Script Monkey – Privacy Policy

16th April 2021

How this website handles minimal personal data: what we record, why, how long we keep it and how to ask us to delete it.

Script Monkey Ltd. ("we", "us") is the data controller for this website. We are based in the United Kingdom and we handle personal data under the UK GDPR and the Data Protection Act 2018. You can reach us about anything on this page through our contact form.

The short version

  • You do not need an account to use this site. We do not issue logins to visitors and we never store visitor passwords or credentials.
  • We do not use analytics, advertising, profiling or tracking cookies, and we do not sell or share your data with anyone for marketing.
  • If you simply read the site, the only personal data we record is your IP address, in our server logs.
  • If you choose to write to us through the contact form, we keep what you send us so that we can reply.

When you just read the site

Our web server keeps a short technical log of each request, which includes your IP address, the time of the request, the page requested and the response. We use these logs only to keep the site available and secure – diagnosing faults and identifying abuse such as automated attacks. We do not use them to build any profile of you, and we do not try to identify you from them.

Our lawful basis is our legitimate interest in running a secure, working website.

Cookies

We set only the cookies this site needs in order to function, so we do not ask you for cookie consent:

  • An anti‑forgery token on pages that contain a form, which protects the form from being submitted from another site on your behalf.
  • A sign‑in cookie that is issued only to our own staff when they sign in to manage the site. Visitors never receive it.

There are no analytics, advertising or social‑media tracking cookies set by us. You can delete cookies at any time using your browser's own controls, and the site will continue to work.

If you use the contact form

When you send us a message we record the name, email address, subject and message you type, together with your IP address and the browser identification (user‑agent) your browser sends. The IP address and browser identification are kept for one reason only: to recognise and block automated spam.

We also count how many submissions arrive from one IP address in a short period, so that a script cannot flood the form. That count is held in memory for a few minutes and is never written to our database.

Your message is stored in our database and emailed to us so that we can read and answer it. We use it to reply to your enquiry and to keep a record of our correspondence – nothing else. We do not add you to a mailing list.

Our lawful basis is our legitimate interest in responding to enquiries we receive.

Spam protection on the contact form

The contact form is protected by Cloudflare Turnstile, which tells people apart from automated bots without asking you to solve a puzzle. It runs invisibly, so in most cases there is nothing for you to click.

When the form page loads, your browser contacts Cloudflare, and Cloudflare processes a small set of signals in order to make that assessment: your IP address, your browser's TLS fingerprint, the user‑agent your browser sends, and the identifier of our Turnstile widget together with the address of the page it appears on. Cloudflare states that it cannot directly identify any individual from these signals, and that they are strictly necessary in order to detect and block bots.

For this check Cloudflare acts as our processor and we remain the data controller. Cloudflare also uses the same signals as a controller in its own right, to improve how well Turnstile detects bots generally. The detail is set out in Cloudflare's Turnstile Privacy Addendum, which sits alongside the main Cloudflare privacy policy.

Our lawful basis is our legitimate interest in keeping the form working and free of automated abuse. If you have a data protection question about this check in particular, please raise it with us rather than with Cloudflare – Cloudflare directs visitors to the website operator, which is us.

Content loaded from X (Twitter)

Our home page embeds our public timeline from X (formerly Twitter). That panel is loaded by your browser directly from X, which means X receives your IP address and may set its own cookies, independently of us. We do not control what X does with that information. If you would rather it did not load, you can block scripts from platform.twitter.com in your browser, and the rest of the site will work normally. See the X privacy policy.

How long we keep things

  • Server logs: up to 90 days, then deleted.
  • Contact form messages: for up to 24 months after our last correspondence with you, then deleted.

Who else sees your data

We do not sell your personal data and we do not share it for anyone else's marketing. It is handled only by the suppliers who help us run the site – our hosting provider, our email provider, and Cloudflare for the spam check described above – each acting on our instructions. We will disclose data if we are legally required to do so.

Your rights

You have the right to ask us for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable form. Where we rely on legitimate interests, you can object and we will stop unless we have compelling grounds to continue.

To exercise any of these rights, send us a message through our contact form saying what you would like us to do. We will respond within one month, by email to the address you give us. If you are not satisfied with our response you can complain to the Information Commissioner's Office at ico.org.uk.

Changes to this policy

If we change how we handle personal data we will update this page and the date below.

Last updated: 17 October 2026.