The current Blancc site does not post contact details to a Blancc server, set application cookies, or send measurement events to an analytics provider. It does use limited browser storage and Cloudflare-hosted infrastructure.
This page describes the code and hosting configuration reviewed on 16 August 2026. It does not pretend that unverified business or supplier facts are settled.
01 / CURRENT SCOPE
The short answer.
No website submissionThe project form prepares a draft or clipboard copy in your browser.
No analytics recipientAllow-listed events remain in the current page unless a future provider is deliberately connected.
Two browser entriesOne remembers motion preference; one prevents the home intro repeating within a tab session.
Ordinary hosting dataCloudflare infrastructure receives web requests to deliver and protect the site.
Not yet a final production privacy notice.
The controller’s legal identity, a verified privacy contact, correspondence retention periods, and supplier account settings still require owner confirmation before permanent-domain launch.
02 / ENQUIRIES
Contact details move only when you choose.
Completing the form does not send information to Blancc. Your browser first builds a human-readable brief from the fields you complete.
EMAIL DRAFT
Your email app controls the draft.
Choosing “Create email draft” first tries to copy a human-readable brief on your device, then opens a mailto: link containing your name, reply email, optional organisation, service, optional timing and budget band, and message. “Copy brief only” makes the same local clipboard request without opening another service. The site receives no confirmation that a draft opened or that you sent it.
If you press Send, your email service and the recipient’s email service process the message under their own arrangements.
WHATSAPP HANDOFF
Copying is local; sending is separate.
Choosing “Copy brief + open WhatsApp” asks the browser to copy the same brief to your device clipboard and opens Blancc’s public WhatsApp route. The site does not paste or send the brief for you.
WhatsApp receives the message only if you paste it, review it and press Send. WhatsApp then handles that interaction under its own privacy information.
Purpose
If you send an enquiry, the intended purpose is to understand the request, assess fit, reply, scope a possible project and protect the correspondence from abuse.
Data minimisation
Do not send passwords, payment details, health information or other sensitive material. Blancc does not need that information for an initial project enquiry.
Lawful basis requires confirmation
The likely basis for an individual requesting a quote is taking steps at that person’s request before a contract. Business-enquiry administration or security may instead require a documented legitimate-interests assessment. The owner must confirm and record the actual bases before launch.
Cloudflare provides the current hosting and network edge. Request information may include an IP address, requested URL, request headers, browser or device signals, timestamps and security or caching events.
The application declares no customer database, file-upload bucket, account system or server-side contact-form store. Its generated hosting configuration currently enables Workers observability, while the application writes no custom visitor log messages.
Operational request data may be used to serve content, diagnose failures, prevent abuse and maintain security. The exact Cloudflare products, log fields, account access, retention period, subprocessors, processing locations and transfer safeguards are not verified in this workspace.
Owner confirmation required.
Review the live Cloudflare account, data-processing terms, observability and security settings, log access, retention and any international-transfer mechanism before treating this section as final.
04 / YOUR DEVICE
Two preference entries, no application cookies.
The current application code does not set cookies, advertising identifiers or cross-site tracking pixels. Browser storage is used only for the experience described below.
Cloudflare security features could set or access a security cookie if the account owner enables them or a protection is triggered. The live security-product configuration has not been verified, so this page does not claim that infrastructure-level cookies can never occur.
Entry
Where
Purpose
Duration
Sent off-device?
blancc-motion-preference
Local storage
Remembers whether you chose paused or playing motion.
Until you clear it or browser storage is removed.
No.
blancc-intro-seen
Session storage
Prevents the Blancc home intro repeating in the same tab session.
Normally until that tab session ends, or you clear it.
No.
The ICO treats local and session storage as storage and access technologies even when data stays on the device. The motion control is always available, and the control below removes both Blancc entries. If you later choose a motion setting or revisit the homepage, the relevant preference entry may be created again.
Current measurement boundary
The site creates allow-listed page, link, form-intent, contact-handoff, tool-completion, result-export and web-vital events in an in-memory dataLayer and browser event bus. During the current page context, each event can include an in-memory first-touch snapshot: first landing pathname, external referrer hostname, and bounded utm_source, utm_medium, and utm_campaign values. That snapshot is not placed in local storage, session storage, or a cookie, and it ends on a full page load or when the page context ends. It never includes a query string or full referrer URL. Result-export properties are limited to the tool slug and action—copy, download, print or copy-and-open-enquiry. Website and AI opportunity tool answers are not included. The MVP scope planner and branding brief builder accept short project text locally; that text can appear in the result the visitor chooses to copy, download, print or carry to the contact page through their own clipboard, but application code does not send or store the answers, and tool answer text is excluded from analytics. The content production brief builder accepts 12 controlled selections without free text; its completion and export events exclude selections, counts and brief text, and its result is generated locally without network submission or browser storage. Choosing “Copy brief + open project enquiry” first asks the browser to copy the locally generated Markdown. Only after the modern Clipboard API confirms that copy does the site open the canonical contact page with an allow-listed service selection. If that confirmation is unavailable or copy is blocked, the visitor stays on the tool and the result appears in a local, read-only manual-copy field; the visitor must copy it and open the contact page themselves. Answers are not placed in the URL, browser storage, analytics event or network request, and nothing is attached, pasted or sent automatically. The visitor must paste the brief into the message field, review it and choose a sending route. The social media audit accepts 18 controlled radio selections without handles, profile URLs, account access, customer data or free text; its completion event includes no answers or counts, and its result and export are generated locally without network submission or browser storage. All six planning tools keep their inputs and generated results in the visitor’s browser unless the visitor deliberately copies, downloads, prints or pastes a result into another service. Contact-handoff events distinguish an attempt from a clipboard-ready brief, but neither means a message was sent or received. The bridge does not read contact names, email addresses, company fields, form values or message text from the site interface. UTM parameters are supplied in the landing URL, however, so a visitor or campaign operator could place unexpected text in them; normalisation and length limits do not guarantee that a UTM value is non-personal.
