Privacy

How I handle your details.

Short version: I collect only what you give me when you send a brief or book a call, I use it to reply and to work with you, I don't sell it, and this site has no analytics, no advertising trackers and no cookies. The detail is below.

Last updated 12 October 2026

Who I am

The Extra Loaf is run by Ragesh, a sole trader, trading as The Extra Loaf and based in India. I work with clients in the UK, India and elsewhere. I decide what happens to the details you send me, which makes me the “controller” (UK GDPR) and the “data fiduciary” (India’s Digital Personal Data Protection Act 2023, DPDP Act).

Contact for anything on this page, including requests and complaints: hello.theextraloaf@gmail.com.

What I collect, and why

WhenWhatWhy, and my legal basis

You send a briefYour name or brand, your email or Telegram handle, and your message.To reply and to scope the work you asked about. Basis: taking steps at your request before a contract, and my legitimate interest in answering enquiries.

You book a callYour name, email, the time you pick, and anything you add to the booking.To hold the call. Same basis as above.

You email or message meWhatever you send, and your address or handle.To respond and, if we work together, to deliver and invoice. Basis: contract, and my legitimate interest.

You visit the siteThe hosting provider’s standard server logs: your IP address, browser, the page requested and the time.To deliver the site, keep it secure and fix faults. Basis: legitimate interest.

If we work together, I also keep what I need to do the job and the paperwork: project files, invoices and payment records. I do not collect more than that, and I do not ask for sensitive information (health, beliefs and the like). Please don’t put any in a brief.

You don’t have to give me any of this. Without it I just can’t reply to you.

Cookies and what your device stores

This site sets no cookies and has no analytics, advertising or tracking tools. It loads its fonts from its own server, so your browser does not contact Google Fonts.

One small note is kept in your browser’s session storage, to remember that the opening animation has already played. It stays on your device, holds no personal details and disappears when you close the tab.
Prices show in rupees or pounds depending on your device’s time-zone setting. This is worked out in your browser and is not stored or sent anywhere.
Nothing from Cal.com is loaded until you click a booking button. When you do, Cal.com’s booking window loads from their servers and they may set their own cookies, which they explain in their privacy policy.
The brief form uses hCaptcha, through Web3Forms, to tell people from bots. It only loads when you start filling in the form, not when you visit the page. hCaptcha may use cookies and collect technical details from your device for that purpose, as described in their privacy policy.

Links to Instagram and LinkedIn just take you to those sites. Once you are there, their own policies apply.

Who else handles your details

I use a few services to run this. They handle your details for me, on my instructions, and for no purpose of their own:

Web3Forms carries your brief from the form to my inbox.
Google (Gmail) is where those briefs, and any emails you send me, arrive and are stored.
Cal.com runs the booking calendar, if you use it.
Vercel hosts the website and keeps the server logs.
hCaptcha checks that a form is sent by a person, when you use the brief form.

I don’t sell your details or share them for advertising. I may have to disclose them if the law requires it.

Because I am based in India, your details are handled here as well as wherever the services above store them, which includes the United States and other countries. Where that happens I rely on the safeguards each provider offers, such as approved standard contract terms and the UK–US data bridge where available.

How long I keep it

Enquiries that don’t lead to work: 12 months, then deleted. If you get back in touch about new work, that starts a fresh 12 months. Otherwise they are not kept longer.
Clients: project files for the length of the work plus 2 years; invoices and payment records 6 years, because tax rules require it.
Server logs: kept by the hosting provider for a short period under its own settings.

Your rights

Under UK GDPR you can ask me to give you a copy of your details, correct them, delete them, restrict how I use them, hand them to you in a portable form, or stop using them where I rely on legitimate interest. Under the DPDP Act you can ask for a summary of your details, to have them corrected, updated or erased, and you can name someone to act for you if you cannot. You can also withdraw any consent you have given, at any time.

Email hello.theextraloaf@gmail.com and say what you want. I may need to check it is really you, and I will reply within one month (longer only if your request is complicated, and I will tell you why).

Complaints. Please write to me first so I can put it right. This email is also my point of contact for grievances. If you are in the UK you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint. In India, once the Data Protection Board of India is taking complaints, you can complain there after you have tried me.

Other things

This site is for businesses and adults, not children. I keep details safe with HTTPS and by limiting who can see them: it is just me. If something goes wrong with your details, I will tell you and the regulator as the law requires.

If this page changes in a way that matters, I will update the date at the top.