Privacy policy

1. Who we are

VectisFlow Limited is a software studio providing bespoke software and practical digital improvements for businesses, registered in England and Wales, company number 14990157, registered office 43 Fairfoot Rd, London E3 4EG. For personal data collected through this website we are the data controller.

For anything in this notice, or to exercise any of the rights described in section 8, contact hello@vectisflow.com.

We have not appointed a Data Protection Officer. On the processing described here we are not a public authority, we do not monitor individuals on a large scale, and we do not process special category data at scale, so the conditions in Article 37 are not met. We keep that assessment under review as the business grows.

2. What we collect

Only what we need in order to reply to you and to keep the site working. We do not buy personal data, we do not enrich what you give us from third-party sources, and we do not build profiles.

• Enquiry data: the name, email address and message you submit through the contact form, plus organisation and role if you choose to give them. Those two fields are optional and marked as such. As with the estimate tool, we derive pseudonymised (hashed) keys from your IP address and email address for rate limiting.
• Application data: if you apply through the careers page, your name, email address, the kind of work you do, where you are based, the message you write, and a portfolio or profile link if you choose to give one.
• Consent data: your cookie choices and the date you made them, stored in your browser's local storage under the key bc-consent-v1. This never leaves your device unless you submit an enquiry.
• Technical data: IP address, user agent and requested URL, recorded in our hosting provider's server logs and used only to keep the site available and secure.
• Estimate tool data: if you use the estimate tool, the business type, the tasks and options you select, the optional "anything else" note, your name and email address, and your consent. We also derive a pseudonymised (hashed) key from your IP address and another from your email address, used only for rate limiting. A hash can in principle be matched back to a known value, so we still treat these keys as personal data. If you use the estimate assistant, the messages you type and the summary it produces.
• Booking data: if you book a discovery call, the name, email address and any notes you give in the booking calendar, and the time you choose. The calendar is provided by Cal.com and loads with the contact, booking and estimate pages.
• Analytics data: only if you accept analytics in the cookie controls. Vercel Web Analytics then records the pages you view, the page that referred you, your country, browser and device type, and four events: starting an estimate, finishing an estimate, sending a message and booking a call. It sets no cookies and does not identify you. It stays off until you accept, and you can switch it off at any time.

3. Business contacts we approach

We sometimes contact people at limited companies and LLPs about our services. We collect their name, role, work email, work phone and public professional profile from the company's own website, Companies House and public business profiles. We do not buy contact lists. Our lawful basis is legitimate interests (Article 6(1)(f)): telling businesses about services relevant to them. We keep these details for up to 12 months from our last contact unless you become a client. You can ask us to stop at any time by replying 'no thanks' or emailing us, and we will add you to a do-not-contact list so you are not contacted again. Our outbound email is sent through Smartlead (USA) under UK transfer safeguards, and replies may be sorted by an AI model through Vercel's AI Gateway on US servers that keep no copy of the text and do not train on it; our records are stored with Neon in London. Our emails record whether a link in them was clicked, so we know who to follow up with; they do not track whether an email was opened. You can ask us to stop at any time.

4. Why we use it, and our lawful basis

Under Article 6 of the UK GDPR we rely on the following:

• Replying to your enquiry: legitimate interests, Article 6(1)(f). Our interest is in responding to someone who has approached us about our services. The processing is what you would expect, it is minimal, and it is easy to object to. A legitimate interests assessment supporting this is retained and available on request.
• Keeping a record of enquiries that become engagements: necessary for the performance of a contract, Article 6(1)(b), and thereafter legal obligation, Article 6(1)(c), for accounting records.
• Considering your application to work with us: steps taken at your request before entering into a contract, Article 6(1)(b). Keeping it for 12 months to match you to future projects: consent, Article 6(1)(a), given with the tick box on the form and withdrawable at any time by emailing hello@vectisflow.com.
• Keeping the site secure and available: legitimate interests, Article 6(1)(f), covering server logs and abuse prevention.
• Sending you an estimate and replying to it: steps taken at your request before entering into a contract, Article 6(1)(b).
• Rate limiting the estimate tool and the contact and careers forms, to stop abuse and keep them available: legitimate interests, Article 6(1)(f), using only the pseudonymised (hashed) IP address and email address keys.
• Booking a discovery call: steps taken at your request before entering into a contract, Article 6(1)(b).
• Analytics: consent, Article 6(1)(a), withdrawable at any time through the cookie controls.

5. Who we share it with

We do not sell personal data, and we do not share it for advertising or profiling under any circumstances.

