Foresty Ltd · Privacy Policy · Version 1.0 · Effective 24 October 2026
Privacy Policy
This policy explains how Foresty Ltd collects, uses, shares and protects personal data. Please read it together with our Terms of Use and our Cookie Policy.
Version history
| Version | Date | Changes |
|---|---|---|
| 1.0 | 24 October 2026 | Initial policy. |
1. Who we are
Foresty Ltd (“we”, “us”, “our”) is a company registered in England and Wales under company number 16775596, with our registered office at 124 City Road, London EC1V 2NX, United Kingdom. We provide software development, design, IT consultancy and advertising-related services, and we operate the website at foresty.me and other online services.
We are the controller of the personal data described in this policy, except where section 11 explains that we act for our clients. We are registered with the Information Commissioner’s Office (ICO) under registration number ZC126206.
You can contact us about anything in this policy by email at info@foresty.me or by post at the address above. We have not appointed a data protection officer, because the law does not require us to.
2. Who this policy covers
This policy applies to:
- visitors to foresty.me and our other websites;
- users of our Online Services: apps, browser extensions, bots and other tools that we operate and that refer to this policy;
- clients and prospective clients, and the people who work for them and deal with us;
- people who contact us by email, through Telegram or otherwise; and
- suppliers and partners, and the people who work for them.
Some of our products have their own privacy policy. Where they do, that policy applies to them instead of this one. Section 11 explains what happens when we process personal data for our clients, for example about the users of an app that we build for them.
3. Personal data we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Contact and enquiry data | Name, email address, phone number, company and job title, Telegram username, and what you tell us in your enquiry. | You. |
| Client and engagement data | Contact details of the people we work with; project information; messages, files, designs and code that we exchange; access to accounts that you ask us to work on; proposals, contracts and invoices. | You and your colleagues; platforms that you give us access to. |
| Billing data | Billing name and address, tax or VAT number, invoices, payment status and transaction history. Card payments are handled by Stripe, and we receive only the card brand, the last four digits and the expiry date. | You; Stripe. |
| Account data | Where an Online Service has accounts: your name or nickname, email address, password (stored only as a secure hash) or the identity that you sign in with (such as Apple, Google or Telegram), and your settings. | You; the sign-in provider that you choose. |
| Purchase data | What you bought, the price, currency and date, transaction and subscription identifiers, and renewal, cancellation and refund events. We never receive your full card details. | Apple, Google, Telegram or Stripe. |
| Content you submit | Text, files, images and other content that you enter into an Online Service in order to use its features. | You. |
| Usage, device and technical data | IP address; browser, device and operating system; app version; language; approximate location (country or city, derived from your IP address); pages and features used; referring pages; dates and times; crash reports and diagnostic data; and identifiers that an app creates for your installation. | Automatically, from our servers and from Cloudflare; Cloudflare Web Analytics, in aggregated form; Google Analytics, if you accept analytics cookies (see our Cookie Policy); app stores. |
| Advertising identifiers | Where one of our apps measures which advertising campaign led to its installation: your device’s advertising identifier, only if you allow this in your device settings, and campaign information. | Your device, with your permission; advertising and attribution platforms. |
| Communications | Emails, Telegram messages, support requests and feedback, and our notes about them. | You. |
| Marketing data | Your marketing preferences. | You. |
| Compliance data | Information needed to check eligibility under sanctions law and to prevent fraud, such as company registration details and the results of sanctions screening. | You; public registers; sanctions lists. |
We do not ask for special category data, such as health data. Please do not send it to us.
If you are a client, we need your contact and billing data to work with you. Other information is optional, unless we tell you otherwise.
4. How we use personal data and our lawful bases
UK data protection law, and the EU GDPR where it applies, requires a lawful basis for each use of personal data. The table shows the bases that we rely on.
| Purpose | Lawful basis |
|---|---|
| Answering enquiries and preparing proposals. | Steps taken at your request before entering into a contract; our legitimate interests in responding to business enquiries. |
| Providing Professional Services and managing our relationship with clients. | Performance of our contract with you; where the client is an organisation, our legitimate interests in working with its staff. |
| Providing Online Services, including accounts, features, purchases and support. | Performance of our contract with you (our Terms of Use). |
| Billing, accounting and recovering money owed to us. | Performance of our contract; compliance with our legal obligations (tax and accounting); our legitimate interests in being paid. |
| Keeping our services and systems secure, preventing fraud and abuse, and diagnosing errors. | Our legitimate interests in network and information security, which UK law recognises as a legitimate interest. |
| Measuring and improving our website and Online Services. | Our legitimate interests in understanding how our services are used (cookieless statistics, which you can switch off); your consent for analytics cookies. |
| Measuring advertising campaigns for our apps. | Your consent where the law or the platform requires it, for example to access your device’s advertising identifier; otherwise, our legitimate interests in measuring our marketing. |
| Sanctions and compliance checks. | Compliance with our legal obligations; our legitimate interests in preventing fraud and crime. |
| Service messages about your account, purchases, projects or changes to our terms. | Performance of our contract; compliance with our legal obligations. |
| Marketing our services. | Our legitimate interests in promoting our business to business contacts; for individuals, your consent or, for existing customers, the “soft opt-in” allowed by electronic communications law. You can opt out at any time. |
| Showing our work and naming clients in our portfolio. | Our legitimate interests in promoting our business. You can object at any time. |
| Establishing, exercising or defending legal claims, responding to authorities and enforcing our terms. | Compliance with our legal obligations; our legitimate interests in protecting our rights. |
| A sale, merger, financing or reorganisation of our business. | Our legitimate interests in running and developing our business. |
Where we rely on legitimate interests, we have balanced our interests against your interests and rights. You can ask us for details and object to the processing (see section 10).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
5. Cookies and similar technologies
On foresty.me we use only what we need: a record of your cookie choices; security cookies from Cloudflare when its protection is active; cookieless statistics from Cloudflare Web Analytics, which you can switch off; and Google Analytics cookies only if you accept them. We do not use advertising cookies on our website, and we treat a Global Privacy Control signal from your browser as a refusal of analytics and marketing cookies. Our Cookie Policy gives the details and explains how to change your choices.
