Legal

Privacy Notice

Last updated: 20 July 2026

This privacy notice explains how Wildmore Labs collects, uses and protects personal data when you visit wildmorelabs.com or contact us through the website. It is provided in accordance with Article 13 of the UK GDPR and the Data Protection Act 2018.

1. Who we are (the controller)

Wildmore Labs is a UK software studio operated by Darren Wilde. We are the data controller for the personal data described in this notice.

  • Trading name: Wildmore Labs
  • Legal status: Private limited company
  • Company / registration number (if incorporated): 17356995
  • Registered / service address: 14 Manor Road, Newton Abbot, Devon, TQ12 1SN, United Kingdom
  • ICO registration number: [PLACEHOLDER — ICO registration reference]
  • General contact: info@wildmorelabs.com
  • Privacy / data-protection contact: privacy@wildmorelabs.com

We are not required to appoint a statutory Data Protection Officer under Article 37 UK GDPR. You can reach our Data Protection Lead at privacy@wildmorelabs.com.

2. What personal data we collect

We collect only the data you actively choose to give us. We do not use advertising or cross-site tracking technologies, and we do not build profiles of visitors. We use Vercel Analytics for site-performance monitoring — it does not set cookies and collects only aggregated, non-identifying performance data (page load timings, browser type, device type, country).

When you use our contact form, we collect:

  • your name;
  • your email address;
  • your company or organisation name (where you provide it);
  • the contents of your enquiry, including any details you choose to include (for example a project outline or an existing-engagement reference).

We also process your IP address transiently for the technical delivery and security of the website (see section 6). We do not use it to identify you.

We do not intentionally collect special category data (Article 9 UK GDPR). Please do not include sensitive personal information in your enquiry.

Providing your details via the contact form is voluntary. If you choose not to provide your name and email address, we will be unable to respond to your enquiry.

3. How we use your data, and our lawful basis

Purpose Lawful basis (UK GDPR Article 6)
Receiving and responding to your enquiry Legitimate interests — Art. 6(1)(f): responding to business enquiries addressed to us
Carrying out an engagement, if you become a client Contract — Art. 6(1)(b): steps taken at your request and performance of the agreement
Keeping records to meet legal, accounting and tax obligations Legal obligation — Art. 6(1)(c)
Protecting the website against abuse (rate-limiting, anti-spam) Legitimate interests — Art. 6(1)(f): network and information security

Our legitimate-interests basis for handling enquiries is supported by a documented Legitimate Interests Assessment (LIA). You may request a summary from privacy@wildmorelabs.com.

We do not use your details for marketing, and we do not sell or share them for anyone else's marketing.

4. How the contact form works

When you submit the contact form, your details are emailed to one of our shared mailboxes (routed by enquiry type — info@, sales@, support@, accounts@, privacy@ or security@) so that we can read and reply to it. A copy also goes to our central enquiries@ mailbox. This is done through Microsoft Graph on our Microsoft 365 email service.

Storage of enquiries in a CRM system is a planned future feature and is not yet live. This notice will be updated before any such storage begins. At present, enquiry data lives only in the relevant email mailbox.

5. How long we keep it

Data Retention
Enquiry emails that do not lead to an engagement Deleted within 12 months
Correspondence and records where you become a client Retained for the life of the engagement and then per our retention schedule (generally 7 years for financial and contract records)
Transient IP / security logs Held only as long as needed for security and then discarded

6. Our processors (who we share your data with)

We keep your data within Wildmore Labs and a small number of trusted service providers who act as our processors, processing personal data only on our instructions and subject to a data processing agreement. You may request details of any agreement from privacy@wildmorelabs.com.

  • Microsoft Corporation (Microsoft 365 / Exchange Online) — provides our email service. Contact-form enquiries are delivered and stored via Microsoft Graph / Exchange Online. Microsoft operates an EU Data Boundary for its enterprise cloud services; where any data flows outside the EU/UK, the UK Addendum to the EU Standard Contractual Clauses applies.
  • Vercel, Inc. — hosts this website and runs the serverless function that processes contact-form submissions, and provides Vercel Analytics for site-performance monitoring. Vercel is based in the United States; transfer is covered by the UK–US Data Bridge and/or the International Data Transfer Agreement (IDTA). See section 7.
  • Anthropic, Inc. — provides the AI language model that powers our AI assistant service. Anthropic processes your conversational data only when you use the AI assistant — not when you submit the website contact form. Anthropic is based in the United States; transfer is covered by the IDTA or the UK Addendum to the EU Standard Contractual Clauses. Contractual terms prohibit use of your data for model training.
  • ElevenLabs, Inc. — provides the voice synthesis technology used in our AI assistant service. ElevenLabs processes voice-request data only when you interact with the voice assistant — not when you use the website contact form. ElevenLabs is based in the United States; transfer is covered by the IDTA or the UK Addendum to the EU Standard Contractual Clauses.

We may also disclose data where required by law, or to establish, exercise or defend legal claims.

7. International transfers

Some of our providers process data outside the UK, including Vercel, Inc. and Microsoft. In addition, Anthropic, Inc. and ElevenLabs, Inc. also process data in the United States in connection with our AI assistant service, under the IDTA or UK Addendum to the EU Standard Contractual Clauses. Where personal data is transferred outside the UK, we rely on an appropriate safeguard under Article 46 UK GDPR — the UK–US Data Bridge where the provider is certified, and/or the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses. You can ask us for details of the safeguard applying to a particular transfer.

8. Your rights

Under the UK GDPR you have the right to:

  • be informed about how we use your data (this notice);
  • access the personal data we hold about you;
  • rectify inaccurate or incomplete data;
  • erase your data ("right to be forgotten"), where applicable;
  • restrict or object to our processing, including processing based on legitimate interests;
  • data portability, where applicable; and
  • withdraw consent at any time where we rely on consent (we generally do not).

To exercise any of these rights, email privacy@wildmorelabs.com. We will respond within one month. There is normally no charge.

We do not use your personal data for solely automated decision-making, including profiling, that produces legal or similarly significant effects on you (Article 22 UK GDPR).

9. Complaints

If you are unhappy with how we have handled your personal data, please contact us first at privacy@wildmorelabs.com so we can try to put it right. You also have the right to complain to the UK supervisory authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk · Helpline: 0303 123 1113

10. Changes to this notice

We may update this notice from time to time. The "last updated" date at the top shows when it last changed. Material changes affecting how we use your data will be reflected here before they take effect.