Privacy, plainly

Plainly Innovate Ltd (company no. 17317719, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ) is the data controller for personal information collected through this site, under the UK GDPR and the Data Protection Act 2018. It is registered with the Information Commissioner's Office, registration reference ZC202529. Questions and requests: hello@plainlyinnovate.com.

The discovery form collects your name, email, phone number (if you give it), preferred contact time and what you tell us about your project. When you send it, we email you a copy of your answers. We use this to reply to you and, if we work together, to prepare and deliver the work. The lawful basis is taking steps at your request before entering a contract, and our legitimate interest in responding to enquiries. We do not currently run analytics. If that changes, it will only be with your consent via the cookie banner, and limited to anonymised data (pages visited, rough location, device type).

The assistant on the demos page sends the questions you type to Anthropic, whose AI model (Claude) writes the answers. Anthropic processes them on our behalf under its commercial terms, which do not allow it to train its models on them. We keep a trimmed copy of each question, with your IP address, for up to 30 days, to stop abuse and to improve the answers; the conversation itself stays in your browser tab and is gone when you close it. Please don't type personal or sensitive details into it. The lawful basis is our legitimate interest in answering your questions and protecting the service from abuse. The assistant and the discovery form both use Cloudflare Turnstile to check that you're not a bot.

Nobody buys or borrows your data. It is processed by the tools this business runs on, acting under contract: website hosting, bot protection and sending enquiry emails (Cloudflare), the AI model behind the site assistant (Anthropic), our CRM, email, scheduling and, for clients, invoicing and payments (for example Stripe or GoCardless). Some providers process data outside the UK; where they do, transfers are covered by UK adequacy decisions or the standard safeguards (IDTA / standard contractual clauses).

Enquiries that don't become projects: up to 24 months, then deleted. Client records: six years after the engagement ends, because tax law requires it. Should analytics be added later, that data would be kept per the periods set in that tool, and would not be tied to your identity.

You can ask for a copy of your data, ask us to correct it, delete it, restrict how it's used, object to our use of it, or ask for it in a portable format. Email hello@plainlyinnovate.com and it will be handled within a month. If you're unhappy with how we've dealt with your data, you can complain to the Information Commissioner's Office at ico.org.uk.