No tag manager, advertising pixel, analytics provider or remote measurement endpoint is connected. The locally bundled web-vitals library observes CLS, INP, LCP and TTFB and writes only the allow-listed measurements to the in-memory dataLayer and browser event bus described above; it does not send them off-device. Those in-memory events disappear when the page context ends and are not useful as a visitor record. A future analytics integration would require a fresh privacy and PECR review, an owner-approved UTM value allowlist, and updated disclosure before activation.
05 / SERVICE BOUNDARIES
What stays here, and what leaves.
Cloudflare
Delivers and protects the website. Its contractual role and live account settings require owner verification.
Your email service
Processes a draft when your device opens it and processes the message if you send it. Blancc does not control your email provider.
Recipient email service
Processes a message after you send it. The provider and delivery status for the displayed Blancc mailbox have not been independently confirmed.
WhatsApp
Becomes involved when you open its service; it processes message content if you choose to send. Blancc does not embed a WhatsApp tracking widget.
Instagram
Receives an ordinary visit only if you follow the external footer link. Blancc does not embed an Instagram feed or pixel.
No analytics vendor
No analytics, advertising, session-replay or customer-data platform currently receives the site’s in-memory measurement events.
External services can determine their own purposes after you choose to use them. Read the privacy information shown by the relevant service before sending personal information.
06 / RETENTION
Retention must follow purpose, not habit.
UK data protection law does not prescribe one universal retention period. Personal information should be kept only as long as the documented purpose requires, then deleted or anonymised unless another lawful need applies.
Unsent contact form
Not stored by the Blancc application. Draft and clipboard retention depend on your device and chosen communication service.
In-memory measurement
Ends with the page context and is not transmitted to a measurement provider.
Browser preferences
The intro marker is session-scoped. The motion preference persists until cleared. First-touch attribution remains only in memory for the current page context.
Sent correspondence
No verified Blancc retention schedule is available. The owner must set and publish periods or clear criteria for enquiries, declined work, active clients, legal records, disputes and suppression records.
Hosting and security records
The live Cloudflare retention configuration has not been verified. It must be documented before this notice is final.
07 / YOUR RIGHTS
You can ask what happens to your information.
Depending on the purpose, lawful basis and any applicable exemption, UK data protection rights can include information, access, correction, erasure, restriction, portability and objection.
Blancc does not use this website for solely automated decisions or profiling about individuals. A rights request should identify the communication channel and approximate date used, without sending extra sensitive information.
The rights contact is not yet verified.
The site displays hello@blancc.co.uk, but mailbox delivery has not been independently confirmed. The owner must verify a monitored privacy channel and publish the controller’s legal identity before permanent launch.
You may complain to the Information Commissioner’s Office. The ICO recommends giving the organisation a chance to complete its complaint process first where possible.
08 / BEFORE PERMANENT LAUNCH
Facts the owner must confirm.
The natural person or legal entity that operates Blancc and acts as controller.
A monitored privacy and rights-request contact, including verification that email is delivered.
The actual lawful basis for each enquiry, security, correspondence and record-keeping purpose.
Retention periods or clear retention criteria for sent enquiries, project records, backups and hosting logs.
Cloudflare and email-provider contracts, roles, subprocessors, settings, processing locations and international-transfer safeguards.
Whether WhatsApp correspondence is copied into any mailbox, address book, CRM, backup or other system.
Whether an ICO data protection fee is required and, if so, the registration details.
No analytics or advertising vendor should be connected until its purpose, data fields, lawful basis, PECR position, retention, access, processor terms and notice changes are approved.
09 / OFFICIAL SOURCES
Guidance used for this page.
Legal guidance was reviewed on 16 August 2026. Source links go only to the ICO or GOV.UK.
Changes to this practice: this page must be updated before Blancc introduces a new data purpose, server-side form storage, analytics, advertising technology, a new processor, or materially different retention.