Privacy

Last updated: 12 September 2026

Who I am

This notice is for the Jane Upstone website. I am the data controller for personal information sent through this site.

You can contact me through the contact page.

What I hold and why

The public website does not ask you to create an account.

If you use the contact form, I keep the details you send — typically your name, how to reach you, and your message — so I can reply. I do not sell personal information.

How the site is used (Insights)

I collect anonymous figures about how the site is used — which pages and works are opened, which gallery a work was opened from, which other site sent you here (the hostname only), whether you were on a phone, tablet or desktop, roughly which hour of the day, whether you started or sent the contact form, taps on Instagram or Facebook, and how long a page or work stays on screen. This does not identify you, does not use analytics cookies, and is stored separately from the artwork records.

Lawful bases

Under UK GDPR I rely on:

  • Consent, where you tick the box on the contact form and ask me to reply.

  • Legitimate interests in running this website and answering enquiries.

You can object to processing that is based on legitimate interests. See “Your rights” below.

Cookies and similar storage

The public website does not use analytics or advertising cookies.

If you sign in to the editing (admin) area of the site, a session cookie is needed so you stay logged in. That is only for people who have an editor account.

Other organisations I use

Other organisations help run the website:

  • The site is hosted by Vercel.

  • Images and files are stored with Vercel Blob.

  • The database is hosted by Supabase.

They process information on my behalf to provide those services.

If you use a website contact form, Cloudflare Turnstile may run a spam check before the message is sent.

How long I keep information

I keep contact-form messages while I still need them to reply or follow up, and I do not keep them longer than necessary.

Your rights

You have the right to:

  • ask for a copy of the personal information I hold about you (access)

  • ask me to correct it (rectification)

  • ask me to delete it (erasure), in some circumstances

  • ask me to restrict how I use it

  • object to processing based on legitimate interests

  • ask for your data in a portable form, where that right applies

  • complain to the Information Commissioner’s Office (ICO) at ico.org.uk if you are unhappy with how I have handled your information

To exercise any of these rights, use the contact page.