Privacy Policy

Algosoup Ltd is a forward-deployed engineering company registered in England and Wales, company number 17111484. Our registered office is 13 St. Ronans Avenue, Bristol, BS6 6EP, United Kingdom.

For anything in this policy, whether a question, a request about your data or a suspected security incident, contact security@algosoup.ai. It is monitored by the company's directors, who own data protection and information security at Algosoup.

For personal data we handle on this website and in our own business dealings, Algosoup Ltd is the data controller under UK GDPR.

Almost every question about how we handle personal data depends on which of these two situations applies.

We have kept this list specific rather than generic. It describes what the site actually loads and stores, verified against the running site.

What we do not do: we run no advertising or retargeting pixels, we do not sell or share personal data for advertising, we do not use your data for automated decisions that have a legal or similarly significant effect, and we do not ask for special category data.

No analytics cookie and no attribution record is stored on your device until you choose. On your first visit a small panel appears in the corner of the page with two options, and nothing optional is written until you pick one. Google Analytics is not even downloaded until then, so choosing Essential only means nothing about your visit ever reaches Google.

The booking calendar is not covered by this choice. It is a Cal.com widget, and the cookies it sets are for bot protection, request forgery protection and its own sign-in flow: security and functional cookies for a tool you are actively using, rather than anything that tracks you. They are listed below so you can see exactly what they are.

We record your choice so we do not ask again on every page. That record is the one thing stored without asking, because without it the question could not be remembered. You can change your mind at any time using the Cookies link in the footer.

Alongside these, the as_visit and as_first_touch records described in section 3 are held in your browser's session and local storage. They are not cookies and are not transmitted automatically with requests.

You can block or delete cookies in your browser settings, and clear the stored records along with your site data. Google publishes a browser add-on that opts you out of Google Analytics across all sites. Blocking any of this does not stop you using the site, though blocking Cal.com's cookies will prevent the booking calendar working, and you can email us instead.

Under UK GDPR we rely on the following lawful bases, and we collect only what the purpose actually requires.

For personal data we process on a client's behalf, the lawful basis is the client's to establish as controller. We act on their instructions.

When we build and operate software for a client, we act as a processor. This is the capacity in which we handle e-commerce and order-management data, including integrations with platforms such as TikTok Shop, where we process end-customer order and buyer data on the client's behalf.

• We process personal data only on the client's documented instructions and only for the purpose we were contracted for. We do not decide the purposes of that processing.
• We do not sell personal data, and we never use client or end-customer data for our own purposes or for anything unrelated to the engagement.
• Integrations request only the API scopes and fields the contracted purpose requires. Where a platform masks personal data before it reaches us, we preserve that masking rather than work around it.
• Personal data is retained only for as long as the engagement requires, and is deleted or returned at the end of the engagement or on request.
• Sub-processors and any international transfers are identified per engagement, and client data is kept separate from other clients' data.
• We assist our clients, and the platforms they sell on, in responding to requests from individuals and to security incidents, as described in sections 11 and 12.

We share personal data with the service providers below, who process it on our behalf under contract. We do not sell personal data, and we do not share it with anyone for their own marketing.

We may also disclose personal data to our professional advisers, or where we are required to by law. For client engagements, sub-processors are named per engagement and are subject to the client's agreement.

Our processing is UK-primary, with some processing in the United States. Systems we build and run for clients use compute pinned to London and managed PostgreSQL hosted in the United Kingdom. Bookings and job applications stay within the European Union.

This website itself is hosted by Vercel and delivered from its global edge network, and the providers named in section 7 as United States are exactly that: Google Analytics, Google Fonts, Google Workspace and our email delivery provider process data in the US.

Where personal data is transferred outside the UK, we rely on the UK's adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the safeguards those require.

Our full approach is set out in our internal Information Security Policy, adopted 11 August 2026 and reviewed at least annually. In summary:

• All data in transit is encrypted with TLS 1.2 or higher, including API, webhook and database connections.
• Data at rest is encrypted by our managed platform providers.
• Access follows least privilege: people get only the access their role requires, it is reviewed when roles change, and it is revoked on offboarding.
• Multi-factor authentication is required on all critical services, including source control, hosting, databases and partner platforms. Accounts are individual and shared credentials are prohibited.
• Credentials and API keys are never committed to source control, and are rotated on personnel change or any suspicion of exposure.
• We operate no self-hosted servers and no internal corporate network. Production workloads run on managed cloud platforms certified to SOC 2 or ISO 27001, with production, preview and development environments kept separate.
• Work devices use full-disk encryption, automatic screen lock and current security updates. Client data is not stored on removable media.
• Code changes are reviewed before reaching production, and dependency vulnerability alerts are triaged on receipt.

• Enquiries and booking records: kept for as long as we are in conversation with you, and for up to two years afterwards so we have context if you come back to us.
• Business contact records: kept while the relationship is live, and reviewed periodically after that.
• Job applications: kept for up to twelve months after a decision, unless you ask us to delete them sooner.
• Client and end-customer personal data: kept only for the duration the engagement requires, then deleted or returned at the end of the engagement or on request.
• Analytics: retained in Google Analytics under the retention period configured on our property, after which only aggregate reporting remains.
• Accounting records: kept for the period UK law requires.

Under UK GDPR you have the right to request access to the personal data we hold about you, to have inaccurate data rectified, to have data erased, to restrict how we process it, to receive it in a portable form, and to object to processing we carry out on the basis of legitimate interests. Where processing relies on consent, you can withdraw it at any time.

Exercise any of these by emailing security@algosoup.ai. We will respond within one month. We do not charge for this, and we will not treat you differently for asking.

Where the data is one we process on a client's behalf, the client is the controller and the request is theirs to decide. In that case we will pass your request to them promptly and assist them in answering it. We assist our clients and the platforms they sell on, including TikTok Shop, with requests for access, rectification and deletion, without undue delay.

If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner's Office at ico.org.uk, or by calling their helpline on 0303 123 1113. We would appreciate the chance to address it first.

If a personal data breach occurs, we contain it, assess the scope and the data affected, and notify the affected clients and platforms without undue delay. Where the breach is reportable, we notify the Information Commissioner's Office within 72 hours of becoming aware of it, and we inform affected individuals where the law requires. Every incident is followed by a review that records what happened and the corrective actions taken.

Report a suspected security incident to security@algosoup.ai.

We review this policy at least annually, and whenever there is a material change to how we handle personal data or after any security incident. When we change it, we update the date at the top of the page. Material changes will be made clear on this page rather than buried in it.

Questions about this policy, or about anything in it, go to security@algosoup.ai.