This page says what personal data acefina.com collects, which tools process it and what you can do about it. It changes whenever the site's tools change.
1. Who we are
Acefina ("we," "our," or "us") runs acefina.com and decides how the personal data described here is used. Write to hello@acefina.com for any privacy question or request.
2. What we collect, and why
The contact form
When you send a brief we receive the details you type: your name, email address, company, website, what you need help with and anything else you add. The form also sends the address of the page you sent it from, a hidden anti-spam field and how long the form was open, so we can discard automated submissions. We use this only to reply to you and to scope the work you ask about. Our lawful basis is taking steps at your request before a contract and our legitimate interest in answering enquiries. If you arrived from an ad or a tagged campaign link, your message also carries the ad click ID and campaign tags from that link, with the page you landed on and when, so we can see which ads bring enquiries.
The form does not save your message in a database. It is sent as an email through ZeptoMail, a transactional email service from Zoho, to our inbox. Email we send and receive follows the retention rule in section 6.
Spam protection
Pages with a contact form load Cloudflare Turnstile to confirm that a person is sending the form. Turnstile runs in your browser and Cloudflare receives technical signals from it, such as your IP address, to make that decision. Our server also sends Cloudflare the one-time result and your IP address to verify it. Our server also holds your IP address in memory, and nowhere else, to limit repeated submissions: it counts attempts over 15-minute windows and is cleared when the server restarts.
Site visits
We measure which pages are visited with three tools. Details and cookie names are on the cookie policy.
- Google Analytics 4 sets cookies and records page views, approximate location, device and how you arrive. When you send the contact form, it also records that a form was sent, with the type of project and budget band you chose, the page you sent it from and, if a service page or our fixed-price audit offer brought you there, which one. Nothing you type, such as your name, email address or message, is sent to it. In the EU, EEA, UK and Switzerland it loads only if you accept analytics cookies. Elsewhere it loads automatically and you can switch it off from "Cookie settings" in the footer.
- Ahrefs Web Analytics records page views and referrers. Ahrefs states that it sets no cookies and collects no personal data by default.
- Umami, which we host ourselves, records aggregate page views and referrers. It sets no cookies and stores no personal profile.
Hosting and delivery
The site is served through Cloudflare, which handles your IP address and request details to deliver pages and block attacks. Our own server keeps standard access logs for security and fault-finding.
Email, WhatsApp and calls
If you email hello@acefina.com or message us on WhatsApp, we keep the conversation as a business record so we can continue the work.
3. Who receives data
We do not sell personal information. We share it only with providers that run the site or send our email:
- Cloudflare, for delivery, security and Turnstile
- Zoho (ZeptoMail), to deliver contact-form email
- Google, for Google Analytics when it is switched on
- Ahrefs, for Web Analytics page views
- Hosting providers for our servers
- Our email-sending and email-verification providers, for business outreach (section 8)
We also disclose data where the law requires it or to protect our systems and users. Some of these providers process data outside the UK and the EEA. Where they do, they rely on mechanisms such as the EU-US Data Privacy Framework or standard contractual clauses.
4. Cookies and consent
The only optional cookies on acefina.com are the Google Analytics cookies and our own acefina_attr cookie, which remembers the ad or campaign link you arrived from. Visitors in the EU, EEA, UK and Switzerland, and visitors whose location we cannot determine, are asked before either is set. Rejecting costs you nothing and the site works the same. You can change your choice at any time from "Cookie settings" in the footer. Your choice is stored in your browser only.
5. Data security
The site is served over HTTPS and we apply appropriate technical and organizational safeguards to the data we hold. No online transmission method is completely secure, so we cannot guarantee absolute security.
6. Data retention
We retain personal data only for as long as needed for the purposes in this policy or to meet legal, accounting and contractual obligations. Contact and project records are typically retained for up to seven years. Analytics data is kept for the period set in each analytics tool. Business outreach data has its own, shorter rule in section 8.
7. Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Request deletion of personal data
- Object to or restrict certain processing
- Request data portability where applicable
- Withdraw consent for analytics cookies at any time
You can also complain to your data protection authority, such as the Information Commissioner's Office in the UK. See the GDPR page for how we handle EU and UK requests.
8. Business outreach
We sometimes email people at companies whose work fits our software services. If we emailed you, this section covers the details we hold about you.
What we hold and where it comes from
We hold your work contact details: your name, job title, work email address, company and country. We also note public signals about your company, such as whether it is hiring, has raised funding or builds with certain tools, and any check of your company's public website that we mention in the email. These details come from Apollo.io, a business contact database, and from your company's public website.
Why we use them
We use them to offer our software services to businesses whose work fits them, and we send three emails at most. Our lawful basis is legitimate interests (GDPR Article 6(1)(f)).
Your choices
You can object at any time: reply "no" to any of our emails and we stop emailing you and delete your details, apart from the minimum set out below. To see, correct or delete what we hold, write to hello@acefina.com. You can also complain to your data protection authority, which in the UK is the Information Commissioner's Office (ICO).
How long we keep them
If you don't reply, we delete your details 90 days after our last email. If you object, we keep only the minimum we need to make sure we never contact you again, and we keep that permanently.
Who sees them
Our email-sending and email-verification providers process your details so we can check the address and deliver the email.
9. Contact us
If you have questions about this policy or want to exercise a privacy-related right, contact us at hello@acefina.com.