Privacy Policy

What We Collect

When you download a resource, request a demo, subscribe to our newsletter, or contact us through the website, we collect:

• Your name
• Your email address
• Your company or building name (optional)

This information is submitted by you through our lead capture forms. We do not collect data from third-party sources.

Why We Collect It

We process your data on the basis of legitimate interest (Article 6(1)(f) UK GDPR). You initiate contact by requesting a resource, demo, or subscribing to our newsletter. We use your information solely to fulfil that request and to send relevant follow-up content.

How We Use Your Data

• Resource delivery — sending the document you requested to your email address
• Drip email sequences — a short series of educational emails related to the resource you downloaded
• Newsletter — monthly regulatory updates if you subscribe
• Demo scheduling — responding to your demo request
• Contact enquiries — replying to messages you send through our contact form

Every marketing email includes an unsubscribe link. You can opt out at any time.

Who Processes Your Data

We use the following third-party processors to operate this website and deliver our services:

• Supabase — database hosting (stores your contact details securely)
• Resend — email delivery (sends resources, drip emails, and newsletters)
• Cloudflare — website hosting and CDN (serves the website and processes form submissions)
• PostHog — cookieless analytics (aggregated page view statistics only; no cookies, no personal tracking)

We do not sell, rent, or share your personal data with any other third parties.

How Long We Keep It

We retain your data for 24 months from your last interaction with us (based on the last-updated timestamp on your record). After 24 months of inactivity, your data is permanently deleted.

You can request earlier deletion at any time by contacting us.

Your Rights

Under UK GDPR, you have the right to:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data
• Restriction — ask us to limit how we process your data
• Portability — request your data in a machine-readable format
• Objection — object to our processing of your data

To exercise any of these rights, email us at the address below. We will respond within 30 days.

Cookies

We do not use cookies for analytics or tracking. Our analytics tool, PostHog, runs in cookieless mode (persistence: 'memory'), which means no data is stored on your device. No cookie consent banner is needed.

Cloudflare may set strictly necessary cookies for security purposes (such as bot protection). These do not track you and do not require consent under UK GDPR.

How to Contact Us

For any data-related requests, questions about this policy, or to exercise your rights, email us at: [email protected]

We handle all requests manually at our current scale and aim to respond within 30 days.

Changes to This Policy

We may update this privacy policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. We encourage you to review this policy periodically.