What we collect, why, and what we do with it.

Who we are and how to contact us

Hardy & Butler Limited is the controller of any personal data collected through this website. We are registered in England and Wales, company number 17549565, and our registered office is Acorn House, Dog Lane, Kelsall, Tarporley CW6 0RP. If you have any question about this notice or about your data, email hello@hardyandbutler.ai.

What we collect

This website collects personal data in three places. The contact form: your name, your work email address and what you are trying to fix, and, if you choose to give them, your company, your role, your company size and where you would like to start. The card Nova, the chat on every page, shows before the first question: your name, your email address and, if you choose to give it, a phone number. And the sign-up for The Wire weekly: your email address and nothing else. We do not collect anything beyond those, and there is no account. What you then ask Nova is passed to Anthropic to write the answer, and a copy of the chat comes to our inbox when it ends, as set out under Nova, the chat, below.

One addition, only with your consent. If you have allowed Advertising in cookie settings and arrived from one of our adverts, your enquiry also carries that advert's reference: the utm_ tags and the Google click id (gclid) from the address you landed on, and the page you landed on. It tells us which advert brought you and nothing about you.

The form also records when it was opened and submitted, carries a hidden field that should stay empty, and counts how many enquiries have arrived from the same connection in the last hour and the last day. These checks exist only to stop automated spam. For the counting, our code keeps a one-way SHA-256 hash of your internet address, never the address itself: the full hash in a counter that forgets each entry after one hour for the per-address count and after twenty-four hours for the site-wide count, and the first twelve characters of the same hash in a log line that records the date and time, whether the enquiry was sent, dropped or refused and, when it was sent, your company name. Log lines are deleted after ninety days.

Why we collect it, and the lawful basis

We use your details to reply to your enquiry, to tell genuine enquiries from sales pitches and spam, to keep a record of it in HubSpot so that we can follow it up, and, if you want to go further, to arrange a call and an audit. The lawful basis is legitimate interest: you have contacted a business about its services and both of us have an interest in that conversation happening. We have weighed that against your interests and do not think a reply to an enquiry you sent us, our using an AI service to sort it from sales pitches and spam, or our keeping a record of it to follow it up, is something you would not expect.

We do not use the details from the contact form for marketing, and an enquiry never puts you on a mailing list. We do not sell, rent or share your details with anybody for their own purposes.

The Wire weekly

The Wire weekly is paused: no weekly email is being sent. The daily Wire briefings carry on, here on this website. If you give us your email address for the weekly, we keep it to tell you if the weekly starts again, and for nothing else. The lawful basis is consent. Nothing is sent until you click the link in the confirmation email, an address that is never confirmed is forgotten after seven days, and every email we send carries a link that removes you with one click and no questions.

The list is held in a file on our own hosting, above the web root, beside the contact form's handler. The sign-up carries the same anti-spam checks as the contact form: a hidden field that should stay empty, a timing check, and counters that keep a one-way hash of your internet address for an hour and for a day. The log records the first twelve characters of a one-way hash of your email address, never the address itself, and log lines are deleted after ninety days. The emails themselves leave through Hostinger's mail service and MailChannels' relay, exactly as an enquiry does, and are described under Where it is stored below.

We keep your address for as long as you stay subscribed. Unsubscribe and it is deleted at once, not marked and kept. We do not count opens or clicks: the emails carry no tracking pixel and the links in them are plain links to this website.

Nova, the chat

Nova, Hardy & Butler's AI EA, is AI, not a human. She answers questions about Hardy & Butler from this website's own pages and a short list of facts Hardy & Butler has given her, such as where we are based, and nobody checks an answer before you read it, so the page she links to is the word that counts. Before the first question, Nova asks for your name, your email address and, if you choose to give it, a phone number, so that a person at Hardy & Butler can follow up. They are sent to us exactly as an enquiry is, with a line saying they came from the chat, and handled as described for enquiries. Your first name also goes to Anthropic with each question, so that Nova can use it; your email address and phone number never do. When the card or the copy of the chat is sorted, as described under Who handles your enquiry, Anthropic also sees your full name and the part of your email address after the @, but still never the address itself or your phone number. Please do not type other personal details into the chat itself. It does not need them.

