Privacy Policy

Last updated: 23 September 2026

This page explains what information Squashspace collects when you use this website or our migration service, what we do with it, and what we do not do with it. We have written it in plain English. The legal frame is the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

1. Who we are

Squashspace is operated by Jade Browser Limited, a company registered in England and Wales. Registered office: Central Court, 25 Southampton Buildings, Holborn, London, WC2A 1AL. Jade Browser Limited is the controller of the personal data described on this page.

You can reach us about anything on this page at contact@squashspace.co.uk.

2. What this policy covers

Four things, each with its own section below:

• this website, squashspace.co.uk, including the contact form and the designer application form;
• the sign-in and dashboard, which are for our own staff;
• our research into small-business websites that might benefit from a migration, which we call prospecting;
• the migration work itself, when you become a client.

3. This website

What we collect. When you use the contact form we receive the email address and message you type. When you use the designer application form we receive the name, email address, background and regions you enter. Both forms are sent to our own server at api.squashspace.co.uk, stored there, and forwarded to us by email so that we can reply.

Like every website, ours records the technical details of each request: your IP address, browser type and the pages you asked for. These logs are kept by our hosting provider, Cloudflare, and by our own server for the API calls the forms make.

Anonymous usage events. Our own first-party script records which pages are viewed, which links on them are clicked and whether a form was sent. It sets nothing on your device: no cookie, no local storage, no fingerprint. Our server never stores your IP address; it derives a per-day anonymous visitor hash that cannot link you across days, keeps only the domain of the page that referred you, and discards the rest.

What we do not collect. The marketing pages run no third-party analytics, no advertising trackers and no social media pixels. We do not build a profile of you from your visit.

Why we process it. To answer your message and to consider your application, which is the step you asked us to take before entering into any agreement, and to keep the site secure and working, which is our legitimate interest.

4. Sign-in and the dashboard

The Sign in link leads to an internal dashboard used by Squashspace staff to run migrations and prospecting. It is not a customer account system. Signing in sets a session cookie that keeps you signed in and nothing else. If you are not a member of staff you will have no account and nothing about you is stored there.

5. Prospecting: businesses we research and contact

Squashspace finds small businesses whose websites are built on platforms such as Squarespace, Wix, Webflow, Shopify, GoDaddy or Weebly and who might save money and gain speed by migrating. To do this we collect, from public sources only:

• the business name, its website address and its publicly listed trading details;
• contact details the business itself publishes on its website or in business directories, such as a contact email address or phone number;
• technical facts about the website: which platform built it, how large and how fast it is, and how it is structured.

Where a published contact belongs to a named person, for example the owner of a sole-trader business, that is personal data and this section applies to it. We may use automated tools, including AI models, to read the public pages of a business website and summarise them. We do not send your contact-form messages or emails to those tools.

Why we process it. Our legitimate interest in offering our service to businesses that are likely to want it. We limit what we collect to what a business has chosen to publish, we contact a business about migration at most a few times, and we stop the moment we are asked to.

Emails we send. Our approach emails are business-to-business messages under PECR. Every one identifies us and tells you how to opt out. If you reply asking not to be contacted, or write to contact@squashspace.co.uk, we add your address to a suppression list and do not contact you again. We keep that list so that we honour your request.

Your right to object. You may object to this processing at any time, and we will stop. See section 11.

6. Migration engagements

When you become a client we take a copy of your existing website in order to rebuild it. Your site may contain personal data, for example customer testimonials, staff pages or enquiry records. For that data we act as your processor: we handle it only to carry out the migration you have asked for, under your instructions, and we delete our working copies within thirty days of handover unless we have agreed otherwise in writing. Your own privacy obligations to the people in your site are unchanged by the migration.

We also hold the business details needed to run the engagement: your name, email address, phone number and billing details. We keep those for as long as we need to provide the service and afterwards for as long as the law requires us to keep accounting records.

7. Cookies and local storage

The marketing pages set no cookies of our own, and the usage script described in section 3 stores nothing in your browser. The dashboard sets a session cookie when a member of staff signs in. Cloudflare, which hosts the site and protects it from abuse, may set strictly necessary cookies of its own to do so. None of these are used for advertising or tracking across sites.

8. Who we share data with

• Cloudflare hosts this website and the API and handles all traffic to them.
• Amazon Web Services runs our servers and sends our email, from its London region.
• Search and AI providers receive the queries and the public website content we use for prospecting. They do not receive your form messages or your correspondence with us.
• Our accountants, and any authority we are legally required to answer to.

We do not sell personal data and we do not share it with anyone for their own marketing.

9. International transfers

Our own systems run in the United Kingdom. Cloudflare and Amazon Web Services operate worldwide and may process data outside the UK; where they do, transfers are covered by the UK's adequacy regulations or by standard contractual clauses, and both providers publish their arrangements.

10. How long we keep data

• Contact-form and application messages: two years from the last correspondence.
• Prospect records: twelve months from the last contact, then deleted, except that a suppression request is kept indefinitely so that it keeps working.
• Working copies of a client's site: deleted within thirty days of handover.
• Client and billing records: the length of the engagement plus the period required for accounting records, currently six years.
• Server and hosting logs: thirty days.

11. Your rights

Under UK GDPR you have the right to ask us for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict how we use it, to receive it in a portable form, and to object to our processing, including to any direct marketing, which we will always stop. Write to contact@squashspace.co.uk. We answer within one month and there is no charge.

12. Complaints

If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

13. Changes to this policy

When we change this page we update the date at the top. A change that affects how we use your data will be explained here and, where we hold your email address, told to you directly.