MAKE NOISEMEDIA & MARKETING

PRIVACY NOTICE

Your privacy

Last updated 26 October 2026

This notice explains what personal information Make Noise collects through this website and our marketing service, why we use it, who we share it with, how long we keep it and what your rights are under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Make Noise is a media and marketing business based in Devon, run by founders Dan and Tom. We are the “controller” of the personal information described in this notice.

Questions about privacy or your data: email [email protected].

What we collect and why

When you contact us

If you email us or message us (for example on WhatsApp), we receive your name, contact details, business name and whatever you tell us in your message. We use this to reply, discuss your project and prepare a quote.
Lawful basis: taking steps at your request before a contract, or our legitimate interest in replying to enquiries.

When you are a customer

We keep your contact and business details, information about your business that you give us for your marketing (services, offers, tone, photos and videos), the posts we prepare for you, and a record of what you approved and when. If your business has a private Make Noise dashboard, we keep the email address you use to log in to it.
Lawful basis: performing our contract with you. Accounting records are kept because the law requires it.

When you connect your Facebook Page or Instagram account

Our Meta app, “Make Noise Publisher”, lets us publish posts to a Facebook Page or Instagram business account that its owner has connected. When you connect, Meta gives us an access token for your Page plus your Page and Instagram account IDs. We use these only to publish posts that you (the business owner) have approved, and to read back the published post’s ID and link so we can show you it went out.

  • The token and IDs are stored on our own computer, not in a cloud service, and are never shared or sold.
  • We do not use them to read your private messages, your friends or followers’ personal profiles, or to post anything you haven’t approved.
  • If a post is changed after you approve it, even by one word, it needs approving again before it can be published.

Lawful basis: performing our contract with you. You can remove our access at any time — see Data deletion.

When you visit this website

This website is hosted by Cloudflare. Like any web host, Cloudflare processes technical information such as your IP address, browser type and the pages requested, to deliver the site and protect it from attacks. We don’t run advertising or analytics trackers on this website, and the public pages don’t set cookies. Private pages (such as customer dashboards) use Cloudflare Access for login, which emails you a one-time code and sets a cookie that keeps you logged in; this is strictly necessary for the login to work.
Lawful basis: our legitimate interest in running a secure website.

Filming and photography

If we film or photograph at your business, we may capture images and voices of people. We ask anyone clearly identifiable to give their permission, and we don’t film children without written consent from a parent or guardian.
Lawful basis: consent, or our legitimate interest for people incidentally in the background.

Who we share it with

We never sell personal information. We use a small number of service providers who handle data on our behalf, only to provide our service:

  • Cloudflare — website hosting, security, logins for private pages, and the database we use to manage our work and approvals.
  • Zoho Mail (EU data centre) — our company email.
  • AI assistants — we use AI tools (currently Anthropic’s Claude and OpenAI’s ChatGPT) to help research and draft content. A person checks everything, and nothing is published without your approval.

When we publish to Facebook or Instagram, or when you message us on WhatsApp, Meta handles that information under its own privacy policy as an independent controller. If we start using a scheduling tool (such as Metricool) to connect your accounts, we will update this notice first. We may also share information if the law requires it, and with our accountant and bank for billing.

International transfers

Some of our providers process data outside the UK, for example in the EU or the United States. Where that happens, we rely on the legal safeguards UK law provides, such as UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement/Addendum.

How long we keep it

  • Enquiries that don’t lead to work: up to 12 months after our last contact.
  • Customer records, approvals and invoices: for the length of our contract, then 6 years (for tax and legal reasons).
  • Facebook/Instagram access tokens and account IDs: until you disconnect us, our service ends or you ask us to delete them — then deleted within 30 days.
  • Website technical logs: kept by Cloudflare for its standard periods.

Your rights

You have the right to ask for a copy of your information, to have it corrected or deleted, to restrict or object to how we use it, to have it transferred to you or someone else, and to withdraw consent where we rely on it. Email [email protected] and we’ll reply within one month. To delete data connected to our Facebook/Instagram app, see Data deletion.

Complaints

Please contact us first and we’ll do our best to put things right. You also have the right to complain to the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this notice

We’ll update this page if anything changes and show the new date at the top.