Privacy & cookies

Who we are

Hectic Software Limited, trading as Forged Landscapes ("we"), is the data controller for personal data collected through this website and the Forged Landscapes app. Hectic Software Limited is registered in England and Wales, company number 17514067. Registered office: Unit 1c Sandown Road Industrial Estate, Watford WD24 7UB. Contact: hello@forgedlandscapes.co.uk.

What we collect, and why

Enquiry data — name, email, phone, postcode, project details, budget band, and chat transcripts from the project assessor. Lawful basis: legitimate interests (responding to an enquiry you initiated), then contract where a project proceeds.

Project brief data — photos and videos of your garden, dimensions, sketches and inspiration links you upload to the client portal, plus your portal account email. Lawful basis: steps taken at your request prior to entering a contract.

Postcode checks — postcodes entered into the radius checker are sent to postcodes.io (Open Government Licence data) to calculate distance. We don't store checker lookups unless you submit an enquiry.

The iPhone and iPad app

The app does not track you, has no adverts and uses no analytics. It does not ask for your location, camera, photos or contacts.

• Quote form — the name, email, phone (optional), postcode and project notes you type are sent to us over an encrypted connection and stored as an enquiry, exactly like the website form. We only send it when you tap the send button.
• Postcode check — the postcode you type is sent to postcodes.io to work out the distance from Watford.
• Sign in with Apple — optional. Your name, email (or Apple’s private relay address) and phone are kept on your device only, to fill in the quote form. We do not receive or store any Apple sign-in token.
• Messages — job messages are one-to-one between you and our team in the website portal. They are not visible to anyone else and there is no public feed.

Deleting your account and data

In the app, open Account and tap Delete account to remove everything the app has saved on your device. For a website portal account, open the portal and use Delete account: it removes your login, profile, project briefs, uploaded photos and sketches, and portal messages. You can also email hello@forgedlandscapes.co.uk and we will delete it for you within one month. Enquiry and quote records that we must keep for the periods below stay on file, no longer linked to a login, until you ask us to erase them and the law allows.

What we never do

We do not sell personal data, share it with marketing brokers, or use it to train anything. Garden photos are used solely to assess and deliver your project.

Where it lives

Enquiries and briefs are stored in our database and file storage (Supabase, hosted in the UK/EEA region), protected by row-level security so portal users can only ever access their own project data. Email notifications are delivered via Resend. Hosting is provided by Cloudflare.

How long we keep it

Enquiries that don't proceed: deleted or anonymised within 24 months. Project records for completed work: retained for 6 years to honour guarantees and meet legal obligations. Portal accounts: deleted on request at any time.

Your rights

Under UK GDPR you can request access, correction, deletion, restriction, or a portable copy of your data, and object to processing based on legitimate interests. Email hello@forgedlandscapes.co.uk — we respond within one month. If we get it wrong, you can complain to the ICO at ico.org.uk.

Cookies — the honest version

This site sets no marketing or tracking cookies. The only cookies/storage used:

• Portal session — keeps you signed in to the client portal (strictly necessary).
• Consent preference — remembers your choice on the cookie banner (strictly necessary).
• Anonymous analytics — Cloudflare Web Analytics, which counts page views without cookies, fingerprinting or cross-site tracking. No personal data is stored.

Because strictly-necessary cookies are exempt from consent under PECR, the banner exists to be straight with you and to record your analytics preference — not to nag.

Third-party services

• postcodes.io — postcode geocoding (no account data sent)
• Supabase — database, authentication and encrypted file storage
• Resend — transactional email delivery
• Cloudflare — website hosting
• WhatsApp (Meta) — if you choose to message us through the WhatsApp button, that chat is between you and WhatsApp under its own terms and privacy policy
• Groq — powers the project assessor's language model when enabled; transcripts are processed to generate replies and are not used for training under our configuration
• OpenStreetMap / CARTO — map tiles on the service-area pages (your browser requests tiles directly)
• Site photographs — files we host ourselves. They are illustrative concepts until a completed project is published on the work page.