Privacy Policy.

Last updated · 2 October 2026

Pixel Heaven is a solo web design business operated by James Mangiacapra, based in Wallingford, Oxfordshire, United Kingdom. This policy explains what personal data is collected on pixelheaven.org, why it's collected, how it's stored and what your rights are under UK GDPR and the Data Protection Act 2018.

Short version: The only data collected is what you send via the contact form or email, plus anonymous analytics if you accept the cookie banner. Everything is stored in a personal inbox, used only to reply to you about a website, and never sold, shared or passed to advertisers. You can ask for deletion at any time by emailing james@pixelheaven.org.

1. Who the data controller is

James Mangiacapra, trading as Pixel Heaven. Contact: james@pixelheaven.org, WhatsApp 07551 648681.

2. What data is collected

Via the contact form

Your name
Business name (optional)
Email address
Phone number (optional)
Which pricing tier you're interested in
The free-text description of your business

Automatically collected by the hosting provider

Standard web server logs, IP address, user agent (browser), pages visited and timestamps. Retained for up to 30 days for security and diagnostics.

During a client engagement

Photos, logos, copy and other content you supply for your website build
Billing details handled directly by the payment processor (Stripe), card numbers are never seen or stored by Pixel Heaven

3. Why it's collected (lawful basis)

Contact form submissions: the lawful basis is legitimate interest (to reply to your enquiry) and, once a client relationship begins, contract (to provide the service you've asked for).

Server logs: legitimate interest for security and diagnostics.

4. Who processes it

Hostinger, our EU-based web host, also hosts the james@pixelheaven.org inbox and runs the mail service that delivers contact form submissions to it. Form submissions are kept in a secure log for up to 60 days so no enquiry is lost, then deleted.
Hostinger, the web hosting provider. Holds website files and server logs. See Hostinger's privacy policy.
Stripe, processes payments for clients who choose to pay by card. See Stripe's privacy policy.
Google Analytics 4, only if you accept the cookie banner. Aggregates anonymous visit data with IP anonymisation. See Google's privacy policy and section 5 below.
Microsoft Clarity, only if you accept the cookie banner. Produces aggregate heatmaps and session recordings of how visitors interact with the site (where they click, scroll, hover). Form inputs and sensitive fields are automatically masked, so anything you type into the contact form is never recorded. See Microsoft's privacy statement and section 5 below.

5. Cookies and analytics

Strictly necessary cookies

None. The site does not set cookies required for basic functionality.

Analytics and advertising cookies, opt-in only

On your first visit, a cookie banner appears asking whether you want to allow analytics and advertising cookies. No such cookies are set unless you click Accept. If you decline, or simply ignore the banner, nothing is stored on your device.

The Google tag is present on every page but runs in Google Consent Mode v2 with every storage type set to denied by default. In that state it sets no cookies and stores nothing on your device; it sends only an anonymous, cookieless signal that a page was viewed, which Google uses to estimate totals. Accepting upgrades this to full measurement.

If you accept, the following are loaded:

Google Analytics 4 measures aggregate traffic, how many visits, which pages, which countries, how long people stay. The setup uses privacy-protective defaults:

anonymize_ip, your IP address is truncated before it reaches Google's servers, so your exact location is never stored
SameSite=Strict;Secure, cookies can't be read from other sites and only travel over HTTPS

Google Ads conversion measurement. Pixel Heaven sometimes advertises on Google Search. If you arrive from one of those ads, the ad click carries an identifier (a gclid) which is stored in your browser so that if you later send an enquiry, we can tell which advert and search term produced it. This is used to measure whether advertising is working and to stop paying for adverts that are not. It is stored for up to 90 days. We do not build advertising profiles about you and we do not sell or share this data with anyone other than Google as our advertising provider.

Microsoft Clarity records aggregate heatmaps and individual session recordings of mouse movement, scrolling and clicks. Used purely to find usability problems on the site (e.g. visitors getting confused or rage-clicking the wrong thing). Clarity automatically masks form inputs and sensitive content, so anything typed into the contact form is never captured. No content of fields, no email addresses, no names typed by visitors are recorded. Data is retained by Microsoft for up to 13 months. Nothing is shared with advertisers and Clarity does not link your visit to any other Microsoft service.

Your consent choice is stored in your browser's localStorage (key: ph_cookie_consent). You can change your choice at any time by clearing your browser's cookies and site data for pixelheaven.org, the banner will appear again on your next visit.

6. How long it's kept

Enquiries that don't become clients: deleted within 12 months of last contact, unless you ask for deletion sooner.
Client records and work files: kept for the duration of our working relationship plus 6 years afterwards, to comply with UK tax-record-keeping law (HMRC requires 6 years for self-employed records).
Server logs: up to 30 days.

7. Your rights under UK GDPR

You have the right to:

Request a copy of the personal data held about you
Request correction of anything inaccurate
Request deletion (the "right to be forgotten")
Withdraw consent for future communications at any time
Lodge a complaint with the UK Information Commissioner's Office (ico.org.uk)

To exercise any of these rights, email james@pixelheaven.org. Requests are acknowledged within 3 working days and completed within 30 days as required by UK GDPR.

8. Data transfers outside the UK / EEA

Stripe is US-based and may process some data in the United States under Standard Contractual Clauses. Hostinger is EU-based. Google (Analytics and Ads) and Microsoft (Clarity) may process data in the United States under the UK Extension to the EU-US Data Privacy Framework or Standard Contractual Clauses.

9. Security

The site runs over HTTPS (TLS 1.3). Inbox access is protected by a strong password and 2-factor authentication. Client files stored for ongoing projects are encrypted at rest on the hosting provider.

10. Changes to this policy

If this policy changes, the "last updated" date at the top will change and, for any change that materially affects how your data is used, an email notice will go to active clients. Previous versions are archived and available on request.

Contact for privacy queries: james@pixelheaven.org