Privacy Notice

Introduction

This privacy notice explains how Wildmore Labs collects, uses and protects personal data when you visit wildmorelabs.com or contact us through the website. It is provided in accordance with Article 13 of the UK GDPR and the Data Protection Act 2018.

1. Who we are (the controller)

Wildmore Labs Ltd is a UK software company registered in England & Wales. We are the data controller for the personal data described in this notice.

• Legal name: Wildmore Labs Ltd
• Trading name: Wildmore Labs
• Legal status: Private limited company (England & Wales)
• Company registration number: 17356995
• Registered office: 14 Manor Road, Newton Abbot, Devon, TQ12 1SN, United Kingdom
• ICO registration number: ZC206300
• General contact: info@wildmorelabs.com
• Privacy / data-protection contact: privacy@wildmorelabs.com

We are not required to appoint a statutory Data Protection Officer under Article 37 UK GDPR. You can reach our Data Protection Lead at privacy@wildmorelabs.com.

2. What personal data we collect

We collect only the data you actively choose to give us. We do not use advertising or cross-site tracking technologies, and we do not build profiles of visitors. We use Vercel Analytics for site-performance monitoring — it does not set cookies and collects only aggregated, non-identifying performance data (page load timings, browser type, device type, country).

If you accept analytics cookies via our consent banner, we also collect anonymised usage data through Google Analytics 4: pages visited, interaction events (such as link clicks), session duration, approximate geographic location (country and city — derived from your IP address; Google does not store the raw IP address), browser type, and device type. Google Analytics 4 does not receive your name, email address, or any other directly identifying information. Analytics data is only collected after you give explicit consent, and you may withdraw consent at any time via the Manage cookie preferences link in the footer.

When you use our contact form, we collect:

• your name;
• your email address;
• your company or organisation name (where you provide it);
• the contents of your enquiry, including any details you choose to include (for example a project outline or an existing-engagement reference).

We also process your IP address transiently for the technical delivery and security of the website (see section 6). We do not use it to identify you.

We do not intentionally collect special category data (Article 9 UK GDPR). Please do not include sensitive personal information in your enquiry.

Providing your details via the contact form is voluntary. If you choose not to provide your name and email address, we will be unable to respond to your enquiry.

The following applies only to Wildmore Labs' own directors and authorised team members using our internal AI voice assistant — if you are a general visitor to this site, it does not apply to you, and you can skip ahead to section 3 below.

If you are a director or other authorised member of our team using our internal AI voice assistant, we additionally collect:

• Voice audio — captured for wake-word detection and speech-to-text transcription. This is processed on-device only, in memory, and is not stored — it is transcribed and then discarded.
• Transcribed speech and AI conversation content — the text of spoken commands and the assistant's replies. This is sent to our AI processor (Anthropic) for processing, and an excerpt (up to the first 200 characters of your query and the first 500 characters of the response) is kept in our internal operational logs (see sections 5 and 6 below).
• Voice profile settings — your work email address and your display name, as registered in our internal directory (part of our Microsoft 365 service), together with your personality and voice-synthesis preferences, including a short free-text field for how the assistant should address you (for example a first name, or a chosen title).
• Screenshots — on request, a full capture of your desktop screen, taken to give the assistant visual context. This is stored in our internal screenshot log and sent to our AI processor as part of the AI prompt.
• Images and documents you attach — where a director or authorised team member attaches, pastes or drops an image or PDF into the assistant, that file is stored on our internal system and sent to our AI processor as part of the AI prompt.
• Email content and metadata — where the assistant is asked to work with our monitored mailboxes (sales@wildmorelabs.com, info@wildmorelabs.com), the sender, subject and body of the relevant emails, accessed via our Microsoft 365 email service (see sections 6 and 7 below). This is processed in memory only and is not stored beyond the current session.
• Jira issue titles — where the assistant is asked to create a tracked task, a truncated version of your spoken query (up to 200 characters) is created as the title of a Jira issue via the Atlassian API, for internal mission tracking. This is stored in our Atlassian Jira instance (see sections 6 and 7 below).
• Connection metadata — technical connection identifiers used to route your session with the assistant. This is held in memory only for the duration of the session and is not stored.

