Privacy, in plain English

Who I am

This site belongs to CK Forbes Limited, a New Zealand company run by me, Carl Forbes, from Rotorua. If you have a question about your information, email me at carl@ckforbes.com.

What I collect, and why

When you start a brief

Your name, email address, phone number if you give it, and what you tell me about your project, your timing and your budget. I use these to reply to you and, if we work together, to set up and run your project.

On a client project page

The name and initials you type before posting, your messages, the files you upload, and the time of each. These are how we run the project together. The name and initials are whatever you choose to enter; I don’t check them.

When anyone signs in

The time of each sign-in attempt and a scrambled version of your IP address. I use these to stop people guessing their way in. The scrambling is one-way, so the stored value can’t be turned back into your address.

Cookies and your browser

A project page sets one cookie to keep you signed in to that project. If you choose a colour theme on a project page, the choice is saved in your browser. There are no advertising or tracking cookies and no analytics on this site.

The “Listen” button uses your browser’s built-in speech. Some browsers send the text to their maker’s servers to speak it; nothing is sent to me.

Where it’s kept

• Supabase stores the database and uploaded files, in Sydney, Australia.
• Vercel runs the website. The parts that handle your information run in Sydney, and Vercel keeps short-lived request logs.
• Resend sends the notification emails. Emails carry a link back to the site rather than the content of your messages.

These companies store and process the information for me and don’t use it for their own purposes. I stay responsible for keeping it safe. TODO(Carl): confirm Resend’s region and retention

If you book a call, Cal.com handles the booking under its own privacy policy.

How long I keep it

TODO(Carl): how long enquiries and finished projects are kept before deletion

Keeping it safe

Project pages each have their own login, passphrases are stored only as one-way hashes, the site uses HTTPS throughout, and repeated failed sign-ins are blocked for a while. Only I can reach the admin area.

Seeing or correcting your information

You can ask to see the information I hold about you, and ask me to correct it. Email carl@ckforbes.com. I’ll reply as soon as I can, and within 20 working days.

If you’re not happy with how I’ve handled your information, you can complain to the Office of the Privacy Commissioner.