Your data,
handled with care.

International data transfers

We are based in the United Kingdom and host production infrastructure in the UK or EEA wherever practical. Some sub-processors (notably Cloudflare, Microsoft and certain AI services) may process data in countries outside the UK, including the United States. Where that happens we rely on appropriate safeguards (UK/EU adequacy regulations where they exist, the UK International Data Transfer Addendum, or the EU Standard Contractual Clauses) together with supplementary measures such as encryption in transit and access controls.

Data security

We operate a UKAS-accredited ISO 27001 certified information-security programme with technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage:

• Encryption of data in transit (TLS) and at rest.
• Role-based access control and least-privilege by default.
• Centralised logging, monitoring and alerting.
• Annual independent penetration testing.
• Regular backups, disaster-recovery testing and change management.
• Security training and background checks for our people.

Data retention

We keep personal data for as long as we genuinely need it, and no longer than is proportionate. In practice:

• Records of your interactions with us: demo submissions, enquiries, meeting notes and email exchanges are held in our internal business systems (CRM, mailbox, collaboration tools) for as long as the relationship or enquiry is relevant. Individual records may be retained indefinitely as part of normal record-keeping, but we will not actively re-use them once they stop being relevant to a live or realistic future conversation.
• Demo call recordings and transcripts: typically removed once they're no longer useful for support, quality review or debugging.
• Careers applications: retained for as long as the role is open, plus a reasonable period afterwards; longer only if you've asked us to keep your details on file.
• Rate-limit counters and short-lived security tokens: kept in memory for up to one hour.
• Server and security logs: typically 90 days, longer if needed for an incident investigation or legal reason.
• Accounting and tax records: at least six years, as required by UK law.

You can ask us to delete your data at any time. We will delete or anonymise it in the systems we control and stop relying on it for any further contact. Where the data is embedded in ongoing correspondence or held by third-party tools, we'll remove it as far as reasonably possible as part of normal record-management.

Cookies

Our website uses a small number of essential and (with your consent) analytics cookies. See our Cookies Policy for the full list and how to change your preferences at any time.