This tool is used internally by Wildmore Labs' own directors and authorised personnel to help run the business — it is not a feature available to website visitors or clients, and it plays no part in handling your contact form enquiry. If a third party's name or other personal details are mentioned in a voice command, email, or screenshot processed this way, that information is processed in the same way as described above.

3. How we use your data, and our lawful basis

Our legitimate-interests basis for handling enquiries is supported by a documented Legitimate Interests Assessment (LIA). You may request a summary from privacy@wildmorelabs.com.

We do not use your details for marketing, and we do not sell or share them for anyone else's marketing.

4. How the contact form works

When you submit the contact form, your details are emailed to one of our shared mailboxes (routed by enquiry type — for example info@, sales@, support@, accounts@, privacy@ or security@) so that we can read and reply to it. A copy is also BCC'd to our central enquiries@wildmorelabs.com mailbox, an internal shared mailbox we use for operational record-keeping so every submission is visible in one place regardless of routing. This is done through our Microsoft 365 email service.

Storage of enquiries in a CRM system is a planned future feature and is not yet live. This notice will be updated before any such storage begins. At present, enquiry data lives only in the relevant email mailbox.

5. How long we keep it

6. Our processors (who we share your data with)

We keep your data within Wildmore Labs and a small number of trusted service providers who act as our processors, processing personal data only on our instructions and subject to a data processing agreement. You may request details of any agreement from privacy@wildmorelabs.com.

• Microsoft Corporation (Microsoft 365) — provides our email service. Contact-form enquiries are delivered and stored via that service. Microsoft 365 is also the platform through which our internal AI voice assistant accesses our monitored mailboxes when a director or authorised team member asks it to work with email (see section 2 above) — never in connection with the website contact form. Microsoft operates an EU Data Boundary for its enterprise cloud services; where any data flows outside the EU/UK, the UK Addendum to the EU Standard Contractual Clauses applies.
• Vercel, Inc. — hosts this website and runs the serverless function that processes contact-form submissions, and provides Vercel Analytics for site-performance monitoring. Vercel is based in the United States; transfer is covered by the UK–US Data Bridge and/or the International Data Transfer Agreement (IDTA). See section 7.
• The following three processors (Anthropic, ElevenLabs and Atlassian) are used only in connection with our internal AI voice assistant — if you are a general visitor to this site, none of them process your data.
• Anthropic, Inc. — provides the AI language model that powers our internal AI voice assistant, used only by our own directors and authorised personnel to help run the business (see section 2 above). Anthropic receives the transcript/conversation content and, where captured, screenshots or attached images/documents described in section 2. Your personality preference settings (also described in section 2) are also sent to Anthropic: we send a short, plain-language summary of your style preferences (for example, how much humour or formality to use, and your chosen form of address) as context for each message, so the assistant's reply matches your chosen style. The stored profile record itself is not sent to Anthropic, only this style summary. Anthropic never receives anything you submit through the website contact form, and the assistant is not a feature available to website visitors or clients. We use Anthropic only for this internal assistant. We would not use it for any commercial or customer-facing purpose without first completing a further data-protection review and updating this notice. Anthropic is based in the United States; transfer relies solely on the UK International Data Transfer Agreement (IDTA), as Anthropic does not hold UK–US Data Privacy Framework certification. Data use, including any restrictions on training, is governed by our Data Processing Agreement with Anthropic (available on request).
• ElevenLabs, Inc. — provides the voice-synthesis (text-to-speech) technology used by our internal AI voice assistant, described in section 2 above. ElevenLabs receives only the text to be spoken and the voice identifier a user has selected; it does not receive personality preference settings. This processing happens only when a director or authorised team member uses the internal assistant, never when you use the website contact form. ElevenLabs is based in the United States; transfer relies primarily on the UK Extension to the EU-U.S. Data Privacy Framework (UK–US Data Bridge), with the UK Addendum to the EU Standard Contractual Clauses as a secondary backstop.
• Atlassian, Inc. — provides Jira, our internal project-tracking system. When you ask the assistant to create a tracked task, a truncated version of your spoken query (up to 200 characters) is created as the title of a Jira issue via the Atlassian API — only the issue title, not the full transcript or conversation content, and never anything you submit through the website contact form. This happens only when a director or authorised team member uses the internal assistant. Atlassian is based in the United States and Australia; transfer relies on Atlassian's Data Processing Addendum, which applies the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum for transfers from the UK, supplemented by Atlassian, Inc.'s certification under the UK Extension to the EU-U.S. Data Privacy Framework.
• Google LLC (Google Analytics 4) — provides analytics services when you consent to analytics cookies. Google Analytics 4 collects anonymised usage data (pages visited, events, approximate location derived from IP address — the raw IP is not stored — browser and device type). Google is based in the United States; transfer is covered by the UK–US Data Bridge (Google LLC is certified under the UK Extension to the EU–US Data Privacy Framework) and/or the International Data Transfer Agreement (IDTA). Analytics data is processed by Google only where you have consented to analytics cookies. Google's privacy policy: policies.google.com/privacy.

