Your privacy, in plain English.

The data controller for personal data collected through this site is Squirrels' Nest.

• By email: squirrelsneststay@gmail.com

If you have any question about this policy or how we handle your data, please contact us using the details above. We're a small operation, so it's usually Zoe who reads and answers.

Information you give us

When you complete the form on our contact page (or email us directly), we collect:

• your name;
• your email address;
• the dates you're interested in, if you choose to tell us;
• the content of your message.

Please don't send us sensitive information (for example details of your health, race, religion, or anything classed as a “special category” under the UK GDPR). We don't ask for it and don't need it.

Information collected automatically

Like virtually every website, our hosting provider records limited technical information when you visit, for security and reliability. This can include your IP address, the type and version of your browser and device, the page that referred you, and the date and time of your request. We also use your IP address momentarily to rate-limit the contact form so it can't be abused by bots. We do not use this technical data to identify you, build a profile, or track you across other websites.

We only use your personal data for the purposes below, and we always rely on a lawful basis under Article 6 of the UK GDPR:

Where we rely on legitimate interests, we've considered your rights and interests and don't believe our use of your data overrides them. You can object at any time (see Your rights below).

We do not use your data for marketing, we do not sell or rent it to anyone, and we do not make any automated decisions about you.

We use no analytics, advertising pixels, or third-party tracking cookies. Nothing on this site follows you around the web.

The site stores just two small, strictly necessary items in your own browser. Neither contains personal data, neither is shared with anyone, and under the Privacy and Electronic Communications Regulations (PECR) they don't require a consent banner because they only make the site work the way you'd expect:

• Theme preference — remembers whether you chose the light or dark version of the site, so it stays the way you left it.
• Intro flag— remembers that you've already seen the opening animation during this visit, so it doesn't replay on every page.

Our fonts are served from our own domain, not fetched from Google or any other third party, so visiting the site doesn't share your IP address with a font provider.

We keep the list of companies that touch your data deliberately short. Each is a reputable provider bound by a data-processing agreement to use your data only on our instructions:

• Vercel — hosts the website and serves it to you. It processes the technical and security data described above.
• Resend — delivers the email from our contact form to our inbox. It handles your message in transit and keeps only short-term delivery logs.
• Google (Gmail) — the mailbox where your enquiry arrives and is read. Once an email lands, it sits in our private inbox, protected by our account security.

We may also disclose personal data if we're legally required to (for example, in response to a valid request from a public authority), or to establish, exercise, or defend legal claims.

Some of our providers (including Vercel and Resend) are based in, or store data in, the United States. Where your personal data is transferred outside the UK, we rely on safeguards approved under UK data protection law — such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or transfers to a country the UK Government has deemed to provide adequate protection. The effect is that your data keeps an equivalent level of legal protection wherever it's processed.

We don't keep your data any longer than we need to:

• Enquiry emails— until your enquiry is resolved and our conversation is finished, or until we've held a message for around 12 months without further contact, whichever comes first. Then we delete it.
• Technical and security logs— kept only for the short period our hosting provider retains them (typically a few weeks to a few months) before they're automatically deleted.
• Rate-limiting data — your IP address is held in memory only for a few minutes to spot abuse, then discarded. It is never written to a database.

Security is built into the site, not bolted on. Among other measures:

• the whole site is served over an encrypted HTTPS connection;
• we apply strict security headers (including a Content Security Policy, HSTS, and clickjacking protection);
• the website itself stores none of your enquiry data — messages go straight to our inbox and nowhere else;
• access to that inbox is limited and password-protected;
• we use established, security-conscious providers.

No method of transmitting data over the internet is ever 100% secure, but we take every reasonable step to protect yours and to deal quickly with any issue if one arises.

Under the UK GDPR you have the right to:

• Be informed about how we use your data — that's what this policy is for.
• Access the personal data we hold about you.
• Rectification — have inaccurate data corrected or incomplete data completed.
• Erasure — ask us to delete your data (“the right to be forgotten”).
• Restrict how we use your data in certain circumstances.
• Object to our use of your data where we rely on legitimate interests.
• Data portability — receive your data in a portable format.
• Withdraw consent at any time, where we rely on consent.
• Not be subject to automated decision-making— we don't do any, so this never applies.

To exercise any of these, just email squirrelsneststay@gmail.com. It's free, and we'll respond within one month, as the law requires (and usually much sooner).

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO):

• Online: ico.org.uk/make-a-complaint
• Helpline: 0303 123 1113
• By post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

This site and our cabin are intended for adults. We don't knowingly collect personal data from children. If you believe a child has sent us their data, contact us and we'll delete it.

Our site links to places we don't control — most importantly our Airbnb listing, and possibly social media. Once you follow a link off our site, this policy no longer applies; please read the privacy policy of wherever you land. We're not responsible for the practices of other websites.

If we change how we handle your data — for example if we ever add analytics, an embedded booking calendar, or any third-party widget — we'll update this page and change the “last updated” date at the top. For significant changes we'll make the update clear. Please check back from time to time.