Privacy policy

Who we are

yellowloaf is a trading name of Yellow Loaf Ltd, a company registered in England and Wales (company number 17424859). Our registered office is Unit A1, The Embankment Business Park, Heaton Mersey, Stockport, SK4 3GN, and our studio is at Beehive Lofts, Beehive Mill, Jersey Street, Manchester, M4 6JG.

For the personal information described here we are the data controller, except where we process information on a client's behalf — see When we manage your advertising. Questions about privacy go to hello@yellowloaf.com.

What we collect

When you get in touch. If you use the forms on our contact page, we receive your name, email address and message. If you use “Build your recipe”, we also receive your business name (if you give one) and your choices: what you need, project size, timing and rough budget. We also receive anything you send us by email or tell us on a call.

When you're a client. Contact details for the people we work with, project information, and billing details such as company name, address and payment records. To build or improve a website or app, we may need access to your existing systems, content and accounts.

When we run your ads. Access to your Google Ads and Meta (Facebook and Instagram) ad accounts, campaign and performance data, and any audiences or customer lists you choose to provide.

When you visit our website. Our hosting provider automatically records basic technical information to keep the site running and secure — such as your IP address, browser type, the pages requested and the time. We don't use this to identify you.

When you send us an enquiry. We record that an enquiry was sent and which form was used, so we can tell whether our own advertising brings in enquiries. This record is shared with Google Ads and never includes your name or message. Unless you've accepted advertising cookies, it's sent without cookies and without your email address — see Cookies and tracking.

How we use it, and why

UK data protection law requires a lawful reason for each use. Ours are:

• Replying to enquiries and preparing proposals — our legitimate interest in responding to people who contact us, or taking steps at your request before a contract.
• Delivering projects, support and advertising services — to perform our contract with you.
• Invoicing and keeping accounts — our legal obligations, including tax and company law.
• Measuring our own advertising — counting enquiries and page visits without cookies is our legitimate interest in knowing whether our marketing works. Advertising cookies, and using your visit to show you our ads later, are based on your consent, which you can withdraw at any time.
• Keeping our website and systems secure — our legitimate interest in protecting our business and visitors.
• Marketing — we don't send newsletters or marketing emails. If that ever changes, we'll only send them to people who have agreed, and you can unsubscribe any time.

When we manage your advertising

We manage Google Ads and Meta advertising on behalf of clients, including handling their ad spend. When we do this, you (our client) are the controller of the data in your ad accounts and we act as your processor, working only on your instructions.

• We access your accounts through Google and Meta's own permission tools — we never need your passwords.
• We use campaign data, budgets and results to plan, run, report on and improve your advertising.
• If you give us a customer list for targeting, we use it only for your campaigns, upload it through the platform's tools, and don't keep a copy longer than needed. You're responsible for having the right to use that list for advertising.
• Google and Meta process data under their own terms and privacy policies, which apply to your use of their platforms.
• When our work ends, we remove our access to your accounts and delete or return your data, unless we're legally required to keep it (for example, invoices).

Where we pay for ad spend and recharge it to you, we keep records of those costs and invoices as part of our accounts.

Who we share it with

We never sell personal information. We share it only with trusted providers who help us run the business:

• Vercel — hosts our website and handles form submissions.
• Resend — delivers messages from our contact forms to our inbox, using servers in the EU.
• Microsoft — our email provider (Microsoft 365).
• Google and Meta — when we manage advertising on your behalf.
• Google — to measure enquiries from our own Google Ads (without cookies unless you accept them) and, if you accept, to show our ads to people who have visited.
• Our accountants and professional advisers — where needed to run the business.

We may also share information if the law requires it, or to protect our rights, property or safety, or those of others.

Transfers outside the UK

Some of our providers are based in, or use servers in, the European Economic Area or the United States. Where information is transferred outside the UK, we rely on protections recognised by UK law — such as adequacy regulations, the UK International Data Transfer Agreement or Addendum, or the UK–US data bridge.

Cookies and tracking

Our website doesn't need cookies to work, and we don't use analytics tools or social media pixels. Our fonts are served from our own website, so loading a page doesn't send your details to a font provider.

Google Ads tag. We advertise yellowloaf on Google, so every page includes Google's tag for our Google Ads account. It uses Google's consent mode and starts with all advertising and analytics storage switched off. Until you choose “Accept” in our cookie banner — or if you choose “No thanks” — it sets no cookies and redacts ad-click identifiers. Google may still receive limited information without cookies, such as that a page was viewed or an enquiry was sent, along with standard technical details like your browser type and IP address, which it uses to estimate how well our ads work in aggregate.

If you choose “Accept”, Google's advertising cookies (such as _gcl_au) are used to link an enquiry to the ad you clicked, and your visit may be used to show you our ads again on Google. Google's tag may also send Google a hashed (scrambled, one-way encoded) copy of the email address you enter in our enquiry forms, which Google uses only to match your enquiry to an ad you saw or clicked while signed in to Google (“enhanced conversions”). This only happens if you accept.

• What it tells us: that someone who clicked one of our Google ads went on to send an enquiry. We never send Google your name or message, and your email address only in hashed form and only if you accept.
• How long it lasts: Google's conversion cookies usually expire after about 90 days.
• Google's role: Google uses this information under its own privacy policy. You can read how Google uses information from sites that use its services and manage ad personalisation at My Ad Center.
• Your choice: we remember whether you said yes or no in your browser's storage (not a cookie) for 12 months, then ask again. You can change your mind at any time using “Cookie settings” at the bottom of any page — if you withdraw consent, we remove the advertising cookies. You can also clear or block cookies in your browser.

If we add any other cookies or tracking in future, we'll update this policy and ask for your consent where the law requires.

How long we keep it

• Enquiries that don't lead to work — up to 2 years, so we have context if you get back in touch.
• Client records and invoices — for the length of our work together, then 6 years after the end of the financial year they relate to, as required for tax and company records.
• Ad account access and customer lists — only while we're working for you.
• Website server logs — kept for a short period by our hosting provider.
• Advertising cookies — only if you accept them, usually for about 90 days.

Keeping it safe

We use reputable providers, encrypted connections (HTTPS), secure logins with two-step verification where available, and give access only to the people who need it. No system is perfectly secure, but if a breach ever affected your information, we would act quickly and tell you and the regulator where the law requires.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal information we hold about you
• correct anything that's wrong or incomplete
• delete your information
• restrict or object to how we use it
• send it to you or another organisation in a portable format

Some rights depend on the reason we're using the information. Email hello@yellowloaf.com and we'll respond within one month. It's free, though we may need to confirm your identity first. If your request is about data we hold for one of our clients, we'll pass it to them and help them respond.

Complaints

If you're unhappy with how we've handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this policy

We'll update this page if the way we handle information changes, and change the date at the top. Our services are for businesses and adults; we don't knowingly collect information from children.