Privacy Policy

The Third Coconut is a trading name of AadhiPixels Ltd (a company registered in England & Wales, company no. 16230492) - a small web & app studio serving local businesses across South West London & North Surrey. You can reach me any time at hello@thethirdcoconut.com. For data-protection purposes, AadhiPixels Ltd is the data controller for this website.

• Things you send me. When you use the contact form, request a quote, or chat with the assistant, I receive what you choose to share - typically your name, email or phone number, and details about your business and what you need.
• Basic, anonymous usage data. If analytics are enabled, I may see aggregate, privacy-friendly stats (pages visited, rough location, device type) to understand what's useful. This doesn't identify you personally and isn't sold or shared.
• The estimate & chat tools run in your browser. Any numbers you enter into the pricing estimator stay on your device unless you choose to send them to me.

I use your details for one reason: to reply to your enquiry and, if you go ahead, to deliver and support your project. The lawful basis is your consent (when you contact me) and legitimate interests (running and improving a small business website). I don't send marketing emails unless you ask me to.

I don't sell your data - ever. I only use trusted service providers needed to run the site and reply to you (for example, an email or form-delivery provider, and website hosting). These providers process data on my behalf under their own data-protection terms.

I keep enquiry details only as long as needed to help you - and to meet any legal or accounting obligations if we work together. If you decide not to proceed and want your details removed, just ask and I'll delete them.

This site aims to keep cookies to a minimum. Google Analytics runs in Consent Mode with everything — analytics storage, ad storage, ad user data and ad personalisation — set to denied by default, before the tag loads. Nothing is stored until you accept in the banner, and declining costs you nothing: every part of the site works either way. I don't use advertising or cross-site tracking cookies.

The rest are strictly necessary and set regardless, because the site can't work without them: your consent choice (so I stop asking), and — if you sign in to the client portal or the admin panel — a signed, HTTP-only session cookie plus the short-lived tokens that verify it.

If we work together you get a portal login. That holds your project messages, requests, quotes, invoices and payment history. You sign in with a Firebase identity and a session cookie; the panel is rate-limited and gated on a verified token.

The lawful basis is performance of our contract. Where the portal holds data about your customers, you are the controller of it and I am your processor — I only act on your instructions, and it comes back to you or gets deleted when we stop working together.

These are the three things this site does that aren't obvious from looking at it, so they get named explicitly rather than hidden under “analytics”.

• The chat assistant logs conversations. What you type is stored so I can see which questions come up and answer them better on the site. Don't put anything sensitive in it. Lawful basis: legitimate interests in improving the service. Ask and I'll delete your conversation.
• Page visits are counted. The site records that a page was viewed, with the referring link and rough location — not who you are.
• Personal proposal pages are tracked, and that tracking is not anonymous. If I've sent you a link to a proposal built for your business, that page records when it was opened and how long was spent on it, tied to that proposal. I use it to know when to follow up. Lawful basis: legitimate interests in pursuing an enquiry you started. If you'd rather I didn't, say so and I'll turn it off for your link and delete what was collected.

These are the providers actually in use. There are no others: Google Cloud and Firebase (database and sign-in), Vercel (hosting), Resend (email), Stripe (card payments), GoCardless (Direct Debit), and Google Analytics (site statistics, only after you consent). Stripe and GoCardless hold your card and bank details — I never see them.

Under UK GDPR you can ask to see the data I hold about you, correct it, delete it, or object to how it's used. Email me at hello@thethirdcoconut.com and I'll sort it promptly. You also have the right to complain to the UK's Information Commissioner's Office (ico.org.uk).