Our apps and other Online Services may use similar technologies, such as storage on your device and installation identifiers. Where the law or the platform requires it, they ask for your permission first.
6. Who we share personal data with
We do not sell personal data. We share it only as described below.
Service providers
Most of the providers below act as our processors under written contracts, which allow them to use personal data only to provide their services to us. Stripe and Telegram also act as independent controllers, as the table explains.
| Provider | Location | What it does for us |
|---|---|---|
| Cloudflare, Inc. | United States; global network | DNS, content delivery, protection against attacks and TLS encryption for our websites; cookieless website statistics (Cloudflare Web Analytics). |
| DigitalOcean, LLC | United States; our servers are in its data centre in Frankfurt, Germany | Cloud hosting for our websites and Online Services: servers, databases, storage and backups. |
| Google (Google Ireland Ltd and Google LLC) | Ireland; United States | Google Workspace: business email, calendar, documents and file storage. Google Analytics: website analytics, only if you accept analytics cookies. |
| Stripe (Stripe Payments UK Ltd and Stripe, Inc.) | United Kingdom; United States | Card payments and invoicing. Stripe also acts as an independent controller of payment data for its own fraud-prevention and regulatory purposes, under its own privacy policy. |
| Telegram (Telegram Messenger Inc. and Telegram FZ-LLC) | British Virgin Islands; United Arab Emirates | Messaging with clients and users, support chats and bots. Telegram is an independent controller of the data that it processes to run its messaging service, under its own privacy policy. |
| Other IT and software providers | Varies | Tools that we use for particular projects or Online Services, such as code hosting, project management, design and error monitoring tools and, where an Online Service has AI-assisted features, AI model providers. They act as our processors and receive only the data needed for the task. |
Other recipients
- App stores and platforms. Apple, Google, Telegram and other platforms process your downloads and purchases of our apps as independent controllers, under their own privacy policies.
- Advertising and attribution platforms. Where one of our apps measures advertising campaigns, it may share install and purchase events, and, with your permission, your advertising identifier, with the platforms that ran the campaign and with attribution providers. They may act as independent controllers. The app tells you about this and asks for your permission where required.
- Platforms that our clients use. When a client asks us to work on its accounts with advertising, analytics, app store or other platforms, data is exchanged with those platforms on the client’s instructions.
- Professional advisers. Our lawyers, accountants, auditors, insurers and banks, where necessary.
- Authorities. Courts, regulators, law enforcement agencies, tax authorities and sanctions authorities, where the law requires or permits disclosure, or where disclosure is necessary to protect our rights, our customers or the public.
- Business transfers. A buyer, investor or successor in connection with an actual or proposed sale, merger, financing or reorganisation of all or part of our business, subject to confidentiality obligations.
7. International transfers
We are based in the United Kingdom. Our servers are hosted by DigitalOcean in Frankfurt, Germany, which is in the European Economic Area (EEA). UK law recognises the EEA as providing adequate protection for personal data.
Several of our providers are located in, or may access data from, the United States or other countries outside the UK and the EEA. Where this happens, we rely on an appropriate safeguard: UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US companies; the International Data Transfer Agreement issued by the ICO; or the EU Standard Contractual Clauses with the UK Addendum. Transfers from the EEA to us are covered by the European Commission’s adequacy decision for the United Kingdom. You can ask us for more information about these safeguards.
Telegram processes messages in the British Virgin Islands and the United Arab Emirates as an independent controller. If you choose to contact us through Telegram, you share your messages with Telegram under its own privacy policy. You can email us instead.