When you ask Nova a question, your question, the conversation so far in that chat, the first name you gave on the card and the address of the page you are reading go from your browser to our code on Cloudflare, which passes them to Anthropic's API to write the answer and passes the answer back. Nothing else goes with them: no email address, no phone number, no cookie and no internet address. Our code on Cloudflare keeps none of it: there is no chat log and no database, and it does not record conversations. When the chat ends, which is when ten minutes pass without a question, when you press New chat, or when you close the tab, switch to another tab or app, or leave this website, your browser sends a copy of the conversation, with the details from the card, to our inbox exactly as an enquiry is sent, so that a person at Hardy & Butler can follow up, and from then on it is handled as described for enquiries, including the sorting and the record we keep in HubSpot. Until then the conversation is kept in your browser's session storage, as hb-chat, and the details you gave on the card, as hb-chat-who, so that Nova can greet you by name, the chat carries on from page to page and the copy can reach us, and both go when you close the tab. Nova makes no decisions about you, and the sorting described under Who handles your enquiry decides only whether an enquiry is filed in HubSpot, never whether it reaches us.

Anthropic handles the text in the United States only to write the answer and, for the card and the copy of the chat, to sort it, under its commercial terms and its data processing addendum, which incorporates the UK International Data Transfer Addendum. Anthropic does not use it to train models. It deletes it within thirty days, unless its automated safety systems flag it as breaking Anthropic's usage policy, when it may keep it for up to two years, or the law requires it to keep it longer.

To stop the chat being misused, Cloudflare counts how many questions arrive from each internet address in a minute and forgets the count after that minute; our code does not store the address. The lawful basis for all of this is legitimate interest: you have asked us a question, we answer it, and we follow up the enquiry you started with the card. If you choose to add the conversation to an enquiry and send the contact form, it becomes part of your enquiry and is handled as described for enquiries.

Cookies and analytics

This website sets no cookies until you say so. The banner on your first visit offers two choices, each changeable at any time from Cookie settings at the foot of every page. Measure visits uses Google Analytics to count visits: the pages read, how people arrived, an approximate location worked out from the connection, the kind of device and browser, and a random number that tells one visitor from another. Advertising lets Google Ads tell us which of our adverts lead to enquiries: with both chosen, Google Analytics passes your visit, and the fact that an enquiry was sent, to our Google Ads account, and if you arrived from one of our adverts, its reference goes with any enquiry you send. The lawful basis for both is consent. Google signals and personalised advertising are switched off whatever you choose, there is no remarketing, we keep Google's event data for two months, and Google LLC in the United States processes it under the UK Extension to the EU-US Data Privacy Framework and Google's data processing terms. Say no and nothing is set, nothing is sent to Google, and your browser makes no request to any third party. The cookie policy names each cookie and how long it lasts.