Enquiry and application data reach our processors, each engaged under a written data processing agreement: Vercel, which hosts this site and keeps its server logs; Resend, which delivers the emails sent from the contact, careers and estimate forms; Upstash, which holds the pseudonymised rate limiting keys; and the provider that hosts our mailbox and holds our correspondence.

For the estimate tool, our processors are Vercel (hosting), Resend (delivery of the estimate email and our notification of it) and Upstash (rate limiting, which stores only pseudonymised (hashed) keys, not your IP address or email address in readable form; we still treat these keys as personal data).

The estimate assistant sends your messages to an AI model through Vercel AI Gateway. The model runs on US-hosted providers that keep no copy of your messages and do not use them for training. The assistant only suggests tasks; it does not set the price.

Bookings are handled by Cal.com, which provides the booking calendar, stores the booking and sends the calendar invite on our behalf.

If you accept analytics, Vercel (Vercel Web Analytics) processes the analytics data described above.

Sanity, which hosts the articles on this site, receives no visitor data. There is no CRM, no marketing automation platform and no advertising processor in the path. Nothing else receives your data.

6. International transfers

Several of our processors are United States companies that process personal data in the United States: Vercel (hosting and server logs), Resend (email delivery), Cal.com (bookings) and the AI model hosts behind the estimate assistant.

Where a processor operates outside the UK, we rely on UK adequacy regulations where they apply, including the UK Extension to the EU-US Data Privacy Framework for certified US companies, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, supported by a transfer risk assessment. We do not use a processor that cannot meet one of those routes.

7. How long we keep it

We do not keep personal data for longer than we need it.

• Enquiries that do not lead to an engagement: 24 months from your last contact with us, then deleted. Long enough to recognise you if you come back, short enough not to be a standing liability.
• Enquiries that become engagements: retained for the life of the contract and for six years afterwards, in line with the limitation period and our accounting obligations.
• Applications: 12 months from the date you apply, then deleted, unless you start working with us or ask us to delete it sooner.
• Estimate emails: kept as enquiries, on the same terms as above (24 months from your last contact with us if no engagement follows).
• Rate limiting keys, for the estimate tool and the contact and careers forms: the pseudonymised (hashed) IP address key expires after 1 hour and the pseudonymised (hashed) email address key after 24 hours.
• We do not keep a separate lead database. The estimate you request exists as the emails sent, and nowhere else.
• Server logs: kept by our hosting provider for no more than 30 days.
• Consent records: 24 months from the date the choice was made, after which we ask again.

8. How we protect it

The site is served over HTTPS only. Enquiry data is transmitted over TLS and stored in access-controlled systems. Access is limited to the people who need it in order to reply to you, and each account with access is protected by a strong, unique password.

Apart from the Cal.com booking calendar described in section 4, this site loads no third-party scripts, fonts or media, which removes an entire class of data leakage that most marketing sites carry.

The controls described here are the same ones set out in the security schedule we use in client contracts, so a procurement reviewer will not find two different accounts of the same measures.

9. Your rights

Under the UK GDPR you have the right to be informed about how we use your data, to request a copy of it, to have inaccurate data corrected, to have data erased, to restrict how we use it, to object to processing based on legitimate interests, and to data portability. Where we rely on consent, you can withdraw it at any time and as easily as you gave it.

To exercise any of these, email hello@vectisflow.com. We will respond within one month. We will not charge you, and we will not ask you to justify the request.

If you object to us processing your enquiry under legitimate interests, we will stop unless we have compelling grounds not to. In practice that means we will delete it and not reply further.

10. Automated decision-making

We do not make decisions about you by solely automated means, and we do not carry out profiling, on this website.

The estimate assistant suggests tasks from your answers, you check and change them, and fixed rules then turn the tasks into a range for the project. It is a calculation about the project, not a decision about you, and it has no legal or similarly significant effect on you. A person confirms the price on a free discovery call.

11. Cookies and similar technologies

Before you make a choice, the only storage set is what the site and the Cal.com booking calendar strictly need. Nothing non-essential is stored unless you opt in. Details are in the cookie policy, including how to change your mind.

12. Complaints

If you are unhappy with how we have handled your data, please tell us first at hello@vectisflow.com so we can put it right.

You also have the right to complain to the Information Commissioner's Office at ico.org.uk, by calling 0303 123 1113, or by writing to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

13. Changes to this notice

We will update this notice when our processing changes, and record the date of the most recent change at the top of this page. Where a change materially affects you, we will say so rather than relying on you to notice.