8. How long we keep personal data
We keep personal data only for as long as we need it for the purposes in this policy, including to meet legal, accounting and reporting requirements and to deal with disputes.
| Data | Retention period |
|---|---|
| Enquiries that do not lead to an engagement | 24 months after our last contact. |
| Client and engagement records, including communications | For the engagement and 6 years after it ends. |
| Access to accounts that clients give us | Removed when the engagement ends, or earlier when no longer needed. |
| Billing, accounting and tax records | 6 years after the end of the financial year to which they relate. |
| Account data for Online Services | While the account is active; deleted within 30 days after it is closed, and removed from backups within 90 days after that. |
| Content you submit to Online Services | Only as long as needed to provide the feature, or as the Online Service describes, and deleted with your account. |
| Purchase records | 6 years after the purchase. |
| Server, security and access logs | Up to 12 months. |
| Google Analytics data | 14 months. |
| Support communications | 24 months after the last exchange, or longer if needed for a dispute. |
| Marketing data | Until you opt out, or 24 months after your last interaction with us. |
| Sanctions and compliance records | 6 years after the end of our relationship with you. |
| Data relating to a legal claim or complaint | For the duration of the claim and the limitation period (normally 6 years in England and Wales). |
When we no longer need personal data, we delete or anonymise it. If deletion is not immediately possible, for example because the data is in backups, we keep it secure and do not use it until it is deleted.
9. Security
We use appropriate technical and organisational measures to protect personal data. They include TLS encryption in transit, encryption at rest where our providers offer it, access restricted to the people who need it, multi-factor authentication for administrative accounts, secure storage of credentials, regular updates, backups, and contractual obligations on our providers.
No system is completely secure, and we cannot guarantee the security of data sent to us over the internet. If you become aware of a security problem affecting our services, please tell us immediately at info@foresty.me.
10. Your rights
Under UK data protection law, and the EU GDPR where it applies, you have the following rights in relation to personal data for which we are the controller:
- Access: to ask whether we process your personal data and to receive a copy of it, with information about how we use it;
- Rectification: to have inaccurate or incomplete personal data corrected;
- Erasure: to have your personal data deleted in certain circumstances;
- Restriction: to ask us to limit how we use your personal data in certain circumstances;
- Portability: to receive personal data that you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible;
- Objection: to object to processing based on our legitimate interests, and to object at any time to direct marketing;
- Withdrawal of consent: where we rely on your consent, to withdraw it at any time, without affecting processing that took place before; and
- Automated decisions: not to be subject to decisions based solely on automated processing that have legal or similarly significant effects on you, except where the law allows it.
To exercise these rights, email us at info@foresty.me, from the email address linked to your account if you have one, or write to us at our registered office. We may need to confirm your identity first. We will respond within one month, or tell you if we need up to two more months for a complex request. We do not normally charge a fee, but we may charge a reasonable fee for, or refuse, a request that is manifestly unfounded or excessive. Some rights are subject to conditions and exceptions set out in the law.
If you live in a US state with a comprehensive privacy law, you may have similar rights to know, access, correct and delete your personal data, and to opt out of its sale or sharing. We do not sell personal data or share it for cross-context behavioural advertising, and we treat a Global Privacy Control signal as an opt-out. We will not discriminate against you for exercising your rights.
11. When we act for our clients
When we provide Professional Services, we may process personal data on behalf of our clients, for example about the users of an app or website that we build, maintain or connect to analytics and advertising tools for them. In that case our client is the controller and decides how the data is used, and we act as its processor under a data processing agreement. The client’s own privacy policy applies.
If you want to exercise your rights over such data, please contact the client. If you contact us instead, we will pass your request to the client where we can identify them, and we will help the client to respond.
12. Complaints
If you are unhappy with how we have handled your personal data, please tell us first so that we can put things right. You can complain electronically by emailing info@foresty.me with “Data protection complaint” in the subject line, or by post to our registered office. We will acknowledge your complaint within 30 days of receiving it, investigate it, and tell you the outcome without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; website ico.org.uk. If you live or work in the EEA, you may also complain to your local supervisory authority.
13. Children
Our Online Services are not directed at children under 13, and our Professional Services are only for adults. We do not knowingly collect personal data from children under 13. If you believe that a child has given us personal data, please contact us and we will delete it.
14. Marketing communications
We may occasionally send news and offers about our services to business contacts, to existing clients and to anyone who has asked to receive them. You can opt out at any time by using the unsubscribe link in any marketing email or by emailing info@foresty.me. Opting out does not stop service messages about your account, purchases or engagements.
We may name our clients, including by name and logo, in our portfolio and marketing unless they ask us not to. You can object at any time by emailing us.
15. Third-party websites and services
Our websites and Online Services link to, and work with, third-party websites and services, such as app stores, Telegram and payment providers. We are not responsible for their privacy practices, which are governed by their own policies.
16. Changes to this policy
We may update this policy from time to time to reflect changes in the law, in our services, in our providers or in our practices. We will publish the updated policy at foresty.me/privacy/ and update the version history above. If a change materially affects how we use your personal data, we will tell you in advance by email or in the relevant Online Service, where we can.
17. Contacting us
- Email: info@foresty.me
- Post: Foresty Ltd, 124 City Road, London EC1V 2NX, United Kingdom
- ICO registration number: ZC126206