Privacy Notice
How we collect, use and look after personal data, and the rights you have over it.
Last updated 30 October 2026
The short version
- We use your details to reply to you, to deliver the work you ask for, and to get paid.
- We never sell your data. The services we use to run the business only get what they need.
- Analytics and advertising cookies only load if you accept them.
- You can ask to see, correct or delete your data at any time. Email hello@alur.uk.
1. Who we are
Alur.ai (John Li, sole trader) ("we", "us") is the controller of the personal data described in this notice. We are a web design and bespoke software studio based in Manchester, England, United Kingdom. John runs the business and is responsible for data protection.
Email hello@alur.uk or call 07741 526953 about anything in this notice.
This notice covers people who visit alur.uk, get in touch with us, sign up or become clients, and the business contacts we approach. It does not cover the websites we build for clients: each client is responsible for its own website's privacy notice. Where we host or manage a client's website and it collects data from that client's customers, we handle that data on the client's behalf, as its processor, under our Terms.
2. What we collect and where it comes from
When you use our contact form
Your name, email address and phone number, your business name if you give it, what you need, a rough page count, the features you pick and anything else you write.
When you book a call, WhatsApp, phone or email us
Your name and contact details, the time you book and anything you tell us. Calendly collects the details its booking form asks for. If you message us on WhatsApp we see your number, your WhatsApp name and your messages. We may keep notes of our calls.
When you sign up online
Sign-up happens on Stripe's secure checkout. Stripe collects your name, email address, phone number, business name, billing address and payment details. Your card or bank details go to Stripe, not to us: we only ever see limited details such as the card type and last four digits. We also record that you confirmed you are buying for a business, the version of our Terms you accepted and when, any launch code you used, and the status of your payments and plan.
When you are a client
The content you give us for your website (text, photos, logos and anything else, which may include details about you or your staff), logins you share with us for your domain, hosting or other services, the details a registrar needs to register your domain (such as your name, address, email and phone number), our emails and call notes, and your invoices and payments.
When you visit our website
Like every website, ours is served with technical data such as your IP address, browser and device type, the pages you request, the page you came from and the date and time. Our host, Vercel, keeps these in server logs. If you accept cookies, Google Analytics and the Meta Pixel also collect the pages you visit, how you found us, your rough location (worked out from your IP address), your device, and actions such as sending the contact form or booking a call. If you reject them, they never load. See section 8.
If we contact your business first
We sometimes contact businesses we think could use our services. For this we collect a contact name, role, business name, business address and business email or phone number, and notes about the business. These come from public sources: Companies House, the business's own website or social media pages, and online directories and listing sites (for example Checkatrade or food delivery apps). We record where we found each contact and tell you when we first get in touch. We only email limited companies and LLPs. We contact sole traders and partnerships by phone (after checking the Telephone Preference Service) or in person, never by unsolicited email or text.
We do not ask for sensitive information such as health, religion or ethnicity. Please do not send it to us.
3. Why we use it and our lawful basis
UK GDPR says we need a lawful basis for each thing we do with your data. Here is each purpose and the basis we rely on.
| Purpose | Data | Lawful basis |
|---|---|---|
| Replying to your enquiry, calling you back and holding calls | Contact and enquiry details | Legitimate interests (answering people who ask about our services). Where you are asking about becoming a client, also taking steps you ask for before a contract. |
| Processing your online sign-up, taking payment and starting your plan | Sign-up and payment details | Contract |
| Building, hosting and managing your website, registering your domain, and support | Client and project details | Contract. Where you are a contact at a client business rather than the client itself: legitimate interests (delivering what your business asked for). |
| Keeping accounts and tax records | Invoices, payments, client names and addresses | Legal obligation |
| Keeping our website and systems secure, preventing fraud and fixing faults | Server logs, payment fraud checks | Legitimate interests (running a safe, working service) |
| Measuring how people use our website and how well our ads work | Google Analytics and Meta Pixel data | Consent, given through our cookie banner. You can withdraw it at any time. |
| Contacting businesses that may want our services | Business contact details from public sources | Legitimate interests (finding new clients), weighed against your interests in a written assessment we keep on file |
| Occasional updates about our services | Name and email address | Legitimate interests, and only where electronic marketing law allows it, or with your consent. Every message lets you opt out. |
| Keeping a record of the terms you accepted, handling complaints, and making or defending legal claims | Sign-up records and correspondence | Legitimate interests (protecting our business and showing what was agreed) |
Replying to your enquiry, calling you back and holding calls
- Data
- Contact and enquiry details
- Lawful basis
- Legitimate interests (answering people who ask about our services). Where you are asking about becoming a client, also taking steps you ask for before a contract.