Who handles your enquiry

The form on this website is handled by our own code, on our own hosting. There is no third-party form service. When you press send, your details are passed to Hostinger, who provide our hosting and our email and who deliver the enquiry to our inbox, and Hostinger's outbound mail is relayed by MailChannels. Both act only on our instructions and neither uses your details for their own purposes. MailChannels operates outside the UK; that transfer is covered by the data processing terms we are subject to as a Hostinger customer. A person at Hardy & Butler reads your enquiry and replies. A copy of your enquiry also goes to the Microsoft 365 mailbox of Stride Consultancy Partners Limited, a company with the same director as Hardy & Butler Limited, so that it is read promptly. We also keep a record of each enquiry in HubSpot, the system we use to keep track of the people we are talking to, unless it is judged a sales pitch, spam or one of our own tests. Once Hostinger has accepted your enquiry, our code on Cloudflare asks HubSpot whether it already holds a record for your email address. If it does not, our code sends the enquiry to Anthropic's API with your email address replaced by the part after the @, and with any email addresses, phone numbers and advert reference in it taken out, and Claude, an AI model, judges whether it is a genuine enquiry, a sales pitch, spam or one of our own tests, or that it cannot tell. Sales pitches, spam and tests are not filed in HubSpot and stay in our inbox; for a sales pitch or spam, HubSpot gets a reminder for us to check that decision, with none of your details in it. A card from Nova is filed only if Claude judges it a genuine enquiry, and the copy of the conversation that follows is judged in its own right. Any other enquiry Claude cannot judge is filed, and so is every enquiry when Claude cannot be reached. Anthropic handles that text in the United States only to make that judgement, under Anthropic's commercial terms and its data processing addendum, which incorporates the UK International Data Transfer Addendum, and Anthropic does not use it to train models. To file an enquiry, our code then sends HubSpot your name, your email address, your message as we received it (ending with an advert's reference if you allowed Advertising and came from one of our adverts), the page you sent it from, and whichever you gave of your phone number, company, role, company size and where you would like to start; for a chat with Nova, the message is the card or the copy of the conversation. HubSpot files them as a contact with a note. If HubSpot cannot be reached, the enquiry is still in our inbox. HubSpot holds the record as our processor under its data processing agreement, which limits it to our instructions, apart from the limited uses its terms allow for running and improving its service and where the law requires it. We use it to follow up enquiries, not to send marketing. Our HubSpot account is held in HubSpot's European Union data centre, and where HubSpot or its sub-processors handle the data outside the UK, the transfer is covered by HubSpot's data processing agreement, which includes the EU Standard Contractual Clauses and the UK International Data Transfer Addendum. Apart from that, and Anthropic's own short retention described under Nova, the chat, no copy of your enquiry is kept anywhere other than our own inbox, HubSpot and the short anti-spam log described above. If you choose to book a call through the link on our contact page, the booking is handled by Cal.com, Inc. on its own website under its own privacy policy; nothing is sent to Cal.com until you follow that link.

This website is served by Cloudflare, Inc., which delivers every page, passes each enquiry and each Wire sign-up on to Hostinger, passes each new enquiry to Anthropic to be sorted, files in HubSpot those not judged a sales pitch, spam or a test, and runs the code that passes each question to Nova on to Anthropic. To do that it handles your internet address and the address of the page you ask for, in the United States and elsewhere, under Cloudflare’s data processing addendum, which includes the UK International Data Transfer Addendum.

How long we keep it

Addresses on The Wire weekly list stay until you unsubscribe. Enquiries stay in our inbox, and in HubSpot if they were filed there. We review both every six months and delete anything that did not lead to a conversation, from both. If your enquiry becomes an engagement, the details move into our client records, which are covered by the privacy terms in our engagement agreement rather than this notice. You can ask us to delete your enquiry at any time and we will.

Where it is stored

Your enquiry is held as an email in our inbox with Hostinger, The Wire weekly list is held in a file on our hosting with Hostinger, and the emails we send you travel through MailChannels' relay, which operates outside the United Kingdom. Where Hostinger or its relay stores or handles data outside the UK, the transfer is covered by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses in Hostinger's data processing addendum, which applies to us as a Hostinger customer. The record of your enquiry in HubSpot is held in HubSpot's European Union data centre, as set out under Who handles your enquiry. The copy at Stride Consultancy Partners Limited is held in its Microsoft 365 mailbox, and Anthropic handles the text of your enquiry in the United States while it is sorted. A conversation with Nova stays in your own browser until the chat ends; the copy that then reaches our inbox is held as an enquiry is, and Anthropic handles the conversation as set out under Nova, the chat.

Your rights

Under UK GDPR you have the right to:

• be told how your data is used, which is what this notice is for;
• ask for a copy of the data we hold about you;
• have inaccurate data corrected;
• have your data erased, where there is no good reason for us to keep it;
• restrict how we use your data while a question about it is settled;
• object to our use of your data where we rely on legitimate interest, including at any time to any direct marketing;
• receive your data in a portable format, where the processing is automated and based on consent or contract;
• not be subject to a decision based solely on automated processing that has a legal or similarly significant effect on you. We make no such decisions.

To exercise any of these, email hello@hardyandbutler.ai. We will reply within one month. There is no charge.

How to complain

If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office: Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, telephone 0303 123 1113, ico.org.uk.

Changes to this notice

If we change what the website collects, we will change this notice and the date at the top. We will not apply a change backwards to data you have already given us.