What we collect, and what we do with it.

This policy explains how RazzStack (“we”, “us”) handles personal data collected through this website, razzstack.com, through direct messages you send to our Instagram account @razzstack, and in the course of discussing or delivering work for clients.

RazzStack is currently operated by its two founders and is not yet incorporated as a registered legal entity. When incorporation completes, this policy will be updated to name the registered entity, its address, and the person responsible for data protection enquiries. Until then, the founders are jointly responsible for the decisions described here.

We collect a small amount of information, and no more than we need.

• Information you give us through the website. If you submit the enquiry form, we receive the name, email address, company name and team size you enter, together with the message you write. If you email us or speak to us, we keep what you send.
• Information you give us on Instagram. If you send a direct message to @razzstack, we receive your Instagram username, your Instagram-scoped user ID, the content of the message you send, and any contact details you choose to include in it (for example an email address or phone number).
• Basic technical information. Our hosting provider records standard server logs, including IP addresses and browser type, for security and to keep the site running. We do not use these to build a profile of you.

When you send a direct message to our Instagram account @razzstack, that message is handled by an automated assistant we operate, so that a genuine enquiry is never missed. This section explains exactly what that means for your data.

The assistant does one thing: it acknowledges your message, records it as an enquiry, and alerts a member of our team so that a person can reply to you. It is a customer-service tool for handling enquiries that come to us. It is never used to send unsolicited or marketing messages, it does not add you to any mailing list, and it plays no part in advertising.

You may receive an automated acknowledgement confirming we have your message. That first acknowledgement can be sent automatically; it is disclosed as automated and it never quotes a price, makes a promise, or commits us to anything. Any substantive reply — anything about how we could help, scope or cost — is written and sent by a person.

The information from your message is stored in our customer relationship management system (HubSpot) as a contact and an enquiry, and an internal notification is sent to our team's private channel. It is not published, and it is not shared with anyone other than the providers listed in section 6 who process it on our behalf.

We use what you send to reply to you, to prepare for a call you have requested, and to scope and deliver work if we go on to work together. That is the whole purpose.

Where a data protection law such as the EU or UK General Data Protection Regulation applies, our lawful basis is our legitimate interest in responding to enquiries about our services, and, once an engagement begins, the performance of a contract with you.

We do not sell personal data. We do not share it with advertisers. We do not add enquirers to a marketing list, and we do not send newsletters.

This website does not set advertising or tracking cookies, and does not use cookie-based analytics. Because of that, you will not see a cookie consent banner: there is nothing to consent to beyond what is strictly necessary to serve the pages.

If we later introduce analytics or any non-essential cookie, we will update this policy and, where the law requires it, ask for your consent before setting them.

We use a small number of service providers who process data on our instructions, as processors. At present these are:

• Meta Platforms, which operates Instagram and delivers your direct message to us through the Instagram API when you message @razzstack.
• HubSpot, our customer relationship management system, where an enquiry from the website or Instagram is recorded as a contact and a deal so that a person can follow it up.
• Railway, which hosts the automation service that receives an Instagram message, checks it is genuine, and routes it. Your message passes through this service and is processed there only briefly, in transit.
• Telegram, used to send our own team a private internal notification that an enquiry has arrived, so a person can respond.
• Netlify, which hosts the website, processes server logs, and stores website enquiries securely so that a person can follow them up.
• Resend, which delivers a notification to us by email when you submit the website enquiry form, so that we see your enquiry.

Our providers operate globally, which means your information may be processed on servers outside the country where you live, including in the United States. In particular, Meta, HubSpot, Railway, Telegram, Netlify and Resend may process data in the United States.

Where personal data protected by the EU or UK GDPR is transferred outside those areas, we rely on our providers' standard contractual clauses or an equivalent approved transfer mechanism.

Enquiries that do not lead to an engagement — whether they reach us through the website or through Instagram — are deleted within 24 months of your last contact with us.

The automated assistant keeps only a short-lived technical record needed to process your message and to avoid handling the same message twice; it does not build a separate long-term store of message content beyond the enquiry recorded in our CRM.

If we work together, project records are kept for the duration of the engagement and for as long afterwards as we are legally required to retain them, or as long as is necessary to defend a legal claim.

You can ask us to delete your information sooner, and we will unless we are required to keep it.

You can ask us what personal data we hold about you, ask us to correct it if it is wrong, ask us to delete it, ask us to restrict how we use it, or object to our using it. You can also ask for a copy in a portable format.

Write to us using the enquiry form, or email us at the address in section 10, and we will respond within 30 days. We will not charge you for a reasonable request.

If you are unhappy with how we have handled your data, you have the right to complain to the data protection authority in your country.

You can ask us to delete the personal data we hold about you, including anything we received from an Instagram message, at any time and free of charge. There are three ways to do it:

• Email us at razzstack@gmail.com with the words “data deletion”, telling us the Instagram handle or the email address you contacted us from so we can find your records.
• Or use the enquiry form on this site and write “data deletion” in the message.
• You can also remove our access from your own Instagram account at any time, under Settings → Website permissions / Apps and websites, which stops any further messages being shared with us.

When you ask us to delete your data, we remove your contact and enquiry records from our CRM and from our internal notifications, and we confirm this to you within 30 days. The only exception is where the law requires us to keep specific records for a set period, in which case we tell you what we must keep and why, and we delete it once that period ends.

The site is served over HTTPS. Access to enquiry data is limited to the two founders.

Where a project requires access to your systems, accounts are created in your name, scoped to the minimum needed to do the work, and revoked at handover. We never ask you for passwords, and we do not store your credentials.

During discovery we ask for anonymised examples wherever possible, so that we can understand your process without handling identifiable customer information.

No system is perfectly secure. If a breach affects your personal data and is likely to present a risk to you, we will tell you and the relevant authority without undue delay.

This site is intended for businesses. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us information, contact us and we will delete it.

We may update this policy as the business changes, particularly on incorporation and when our processors are finalised. The date at the top of this page shows when it was last revised.