Privacy

What we collect, and what we do with it

Short version: what you type into a form, so we can reply to it. No advertising trackers, no data sold, and you can have it deleted whenever you like.

Last reviewed 19 September 2026.

Who we are

Loomwork is a consultancy of one, run by Vanessa Carmin. If you have a question about anything on this page, or want to know what we hold about you, write to hello@loomwork.com and you will get a reply from the person who can actually answer it.

What we collect, and why

When you use the contact or booking form

Your name, work email, company and message — because we cannot reply otherwise. If you answer the optional questions, we also keep your role, phone number, team size, timeline, which services interested you and, on the booking page, your rough budget, what is driving the timing, and which systems you use. Those are optional in the real sense: the form sends without them.

If you pick a time, we keep the time you picked so we can confirm it.

When you subscribe to the writing

Your email address, and nothing else. You confirm by clicking a link, so nobody can sign you up, and every email carries a one-click unsubscribe.

Where you arrived from

The page you landed on, the site that linked you, and any campaign tags in the link — so we know which writing brings people here. It is recorded once, on your first visit, and is not tied to your name unless you later send us a form.

Keeping the forms usable

To stop automated submissions we count recent submissions per visitor. Your IP address is hashed with a secret before it is stored, so the stored value cannot be turned back into an address. We also use Cloudflare Turnstile, which is a privacy- preserving alternative to a CAPTCHA and sets no tracking cookie.

When something breaks

Errors are sent to Sentry so we find out before you tell us. Names, email addresses, message bodies and session cookies are stripped before the report leaves our server. Server logs record which request failed, not who made it.

Cookies

No advertising cookies, no third-party cookies, and nothing that follows you to other websites. There is no Google Analytics, no Meta pixel and no session replay on this site. Our traffic figures come from Vercel Analytics, which counts page views without cookies and without a cross-site identifier.

Three cookies are set, all first-party:

lw_ft — a signed timestamp recording when a form page was served, so a submission completed in under three seconds can be treated as automated. Twelve hours.
lw_src — where you first arrived from, as described above. Thirty days.
An Auth.js session cookie, only if you sign in to the admin. That is for staff; it is never set for a visitor.

All three are HttpOnly, which means no JavaScript on the page can read them — including ours.

Who else sees it

We do not sell your data, and we never will. It is handled by the services that run the site, each doing one job:

Vercel — hosting, and privacy-preserving traffic counts.
Neon — the database your enquiry is stored in.
Resend — sending our reply and the acknowledgement.
Sentry — error reports, with personal details removed first.
Cloudflare Turnstile — confirming a submission came from a person.
Penciled — our scheduling system, if you book a time. It receives your name, email and the slot, because that is what a booking is.

How long we keep it

Enquiries: 24 months after we last had contact with you. Replying, or us adding a note, starts that clock again.
Newsletter: until you unsubscribe. We keep a record that you unsubscribed, so we can prove we honoured it.
Admin activity records: 24 months. These log which staff member changed what; they do not contain your message or your address.
Anti-spam counters: seven days.

These are enforced by a job that runs every night and deletes what is out of period — not by somebody remembering to.

Your choices

Email hello@loomwork.com and ask for any of these. We will reply within one business day and act within thirty days.

A copy of what we hold.
Deletion. We remove your enquiry and any newsletter subscription. This is permanent and there is no undo, so we will confirm what is about to go before doing it.
Correction of anything that is wrong.
Unsubscribe — the link is in every email, and needs no reply from us.

You do not need to explain why, and asking will not affect how we deal with you.

Changes

If this page changes materially we will update the date at the top. We will not quietly start doing something this page says we do not.