Who we are
Castle of Todd is an independent software project operated by Oliver Watson Todd in the United Kingdom. It is not a limited or incorporated company. In this policy, "Castle", "we", "us" and "our" mean Oliver Watson Todd as operator of the project.
This policy explains what personal information the Castle of Todd website may handle, why it is handled, and what choices you have. The website is currently informational: it does not provide user accounts, and it does not offer a self-service area where visitors connect their own Google accounts.
Information we collect
We collect as little personal information as the work requires. What we may handle depends on how you interact with us:
- Information you give us. When you submit the contact form, it collects your name, email address, the topic you choose and your message. Submissions are stored so that enquiries are not lost, and a submission may trigger a transactional notification to the operator so it can be read and answered. If you contact us by other means, we receive whatever details you choose to include.
- Information needed to serve and secure the site. A limited amount of technical information may be recorded automatically where the hosting platform provides it, such as basic server log details about a request.
- Google account data. This is covered in its own section below. It is not collected from people who simply visit this website.
We do not use analytics or advertising trackers on this website, so no information is collected for profiling or targeted advertising.
How we use information
Personal information is used only where there is a clear reason to do so, such as:
- responding to an enquiry, message or request
- operating, maintaining and securing the website and the project
- administering necessary communications
- handling access, correction or deletion requests and other privacy matters
- taking steps at the request of someone considering work or services with Castle, where applicable
- understanding general use of the site so it can be kept working and improved, where we have a lawful basis
Legal bases
Where UK data protection law applies, we rely on whichever of the following fits the situation:
- Consent — where you have given it, for example for optional communications.
- Legitimate interests — in operating, securing and improving the website and project, and in responding to people who contact us.
- Steps at your request — taking steps you have asked for before entering into an agreement.
- Legal obligations — where we are required to process information to comply with the law.
Castle of Todd is a small independent project, not a large regulated business. These bases are applied proportionately to the limited information actually involved.
Sharing and service providers
Personal information may be processed on Castle's behalf by hosting, infrastructure, communications or other service providers, and only where necessary to operate the website and the project. Such providers are expected to use information only for the purposes we specify.
Castle of Todd does not sell personal information and does not sell Google user data. We do not share personal information for advertising.
Data retention
Information is kept only for as long as reasonably necessary for the purpose it was handled for — for example to answer an enquiry, to maintain a record needed for security or dispute handling, to meet a legal obligation, or to provide a service that was asked for. When information is no longer needed for those purposes, it is deleted or made anonymous where practical.
Security
Reasonable technical and organisational measures are used to protect information. No method of storage or transmission is completely secure, so measures are kept proportionate to the information involved.
Cookies and analytics
This website currently does not use analytics, advertising trackers or tracking cookies.
Where technical storage is strictly necessary to deliver the site, or a feature you have asked for, it may be used — for example basic functionality provided by the hosting platform. We do not set cookies for advertising or cross-site tracking. If this changes, this policy will be updated and consent will be requested where it is required.
Your privacy rights
Under UK data protection law you may have some or all of the following rights, depending on the situation and the information involved:
- to be told how information about you is being used
- to access a copy of personal information we hold about you
- to have inaccurate information corrected
- to have information erased, where there is no overriding reason to keep it
- to restrict or object to certain processing
- to data portability, where it applies
- to withdraw consent, where processing is based on consent
These rights are not absolute and may not apply in every case. To make a request, use the contact details below. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office, at ico.org.uk.
International processing
Some of the service providers used to operate the website and the project may process information outside the United Kingdom. Where the law requires it, appropriate safeguards are expected to be in place for such processing. The providers used can change as the project develops, so this policy does not list them individually.
Google API and Gmail use
Castle of Todd uses authorised Google services, including Gmail, as part of its own operational workflows. This access relates to the operator's own authorised account or accounts — not to the Google accounts of people who visit this website.
Depending on the OAuth permissions configured for the authorised account, the system may access relevant email metadata, message and thread content, and draft information, and may perform permitted email actions such as creating drafts or sending authorised messages. Access is limited to what the configured workflow needs.
This information is used only for Castle's own operational functionality. It is not sold and it is not used for advertising. Google Workspace user data obtained through Google APIs is not used to train or improve general-purpose or foundational AI models.
Castle of Todd's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
OAuth credentials and tokens are treated as private authentication data and are not intentionally made public.
If you have connected a Google account to Castle, you can revoke that access at any time through your Google Account security settings, under third-party connections (myaccount.google.com/connections).
Contact and data requests
Questions about this policy, and requests to access, correct or delete personal information, are welcome. Please use the contact form.
We may need to verify your identity before acting on a request, and we may need to keep limited records where there is a legitimate reason to do so.
Changes to this policy
This policy may be updated as Castle develops, for example when new features, services or integrations are added. The date shown above is when it was last revised, and the current version will always remain available on this page.