Processing your online sign-up, taking payment and starting your plan
- Data
- Sign-up and payment details
- Lawful basis
- Contract
Building, hosting and managing your website, registering your domain, and support
- Data
- Client and project details
- Lawful basis
- Contract. Where you are a contact at a client business rather than the client itself: legitimate interests (delivering what your business asked for).
Keeping accounts and tax records
- Data
- Invoices, payments, client names and addresses
- Lawful basis
- Legal obligation
Keeping our website and systems secure, preventing fraud and fixing faults
- Data
- Server logs, payment fraud checks
- Lawful basis
- Legitimate interests (running a safe, working service)
Measuring how people use our website and how well our ads work
- Data
- Google Analytics and Meta Pixel data
- Lawful basis
- Consent, given through our cookie banner. You can withdraw it at any time.
Contacting businesses that may want our services
- Data
- Business contact details from public sources
- Lawful basis
- Legitimate interests (finding new clients), weighed against your interests in a written assessment we keep on file
Occasional updates about our services
- Data
- Name and email address
- Lawful basis
- Legitimate interests, and only where electronic marketing law allows it, or with your consent. Every message lets you opt out.
Keeping a record of the terms you accepted, handling complaints, and making or defending legal claims
- Data
- Sign-up records and correspondence
- Lawful basis
- Legitimate interests (protecting our business and showing what was agreed)
Where we rely on legitimate interests, we have weighed our interests against your rights and expectations. Ask us if you would like the details.
You do not have to give us your details, but we need your name, email and phone number to reply to a contact form, and the details Stripe asks for to set up a plan. Without them we cannot respond or provide the service. Accepting cookies is entirely optional.
We do not make decisions about you by purely automated means.
4. Who we share it with
We do not sell your data. We share it only with the services we use to run the business, and only what each one needs. Most act as our processors, under contracts that require them to keep it secure and use it only on our instructions.
| Who | What for | Where |
|---|---|---|
| Vercel | Hosts our website and keeps its server logs | USA and other regions |
| Make.com | Automation that passes contact form submissions and payment notifications to our inbox and records | EU |
| Notion | Where we keep our records of enquiries, clients and projects | USA |
| Stripe | Online sign-up, card and Direct Debit payments, invoices and the billing portal. Stripe is also a controller in its own right for its fraud prevention and legal duties. | UK, EU and USA |
| Calendly | Booking calls with us | USA |
| Our email inbox (for example Gmail or Google Workspace), and Google Analytics if you accept cookies | USA and elsewhere | |
| Cloudflare | Runs our domain's DNS and forwards email sent to hello@alur.uk | Worldwide |
| Meta | WhatsApp, if you message us, and the Meta Pixel if you accept cookies. For the Pixel, Meta and we are joint controllers for collecting and sending the data; Meta is responsible for what it does with it after that. | EU and USA |
| Domain registrars | Registering and renewing your domain in your name (for .uk addresses, the details also go to Nominet, the .uk registry) | UK and elsewhere |
| A password manager (for example 1Password or Bitwarden) | Storing logins you share with us, encrypted | Varies by provider |
| Professional advisers and authorities | Our accountant, legal advisers and insurers, and HMRC, the police or a court where the law requires it | UK |
Vercel
- What for
- Hosts our website and keeps its server logs
- Where
- USA and other regions
Make.com
- What for
- Automation that passes contact form submissions and payment notifications to our inbox and records
- Where
- EU
Notion
- What for
- Where we keep our records of enquiries, clients and projects
- Where
- USA
Stripe
- What for
- Online sign-up, card and Direct Debit payments, invoices and the billing portal. Stripe is also a controller in its own right for its fraud prevention and legal duties.
