Legal
Privacy Policy
This policy explains what personal information we collect when you use rightclickforbidden.com, why we collect it, how long we keep it, and what rights you have over it.
Last updated:
1. Who we are
Right Click Forbidden ("we", "us", "our") is a remote web and AI product studio operating from the United States. We operate the website at rightclickforbidden.com (the "Site").
For the purposes of the UK and EU General Data Protection Regulation, Right Click Forbidden is the data controller for personal information collected through this Site. You can reach us at [email protected] for any privacy matter.
2. Information we collect
2.1 Information you give us
When you submit our contact form, we collect the information you choose to enter: your name, email address, and message, plus optionally your company name, project type, budget range, and timeline. You control what you put in these fields; please do not include sensitive personal information in your message.
If you email us directly, we receive whatever information is contained in that email and its metadata.
2.2 Information collected automatically
Like nearly all websites, our servers and our infrastructure providers automatically record certain technical information when you visit:
- IP address (used for security, abuse prevention, and rate limiting)
- Browser type, version, and operating system
- Pages requested, referring URL, and timestamps
- Approximate geographic region, derived from IP address
This information is generated in ordinary server logs and by our content delivery network. It is used to keep the Site available and secure, and to understand aggregate traffic patterns. We do not use it to build individual profiles.
2.3 What we do not collect
- We do not run advertising networks or advertising trackers on this Site.
- We do not sell or rent personal information to anyone, for any purpose.
- We do not knowingly collect information from children under 13.
- We do not use third-party cross-site behavioural tracking pixels.
3. Why we use your information
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Responding to your enquiry | Name, email, company, message, project details | Legitimate interests; steps prior to entering a contract |
| Preventing spam and abuse | IP address, submission timing | Legitimate interests |
| Keeping the Site secure and available | Server and CDN logs | Legitimate interests |
| Understanding aggregate traffic | Aggregated, non-identifying analytics | Legitimate interests |
| Meeting legal obligations | Records we are required to retain | Legal obligation |
4. Service providers
We use a small number of third-party providers to operate the Site. Each processes data only as needed to provide their service to us:
| Provider | Role | Data involved |
|---|---|---|
| Cloudflare, Inc. | DNS, CDN, TLS, security | IP address, request metadata |
| Railway Corp. | Application hosting | Server logs, form submissions in transit |
| Resend (Plus Five Five, Inc.) | Transactional email delivery | Contact form contents |
| Google LLC | Email inbox (Gmail) receiving enquiries | Contact form contents |
| GitHub, Inc. | Source code hosting | No visitor personal data |
We may also disclose information where required by law, to enforce our terms, or to protect the rights, property, or safety of Right Click Forbidden, our clients, or the public.
5. International transfers
We operate from the United States and our providers process data in the United States and other countries. If you are in the European Economic Area, the United Kingdom, or Switzerland, your information will be transferred outside your jurisdiction. Where required, our providers rely on Standard Contractual Clauses or an equivalent lawful transfer mechanism.
6. How long we keep information
- Contact enquiries: retained for up to 24 months from last correspondence, then deleted, unless they become part of a client relationship.
- Client project records: retained for the duration of the engagement plus 7 years, for contractual, tax, and legal purposes.
- Server and CDN logs: typically retained for 30 days or less by our providers.
7. Your rights
Depending on where you live, you may have some or all of the following rights:
- Access — request a copy of the personal information we hold about you.
- Correction — ask us to fix information that is inaccurate or incomplete.
- Deletion — ask us to erase your personal information.
- Restriction and objection — ask us to limit or stop certain processing.
- Portability — receive your data in a structured, machine-readable format.
- Withdraw consent — where we rely on consent, withdraw it at any time.
7.1 California residents (CCPA / CPRA)
California residents have the right to know what personal information is collected, used, and disclosed; to request deletion; to correct inaccurate information; and to opt out of the sale or sharing of personal information. We do not sell or share personal information as those terms are defined under the CCPA/CPRA, and we do not use personal information for cross-context behavioural advertising. We will not discriminate against you for exercising any of these rights.
7.2 How to exercise a right
Email [email protected] with your request. We will respond within 30 days (or 45 days for CCPA requests, where permitted). We may need to verify your identity before acting on a request. If you are in the EEA or UK and believe we have handled your data improperly, you also have the right to complain to your local supervisory authority.
8. Security
All traffic to this Site is encrypted with TLS. Form submissions are transmitted over HTTPS and delivered to a mailbox protected by multi-factor authentication. We apply rate limiting and automated abuse detection to our form endpoints, and we limit access to enquiry data to the people who need it to respond to you.
No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a breach affecting your personal information, we will notify you and any relevant regulator as required by law.
9. Cookies
This Site uses only strictly necessary cookies and does not use advertising or cross-site tracking cookies. Full details are in our Cookie Policy.
10. Third-party links
Our portfolio links to websites we have built for clients and to external services. Once you follow a link away from this Site, this policy no longer applies and we are not responsible for the privacy practices of that site.
11. Children
This Site is not directed at children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us with personal information, contact us and we will delete it.
12. Changes to this policy
We may update this policy to reflect changes in our practices or the law. The "last updated" date at the top of this page always reflects the current version. Material changes will be highlighted on this page.
13. Contact
Questions, requests, or complaints about privacy should go to [email protected]. We read and respond to all of them ourselves.