Privacy Policy
hepton.design is the personal portfolio of Russ Hepton, operated by Products for Humans Ltd. This page explains what personal data we collect when you use the site, why we collect it, and the rights you have over it. We’ve kept it short on purpose — the site is built to ask for as little as possible.
Products for Humans Ltd (“we”, “us”, “our”) is a private limited company registered in England and Wales, company number 08654264, VAT registered. We are the data controller for any personal data processed through hepton.design. Russ Hepton is the sole director and the person who will handle any privacy queries.
On your first visit we ask, through a banner at the bottom of the screen, whether you’re happy for us to use Google Analytics to measure basic traffic. If you accept, we collect anonymised data about which pages you viewed, the country and city your visit came from (resolved from your IP), the device and browser you used, and how you found the site. We do not record names, email addresses, or any directly identifying information through analytics, and we do not pass the data to advertising systems.
If you decline, no analytics cookies are set and no identifying information is sent. Google Analytics may still receive a minimal, cookieless ping so we know roughly how many people declined, but it cannot be linked back to you.
Whether you accept or decline, our host (Vercel) records standard server log entries: your IP address, the page or file requested, the time of the request, the referring page, and your browser’s user-agent string. These logs are used to keep the site running, diagnose errors, and protect against abuse. They are retained for a short, rolling window by Vercel and are not used for marketing.
If you email russ@hepton.design, we will hold your email address and the contents of your message for as long as needed to reply and to keep a sensible business record of the conversation. Email is hosted on Google Workspace for hepton.design.
If you book a call via the “Book a call” link, you’re taken to a Calendly page. Calendly will ask you for the details needed to schedule the meeting (name, email, time zone, any notes you add). Calendly processes that information as its own controller — please read their privacy notice. The booking confirmation is sent to us by email.
Some case studies include a “Submit a 1–2 minute team video” form for former colleagues to record a short clip about the project. If you choose to use it, we collect: your first and last name, your email address, the role you played on the project, the video file, and any profile photo you upload. The video and photo are stored privately on Vercel Blob until reviewed.
We use the email address to confirm receipt, to let you know whether the clip is going live, and to reach you if we need to make changes. Submissions are protected by Cloudflare Turnstile, an invisible bot check that processes minimal technical signals to confirm you’re a real person.
If your clip is approved, it appears alongside the team carousel on the relevant case study. If it’s rejected, the file and your details are deleted from our storage. You can ask us to take an approved clip down at any time by emailing russ@hepton.design.
The site only sets cookies if you choose “Accept” on the consent banner. In that case Google Analytics sets two first-party cookies, _ga and _ga_<container_id>, used to distinguish unique visitors and sessions. They expire after two years and are never used for advertising. If you decline, no cookies are set.
Your browser stores two small values in local storage: your light/dark theme preference, and a record of your consent choice so we don’t ask again on every visit. Local storage stays on your device and is never sent to us. You can clear it from your browser’s site-data settings at any time, or use the button below to reopen the banner and change your mind.
To run the site we use a small set of trusted suppliers, each of which may process limited personal data (such as your IP address) on our behalf:
- — Vercel — hosting, server logs, and file storage (Vercel Blob).
- — Google Analytics 4 — provided by Google Ireland Limited; processes your IP address, pages viewed, and device/browser data when you consent. Not linked to advertising.
- — Google Fonts — serves the Geist typeface. Loading a page transmits your IP to Google.
- — Calendly — only when you click “Book a call” and visit their site.
- — Cloudflare Turnstile — bot protection on the team-video form.
- — Resend — sends the transactional confirmation emails for team-video submissions.
- — Google Workspace — hosts the hepton.design mailbox.
External links elsewhere on the site (YouTube, LinkedIn, GitHub) only contact those services when you click them.
Server logs are retained briefly by Vercel for security and diagnostics. Emails and booking notes are kept for the lifetime of the working relationship and then for a further six years to meet our tax and contractual record-keeping obligations. Team-video submissions are kept while the case study is live; rejected submissions are deleted at the point of review.
We do not sell or rent personal data, ever. We share it only with the suppliers listed above (to provide the service), with our accountant where strictly necessary for bookkeeping, or where required by law.
Under the UK GDPR and the Data Protection Act 2018 you have the right to ask us to access, correct, delete, or restrict our use of your personal data, and the right to object to processing or to ask for a copy in a portable format. Email russ@hepton.design with your request and we’ll respond within 30 days.
If you’re not happy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put things right first.
If we change how the site processes personal data, we’ll update this page and bump the “Last updated” date at the top. Material changes will be flagged on the home page for a short period.
Products for Humans Ltd · Company number 08654264 · United Kingdom.
Privacy queries: russ@hepton.design.