We may also disclose data where required by law, or to establish, exercise or defend legal claims.

7. International transfers

Some of our providers process data outside the UK, including Vercel, Inc. and Microsoft.

The following covers only the international transfers made by our internal AI voice assistant (Anthropic, ElevenLabs and Atlassian) — if you are a general visitor to this site, none of them process your data.

In addition, Anthropic, Inc., ElevenLabs, Inc. and Atlassian, Inc. process data in the United States (and, for Atlassian, also Australia) in connection with our internal AI voice assistant, used only by our own directors and authorised personnel (see section 6 above) — never in connection with the website contact form. Anthropic receives the transcript/conversation content and, where captured, screenshots or attached images/documents (see section 6 above), together with a short summary of your style preferences; the stored profile record itself is not sent to Anthropic. Atlassian's processing is limited to a truncated Jira issue title derived from a voice query, not the full transcript or conversation content. Anthropic's transfer relies solely on the UK International Data Transfer Agreement (IDTA), as Anthropic does not hold UK–US Data Privacy Framework certification. ElevenLabs' transfer relies primarily on the UK Extension to the EU-U.S. Data Privacy Framework (UK–US Data Bridge), with the UK Addendum to the EU Standard Contractual Clauses as a secondary backstop. Atlassian's transfer relies on Atlassian's Data Processing Addendum, which applies the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum for transfers from the UK, supplemented by Atlassian, Inc.'s certification under the UK Extension to the EU-U.S. Data Privacy Framework.

Google LLC processes analytics data in the United States where you consent to analytics cookies; transfer is covered by the UK–US Data Bridge (Google LLC is DPF-certified) and/or the IDTA. Where personal data is transferred outside the UK, we rely on an appropriate safeguard under Article 46 UK GDPR — the UK–US Data Bridge where the provider is certified, and/or the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard applying to a particular transfer.

8. Your rights

Under the UK GDPR you have the right to:

• be informed about how we use your data (this notice);
• access the personal data we hold about you;
• rectify inaccurate or incomplete data;
• erase your data ("right to be forgotten"), where applicable;
• restrict or object to our processing, including processing based on legitimate interests;
• data portability, where applicable; and
• withdraw consent at any time where we rely on consent (we generally do not).

To exercise any of these rights, email privacy@wildmorelabs.com. We will respond within one month. There is normally no charge.

We do not use your personal data for solely automated decision-making, including profiling, that produces legal or similarly significant effects on you (Article 22 UK GDPR).

9. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at privacy@wildmorelabs.com so we can try to put it right. You also have the right to complain to the UK supervisory authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk · Helpline: 0303 123 1113

10. Changes to this notice

We may update this notice from time to time. The "last updated" date at the top shows when it last changed. Material changes affecting how we use your data will be reflected here before they take effect.