What happens to your information.
A plain description of what this site does, what a website preview does, and where an enquiry goes. Written to be accurate rather than to be a document.
Read this first
It matters more than anything else on the page.
What that means in practice
Nothing on this page tells you how long anything is kept, what law governs it or what rights you can enforce, because OAS has not decided those and will not invent them. When a reviewed policy exists, it replaces this page.
When you contact us
What the contact form asks for, where it goes, and what happens to it.
What the form asks for
The site’s contact forms ask for the least they can and still let us have a useful conversation. What follows is everything they ask for, and a shorter form asks for fewer of them. If what they ask for changes, this list changes with it.
- Your nameSo we know who we're replying to.
- Your businessThe business the conversation is about.
- Phone and emailHow we reply. We use whichever you prefer, and a shorter form asks only for your email.
- Your website, if you have oneOptional, and a shorter form does not ask. It tells us where you start.
- What you'd like help withThe areas you select — getting found, estimates and invoices, keeping the business organized, photos and posts, a website, or not sure yet.
- What you're dealing withThe message you write. Please leave out anything sensitive; a form is not the place for it.
Where it goes first
What you send is written into OAS’s own database before anything else happens, and that record is what we mean when we say we got your message. A notification email goes to OAS afterwards; if that email fails, your message is still here and still gets read. We never tell you it arrived unless it did.
The address your connection comes from is used for a few minutes to stop the form being flooded. It is not stored with your message.
What happens to it
It reaches OAS, and we use it to reply to you and to understand what your business needs. It is not sold, rented or passed to anybody trying to sell you something else, and it is not used to advertise to you elsewhere.
If you would like us to delete what you sent, ask and we will.
If we built a preview for your business
OAS sometimes builds a personalized website preview for a contracting business before that business has agreed to anything. If you were sent one, this is what it is.
Where the information in it came from
Publicly available business information — the sort of thing a customer looking for you would find: your business name, trade, service area, listed phone number and public listing. A preview is a demonstration of what OAS could build. It is not a website that belongs to you, and it does not speak for your business: the legal pages, coverage promises and the working contact form are all switched off in a preview for exactly that reason.
It expires, and it is not indexed
A preview is a short-lived leave-behind. It is given a life of up to thirty days when it is created — seven by default — and it stops working the moment that life runs out. The expiry is checked every time the link is opened, so nothing has to run for the address to go dead. OAS can extend a preview, and can take one down. Every preview is served with instructions telling search engines not to index it, and its address is not linked from anywhere on this site.
If you would like your preview taken down before it expires, tell us and we will remove it. You do not need a reason.
What a preview records
Enough to know whether a preview was worth sending, and nothing that identifies a person:
- That the preview was openedAnd when.
- How long the tab was actually in front of youIdle time is not counted.
- Which design was being shownIf the preview offers more than one.
- When you opened the contact control, and how oftenOne record each time it is opened — not what you wrote in it.
There is no account, no sign-in and no advertising cookie. A preview keeps one random value in your browser’s tab storage so that a page refresh is not counted as a second visit; it is discarded when you close the tab and is never shared with another site. Your IP address, your browser and your location are not stored, and neither is anything you type unless you send it to us as a message.
If you do send us a message from a preview, we keep it: what you wrote, the topic you picked, the email address or phone number you gave us to reply to if you gave one, which page of the preview you were on, and when. It is stored in OAS’s database against that preview so that the people at OAS working with your business can read it and answer you, and OAS is emailed a copy. It is not joined to the visit records above.
Enquiries sent through a website we built
If you are a homeowner who contacted a contractor through a website OAS runs, your enquiry reaches OAS as well as the contractor.
Where it goes
OAS operates the websites it builds, so an enquiry from one is stored centrally by OAS on behalf of the contractor whose site you used. That contractor gets it, and uses it to answer you. OAS uses it to run and support their website.
An enquiry form asks for your name, your phone number, optionally your email, the town you are in, what you need doing and whatever you write about the job. On a larger job it also asks for the address the work is at, the type of home, a rough budget and when you want to start. Where a site asks permission to text you, it asks separately about replying to your enquiry and about anything promotional, and it records those separately — agreeing to one is not agreeing to the other.
If you are a contractor who asked us to text you
A contractor OAS works with can ask to be told about a new enquiry by text. This is what that means for the mobile number they give us, and it is the only mobile number this page is about.
What we hold, and what it is used for
Two things: the mobile number they asked us to send alerts to, and the record that they agreed to those alerts — when they agreed, who recorded it, and whether it was the contractor themselves or OAS recording it for them. The number is used to send that alert and for nothing else. We do not text customers, and the number is never shown on their website.
It is not shared, and it is never marketing
A mobile number given for these alerts, and the agreement recorded with it, are not shared with anybody else for marketing, and are not sold or rented to anybody for any purpose. No affiliate, advertiser, data broker or other third party receives either. The outside companies that handle the number at all are the ones OAS runs on, and whichever service carries a text; every one of them is named under “Who else handles it” on this page, and each holds it only so that OAS can use it.
