Privacy notice

Who created this site

BytesFX built this website to show what a family café, soft play area and party booking flow can look like. BytesFX is the data controller for the very little this site holds. More about BytesFX is on web.bytesfx.com.

BytesFX Café & Bookings is not a trading business. It has no premises, no staff and no customers, and its location, opening hours, telephone number and contact details do not exist, so there is nothing on this site for them to be about.

This notice describes what this site actually does. It is written by the people who built the site, not by a solicitor.

What the forms do

There are enquiry, party, newsletter and booking forms. Each one is validated and then discarded.

• Enquiry form. Asks for a name, an email address and a message. The values are checked, then dropped.
• Party enquiry form. Asks for a name, a telephone number, an email address, a preferred date, a number of children, the party child's age and any notes. The values are checked, then dropped.
• Newsletter form. Asks for an email address. It is checked, then dropped. No marketing consent is recorded and no mailing list is built.
• Booking form. Asks for a name, a telephone number, an email address and a slot, and optionally the number of children, the child's age and notes. It is checked against the generated list of slots, then dropped.

Nothing is stored. No email is sent. No contact record is created. No reservation is made. The confirmation you see after submitting is the page answering you, not a café replying.

It is worth being precise about one thing, because "no data is collected" would not be accurate. Your browser does send the request to our server. What you typed travels over the network and may appear in the hosting provider's server logs, which the provider processes to deliver the site. We are not saying nothing is sent. We are saying nothing we control is kept, and the site builds no record of you from it.

The staff sign-in

One part of this site behaves differently from everything else: the sign-in form at the foot of the page. It is how the owner reaches the booking dashboard, and it works the way a real sign-in does — which makes it the one form here that creates records.

• What it sends. The email address and password you type are sent to this site's own authentication endpoint and checked there against a stored hashed credential. The password itself is never stored, and it never leaves the site.
• What it creates. A successful sign-in creates a session record, writes an entry to the site's activity log, and records the time of the last sign-in on the staff account. A failed attempt is written to the activity log too, and five failures within fifteen minutes lock the account temporarily.
• Who can use it. Only an account that already exists. There is no sign-up here, and no way to create an account from a public page.

That is the same behaviour as the sign-in page in the dashboard itself, which is where the form sends you if a second factor is needed. Nothing here weakens it: the bot check, the lockout and the two-factor requirement all still apply.

What is stored on your device

Two entries, or three if you sign in as staff. When you use the cookie banner, your choice is written to your browser's local storage under the name bytesfx-consent. It records which categories you allowed and when you decided. It stays on your device until you clear it.

The second is the light or dark mode preference, written under the name bytesfx-theme when you use the mode switch in the header. It holds the word light or dark and nothing else. Until you use the switch, the site follows the setting on your operating system and writes nothing at all.

Signing in as staff adds one more. The session token is kept in your browser's session storage under the name bfx-admin-token. Session storage is cleared when you close the tab, and it is never sent to any other site. If you do not sign in, the cookie choice and the mode preference are the only things stored.

That is all. This site sets no cookies of its own, and it stores no advertising identifier, no fingerprint and no analytics identifier. The cookie notice sets out the same point in table form.

What the server does

Hosting. The site is delivered by Cloudflare Pages, and its server-side code runs on Cloudflare Workers with a Cloudflare D1 database attached. Cloudflare processes standard server logs — the IP address of the request, the address requested, the browser's user agent and the time of the request — to deliver the site, to keep it running and to protect it from abuse. The log retention period is set by Cloudflare, not by us.

Storage. The visitor-facing server code writes no contact records and no bookings. The D1 database is attached so the booking code can run unchanged, but nothing a visitor submits is written to it. The public calendar and the booking flow work against a generated list of slots, so the flow behaves like a real one without a real venue behind it.

Analytics. The site includes a first-party, cookieless page-view counter. On this site it records nothing at all.

Bot checks. The captcha used on a live site is switched off here, so you are not asked to solve one.

Staff sessions. A successful staff sign-in creates a session record in the database and an entry in the site's activity log, and records the time of the last sign-in on the account. Failed attempts are logged too. Those records are what the owner's console reads to show who did what, and they are the only records this site creates about a person.

Who else receives anything

No third party receives anything from your browser. There are no font services, no analytics tags and no advertising tags, and nothing is embedded from another site. The site uses the fonts already installed on your device.

Cloudflare is the one exception, and it is not optional: the site cannot be delivered without the host that receives the request. Cloudflare acts as a processor for the log data described above.

The site does have a tracking-snippet feature. An owner can paste third-party head or body code into the admin console, assign it to a page and a consent category, and the site will inject it once the matching category is allowed. No snippets are served at all, so no third-party tag is loaded and no third party is contacted.

How long we keep things

• Form submissions. Not retained. They are discarded once they have been validated.
• Contact records and bookings. None are created, so none are retained.
• Marketing consent. None is recorded, so there is no list and no record of who asked to be contacted.
• Server logs. Retained by the hosting provider for as long as its own policy says. We do not add to them and we do not use them to build a profile of visitors.
• Your cookie choice and your mode preference. Held in your browser's local storage until you clear them, either through the cookie settings on the site or through your browser's site data controls.
• Staff sessions and the activity log. A session lasts until it expires or you sign out. The activity log is pruned on a twelve-month cycle, as are expired sessions.

Your rights under UK GDPR

UK GDPR gives you rights over personal data. BytesFX is the controller for anything this site holds. In practice that is almost nothing: server logs held by the hosting provider, and your cookie choice and mode preference, which sit in your own browser rather than on our servers. If you sign in as staff, a session record and an activity-log entry are created — see the staff sign-in above.

• Access. You can ask for a copy of the personal data held about you. There is no contact record, booking or mailing list to hand over. The only personal data is in the hosting provider's logs, which Cloudflare holds, and we can point you to how to ask them.
• Rectification. You can ask us to correct inaccurate data. There is no stored profile of you to correct.
• Erasure. You can ask us to delete your data. There is no contact record or booking to erase. You can also clear your cookie choice and your mode preference yourself in your browser.
• Restriction. You can ask us to stop using your data. Nothing this site holds is used to make decisions about you.
• Objection. You can object to our use of your data. The site does not use your data for marketing or profiling, so there is nothing in practice to object to.
• Portability. You can ask for your data in a portable format. There is no data set to export.
• Complaint. If you are unhappy with how your information has been handled, you can complain to the Information Commissioner's Office at ico.org.uk.

To make a request about data that BytesFX holds, use the contact details on web.bytesfx.com. Please do not use the contact form on this site for a request: that form is checked and then discarded, so a request sent through it would never arrive.

We have not had this notice reviewed by a solicitor, we have not carried out a data protection audit, and we do not describe this site as fully compliant with anything. It is a plain description of what this site does.

Questions for the owner

If this site were ever run for a real café, the questions below would need answering before a notice like this one could be written properly. They are open questions, and nothing on this site should be read as an answer to them.

• Who is the data controller: an individual owner, a company or a group, and where should a request about it be sent?
• How long should enquiries and booking records be kept before they are deleted?
• Does a party deposit scheme need a consumer contract, and what would that contract say about cancellation, refunds and a café closing at short notice?
• What would the allergen policy be, and who is responsible for checking it on the day?
• Which analytics and advertising tags would run on a live site, and what would the consent banner ask for?