Sections 2, 3, 5 and 11 describe the system precisely and were written from the code. Sections 4, 9 and 10 state UK GDPR positions that need a professional to confirm, and every value marked in red must be completed before this page is published.
01Who controls your data
The data controller is Tiny Bot Labs Limited, registered in England and Wales under company number 14808229, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.
For anything about this policy or your data, write to [email protected].
02What we collect
When you book a call
Booking is handled by Cal.com. Their form asks for your name, your email address, a time, and three questions we added: what your business is called, which job you would hand over first, and which tools your team already uses.
Cal.com sends us the booking and we receive all of it. If you arrived on a link we sent, the campaign reference on that link comes back with the booking, so we can tell which message led to it.
When you simply visit
Our server writes a request log containing a request identifier, the HTTP method, the path, the response status and how long the request took. That is the whole log entry. It contains no IP address, no browser identifier, no cookie and none of your answers.
How we measure whether the site works
We count how many people reach the landing page, open the booking page and reach the calendar. These are counts only, held on our own server, with no profile and nothing that identifies a visitor.
If you arrived from a link we sent you, that link may carry a short campaign reference such as ?r=k3f9. We count visits against that reference so we can tell which of our own campaigns worked, and it travels with your booking if you make one. It contains no information about you, but because we can connect it back to the message we sent, we treat it as personal data and disclose it here rather than calling it anonymous.
Your IP address is used for one purpose only: to build a rate-limiting key so that one source cannot flood the form. The address is immediately turned into an irreversible cryptographic hash, held in memory, and discarded. It is never written to disk and never written to a log.
03What we do not collect
Stated plainly, because most of these are things you would reasonably assume we do collect:
- No advertising or analytics trackers. There is no Google Analytics, no advertising pixel and no third-party tracking script anywhere on this site.
- No phone number. We removed that field from the booking form. We ask your name and email because we cannot hold a meeting with you otherwise, and nothing else about you personally.
- No form before the calendar. There is no questionnaire, and nothing is collected unless you actually book.
- No stored IP addresses. See section 2.
- No profiling and no automated decision-making about you as an individual.
- No sale of personal data. We do not sell it, rent it or share it for anyone else's marketing.
04Why, and on what basis
| What | Why | Lawful basis |
|---|---|---|
| Onboarding answers | To understand your business before we speak, and to prepare for the meeting | Legitimate interests: responding to a business enquiry you started |
| Booking details and your three answers | To hold the meeting you asked for, and to arrive understanding your business | Steps taken at your request before entering a contract |
| Hashed rate-limit key | To stop automated abuse of the form | Legitimate interests: keeping the service available and secure |
| Session cookie | To confirm a submission came from a real session on our own site | Strictly necessary for a service you requested |
| Request logs | To operate and debug the service | Legitimate interests: running the service reliably |
| Funnel counts and campaign reference | To see whether the site and our own campaigns are working | Legitimate interests: understanding whether our marketing is effective |
Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights. You can object at any time using the contact address in section 12.
07Data inside your AI employees
This section is about our customers rather than website visitors. When we build and run AI employees for your business, we handle your business data as a processor acting on your instructions. You remain the controller of that data.
We use AI model endpoints configured so that prompts and outputs are not retained by the model provider and are not used to train their models. The employee reads what it needs to do the job in the moment, and the provider keeps nothing afterwards.
Access is agreed with you before anything is built and is limited to what the role needs. No employee we build has access to payment systems. Anything leaving your business waits for one of your people to approve it.
Where we act as your processor, the terms governing that relationship are set out in our standard data processing agreement, which we provide on request and sign before any build begins.
08How long we keep it
| What | Kept for |
|---|---|
| Your booking and the three answers | 12 months from the booking, then deleted |
| Booking details | Held by Cal.com under their retention policy, and by us for 12 months |
| Deduplication ledger | 24 hours. It holds one-way fingerprints and submission identifiers, never the content of what you submitted. |
| Request logs | 30 days |
| Funnel counts and campaign references | 400 days, then automatically discarded |
| Customer business data | For the life of the service, then as set out in our Terms |
09International transfers
Some of the providers in section 6 are based outside the United Kingdom. Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Addendum to the European Commission standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it, such as the UK International Data Transfer Addendum or an adequacy decision, and we satisfy ourselves that the data receives equivalent protection.
You can ask us for details of the safeguards that apply to a specific transfer.
10Your rights
Under UK data protection law you have the right to:
- ask what personal data we hold about you and get a copy of it
- have inaccurate data corrected
- have data erased, in the circumstances the law allows
- restrict how we use it, or object to us using it under legitimate interests
- receive data you gave us in a portable format
- withdraw consent, where we relied on consent
Write to [email protected] and we will respond within one month. There is no charge.
If you are not satisfied with how we handle it, you can complain to the Information Commissioner's Office at ico.org.uk, or by calling 0303 123 1113. We would rather you came to us first so that we can put it right.
11How we protect it
The short version is on our security page. In summary: everything travels over HTTPS with strict transport security, the site runs under a restrictive content security policy, the form is rate limited using irreversible hashes, submissions are deduplicated using fingerprints rather than content, secrets never reach your browser, and our logs are built so that personal data cannot end up in them.
No system is perfectly secure. If a breach affects your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and we will tell you directly where the law requires it.
12Changes and contact
If we change this policy, the date at the top of the page changes with it. Where a change materially affects you, we will make it obvious rather than quietly updating the page.
Questions, requests and complaints: [email protected], or write to 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.