Privacy Policy

1. Who we are

Selfound Ltd ("we", "us", "our") is an AI venture studio registered in England and Wales (company number 16450921). Our registered office is at Unit 82a James Carter Road, Mildenhall, Bury St. Edmunds, IP28 7DE, United Kingdom. We operate the website at selfound.com and the AI chat assistant at ai.selfound.com.

This policy explains what personal data we collect from you when you use our site or chat with our AI consultant, how we use it, and the rights you have over it under the UK GDPR, the Data Protection Act 2018, and (where applicable) the EU GDPR.

Data controller: Selfound Ltd. For any privacy question or to exercise your rights, contact us at [email protected].

2. What we collect

a) Information you give us through the AI chat

When you use the chat widget on our site, we process the content of your messages and any information you choose to share: your name, email address, job title, company, team size, pain points, tools in use, budget expectations, and timeline. You control what you share.

At the end of a qualification conversation, when you confirm, we store the full conversation transcript, a summary, and your contact details in our database so our team can follow up with a tailored proposal.

b) Information you give us by email

If you email [email protected], we retain that correspondence and any details you include.

c) Technical data

Our chat backend processes your IP address transiently for abuse prevention and rate-limiting. IPs are not stored with your lead record.

d) Analytics (opt-in)

If you consent via our cookie banner, we load Umami, a self-hosted, privacy-friendly analytics script. Umami uses no persistent cookies and does not cross-site track. It records aggregated events like page views, referrer, browser family, and approximate country — none of which identify you personally.

With the same consent, we also use Google Analytics 4, provided by Google LLC / Google Ireland Ltd, to understand how visitors use the site. It collects pages visited, referring site, approximate location (city/country), device, browser and operating system information, and interactions such as clicks and scrolls. Google Analytics 4 does not log or store IP addresses. We use this data only as aggregated usage statistics to improve the site.

3. Why we process it (legal basis)

• Consent (Art. 6(1)(a) GDPR) — for analytics via Umami and Google Analytics, and for follow-up marketing emails where applicable.
• Legitimate interest (Art. 6(1)(f) GDPR) — for qualifying leads, preparing tailored proposals, protecting the service from abuse, and keeping a record of enquiries.
• Contract performance (Art. 6(1)(b) GDPR) — for delivering services to clients who engage us.

4. Who we share it with (sub-processors)

We rely on a small number of trusted vendors to run the service. None sell your data.

International transfers to the United States are covered by Standard Contractual Clauses (SCCs) where applicable. Google may process Google Analytics data outside the UK/EEA (e.g. in the United States) under appropriate safeguards, such as SCCs and the EU-US Data Privacy Framework. We do not transfer your data outside this list of processors.

5. How long we keep it

• Chat transcripts and leads: 24 months from last contact, then deleted — unless you become a paying client, in which case we retain records for the duration of the engagement plus 6 years after its end, as required by UK record-keeping obligations (Companies Act 2006 s.388 and HMRC retention rules).
• Email correspondence: 24 months from last contact, unless it forms part of a client engagement (then 6 years after engagement ends, per above).
• Umami analytics: aggregated, not tied to you personally; retained as long as needed for trend analysis.
• Google Analytics: event data is retained for a limited period; we use Google Analytics' default retention setting.
• Rate-limit IP counters: in-memory only; cleared on server restart (never persisted).

6. Your rights

Under the UK GDPR and EU GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — ask us to delete your data (subject to legal retention obligations).
• Restriction — ask us to pause processing while an issue is resolved.
• Portability — receive your data in a machine-readable format.
• Object — to processing based on legitimate interest or for direct marketing.
• Withdraw consent — at any time, for analytics or marketing. You can reset your cookie preference below.
• Complain — to a supervisory authority (UK: the ICO, ico.org.uk; EU: your local Data Protection Authority).

To exercise any of these rights, email [email protected]. We respond within 30 days.

7. Automated processing

The AI chat uses a large language model (OpenAI GPT-class) to generate responses and route you to relevant services. It does not make decisions with legal or similarly significant effects on you. A human reviews every qualified lead before any commercial follow-up.

8. Cookies and local storage

We use the following on the website:

• Essential (always on): selfound-consent in local storage — remembers your cookie-banner choice so we don't keep asking.
• Analytics (opt-in): Umami script from stats.mavlin.com. Umami uses no tracking cookies; it hashes your session for a single day and discards the data after.
• Analytics (opt-in): Google Analytics 4 cookies _ga and _ga_<ID>, used to distinguish visitors. They last up to 2 years.

You can also block or delete cookies in your browser settings, or install the Google Analytics opt-out browser add-on. For more on how Google handles this data, see Google's Privacy Policy and How Google uses information from sites that use our services.

To change your choice:

9. Security

Data in transit is encrypted via HTTPS/TLS 1.3. The database is hosted in a private Docker network with no public ingress. Access to production data is restricted to named engineers with role-based authentication. We log access for audit.

10. Children

The service is not directed at children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be announced on this page with a revised "Last updated" date. Continued use of the site after an update means you accept the revised policy.

12. Contact

For any privacy-related question or request, contact us at [email protected].