- Where
- UK, EU and USA
Calendly
- What for
- Booking calls with us
- Where
- USA
Google
- What for
- Our email inbox (for example Gmail or Google Workspace), and Google Analytics if you accept cookies
- Where
- USA and elsewhere
Cloudflare
- What for
- Runs our domain's DNS and forwards email sent to hello@alur.uk
- Where
- Worldwide
Meta
- What for
- WhatsApp, if you message us, and the Meta Pixel if you accept cookies. For the Pixel, Meta and we are joint controllers for collecting and sending the data; Meta is responsible for what it does with it after that.
- Where
- EU and USA
Domain registrars
- What for
- Registering and renewing your domain in your name (for .uk addresses, the details also go to Nominet, the .uk registry)
- Where
- UK and elsewhere
A password manager (for example 1Password or Bitwarden)
- What for
- Storing logins you share with us, encrypted
- Where
- Varies by provider
Professional advisers and authorities
- What for
- Our accountant, legal advisers and insurers, and HMRC, the police or a court where the law requires it
- Where
- UK
If our business were ever sold or restructured, the buyer would receive the records needed to carry on serving clients, under this notice.
5. Transfers outside the UK
Some of the services above are based in, or access data from, countries outside the UK, mainly the USA and the European Economic Area. When data leaves the UK it is protected by one of the safeguards UK law allows: UK adequacy regulations (which cover the EEA, and US companies certified under the UK extension to the EU-US Data Privacy Framework), or the ICO's International Data Transfer Agreement or UK Addendum to the EU standard contractual clauses, which these providers include in their terms. Contact us if you would like more detail about a particular transfer.
6. How long we keep it
- Enquiries that do not lead to work: 12 months from our last contact, then deleted.
- Client records (contracts, invoices, payments and correspondence): while you are a client, then 6 years after the contract ends, for HMRC and in case of legal claims. This includes payment and refund records if you cancel before your onboarding call.
- Website content and logins: while we host or manage your website. When your plan ends we hand over your content and help move your domain, then delete our copies and any logins within 90 days.
- Business contacts we approach: until 12 months after our last contact if we do not end up working together, or until you ask us to stop, if sooner.
- Marketing updates: until you opt out or object.
- Do-not-contact list: if you ask us not to contact you again, we keep your name, business and contact details on this list so that we never do.
- Server logs: a short time under Vercel's settings, typically no more than 30 days.
- Google Analytics data: no more than 14 months. Meta keeps Pixel data under its own policy.
- Make.com keeps a short history of each automation run (for example, 30 days).
- Your cookie choice: 12 months, then we ask again.
We may keep data for longer if the law requires it or we need it for a legal claim.
7. Your rights
Under UK GDPR you have the right to:
- Access: ask for a copy of the personal data we hold about you.
- Rectification: ask us to correct data that is wrong or incomplete.
- Erasure: ask us to delete your data, where we no longer have a good reason to keep it.
- Restriction: ask us to pause using your data, for example while we check it is accurate.
- Portability: ask for data you gave us in a common electronic format, or for us to send it to someone else.
- Objection: object to us using your data on the basis of legitimate interests. You can always object to direct marketing, and we will stop.
- Withdraw consent: where we rely on your consent, such as for cookies, you can withdraw it at any time. This does not affect what happened before.
To use any of these rights, email hello@alur.uk or call 07741 526953. It is free. We will reply within one month, or tell you within that month if we need up to two more months for a complex request. We may ask you to confirm who you are first.
9. Keeping your data secure
Our website only runs over an encrypted connection. Card and bank details are handled by Stripe, which is certified to the payment industry's security standard (PCI DSS). Only the people who need your data to do their job can see it. We protect our accounts with strong passwords and two-step sign-in wherever the service offers it, and we keep logins you share with us in encrypted storage, never in code or plain email.
If a data breach is likely to put your rights at risk, we will tell you and, where the law requires, the ICO.
10. Children
Our website and services are for businesses and are not aimed at anyone under 18. We do not knowingly collect data from children. If you think a child has given us their details, contact us and we will delete them.
11. Complaints
If you are unhappy with how we have handled your data, please tell us first at hello@alur.uk and we will try to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at any time: ico.org.uk/make-a-complaint, by phone on 0303 123 1113, or by post to Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
12. Changes to this notice
We will update this notice when the way we use personal data changes. The date at the top shows when it last changed. If a change materially affects our clients, we will also tell them by email.
13. Contact us
Alur.ai (John Li, sole trader), Manchester, England, United Kingdom.
Email hello@alur.uk · Phone 07741 526953