complaints.