Nothing else is sent to that number. There is no newsletter, no offer and no promotion — an alert goes out when an enquiry for their business arrives, and at no other time.
Stopping them
A contractor can stop the texts at any time by unticking the agreement on their own account page, or by replying STOP to any alert. Changing the mobile number ends the agreement too, because it was given for the number it replaces, and texts start again only once the new number has an agreement of its own. Stopping texts does not stop the enquiry being recorded, and email alerts are a separate choice on the same page.
What this site does not do
Worth stating plainly, because most sites do the opposite.
No advertising, no profiles, no selling
This site sets no advertising cookies and carries no third-party advertising or social tracking. Nothing here builds a profile of you across other websites, nothing is sold or rented, and there is no newsletter to be added to.
There is no account to make
This site is a landing page. It has no customer accounts and no dashboard, so there is no password of yours for us to hold. A contractor with a portal account is different: signing in there takes a password, and Supabase, the identity provider, handles it and stores it only as a one-way hash, never in readable form. OAS’s own application tables hold no password and no hash, only a reference to the Supabase account.
Who else handles it
OAS runs on services it did not build. Every outside service OAS chooses to handle your information, configures to receive it, or hands it to is named below, and it is a short list on purpose. Those services use suppliers of their own, which this page does not undertake to list.
Hosting, and the database
This website and the websites OAS builds are hosted on Vercel, so everything you send passes through it, and OAS’s server logs are kept there. The database that holds enquiries, messages sent from a preview and customer records is Supabase. Both run in the United States. They store this information so that OAS can use it; they do not use it for their own purposes.
Getting a message to us, and where it then sits
OAS is told about a message by email. Resend is the service OAS sends that mail through today, and OAS is set up to move that job to the email service run by Amazon Web Services. OAS sends through exactly one of the two at any time, never both, and which one it sends through is a setting on OAS’s own servers rather than anything you choose or can see. From the help control on a preview, whichever one it is receives what you wrote, the phone number or email address you gave us to reply to, and the name of the business the preview was built for. From a contact form, it receives the notification that one arrived — your name, your business, how to reach you and what you wrote. From a contractor website enquiry, it receives the notification sent to that contractor and OAS — your contact details, what service you asked for and what you wrote about the job. From a booked call, it receives the notification that one was booked — your name, how to reach you, when the call is and anything you added.
It then arrives in an OAS mailbox, and OAS’s mail is run by Google Workspace — so your message and your reply address sit there, the same way they would if you had emailed us directly. That is true of anything you send us by email, not only a message from a preview.
A text alert to a contractor
Where a contractor has asked to be told about a new enquiry by text, that text is sent through the messaging service run by Amazon Web Services. It receives the contractor’s mobile number and the alert itself — the name of the business the enquiry is for, your name and phone number, the service you asked about, your town and the start of what you wrote. It also answers a STOP or HELP reply to those texts on OAS’s behalf.
Booking a call
You can book a call with OAS instead of writing to us. The calendar that shows you the times, takes the booking and sends you the confirmation belongs to Cal.com, a scheduling service, and what it receives is what you give it — your name, your email address, anything else its booking page asks for, and whatever you add about what you want to talk about. The call is then placed on an OAS calendar, which is a Google Calendar, so the booking and your email address sit there too.
Cal.com tells OAS you booked, and that booking is written into OAS’s own database before anybody at OAS is emailed about it — the same order everything else on this page follows. If you cancel or move the call, the calendar is the record of that; the booking OAS stored stays as a note that you got in touch.
Counting how often the forms are used
Every form here is capped, so that one script cannot flood it: so many submissions from one internet connection in ten minutes, and no more. Upstash keeps that count for OAS, and what it receives is the internet address the submission came from and nothing else — not your name, not your message, not what you said. The address is a label to count against, it is not stored next to anything you sent, and it is discarded when the ten minutes are up. The same service carries OAS’s internal work queue, which passes it the reference number of a row in the database and never its contents.
Checking you are not a robot
Our forms are checked by Vercel, using a service called BotID, which Vercel runs together with Kasada. When that check runs, your IP address and some signals about your browser go to Vercel and on to Kasada so they can tell a person from an automated program. It does not ask you to identify traffic lights, it does not set an advertising cookie, and what it sends back to us is a yes or a no — not a profile of you. If the check cannot be reached, your message still goes through.
What is not connected
There is no payment processor here — OAS takes no money through this website. There is no advertising network and no analytics company. What a preview records, it records into OAS’s own database rather than an outside analytics service, and the fonts are served from this site rather than from a font company. If any of that changes, this page changes with it.
How it is looked after
Access to the central database is limited to OAS. The credentials a contractor’s website uses are stored as hashes rather than as recoverable secrets. Diagnostic server logs run through a list of permitted fields, so names, phone numbers, email addresses and message text are not copied into routine failure records.
Ask us about your information
Ask what we hold, ask us to correct it, or ask us to delete it. While there is no policy to point you at, the answer comes from a person — so ask.
Talk to OAS