Privacy Policy

This policy explains what personal data we collect when you use georgeautomation.com and our services, why, who we share it with, how long we keep it, and what your rights are. It is written to be read, not skimmed past. If anything is unclear, email hello@georgeautomation.com.

1. Who is responsible

The controller of your personal data is John Patrick George, trading as George Automation, a sole trader established in England, address 17 Cliffe Road, Birstall, Leicester LE4 3AE, United Kingdom, email hello@georgeautomation.com. We are registered with the Information Commissioner's Office under reference ZC252320.

There are two different situations in this policy:

• Data about you — your account, your billing, your enquiries, your use of the site. For this, we are the controller and this policy applies.
• Data you bring to us about other people — for example your customers' details inside an automation we run for you. For this, you are the controller and we act only on your instructions as a processor. Our Data Processing Agreement covers that, and your own privacy notice covers those people. Section 9 says more.

2. What we collect and why

When you visit the site

• Server logs: your IP address, browser type, the pages you request and when. Kept by our hosting provider for security, debugging and abuse prevention. Lawful basis: our legitimate interest in running a secure, working website.

When you contact us, enquire about a product, or fill in our questionnaire

• What you type into the contact form, an enquiry form or our questionnaire at georgeautomation.com/start: your name, email address, company, message, the product you are interested in, and your answers to the questions we ask. The questionnaire also asks about your business — what kind it is, how many people work in it, what is taking up your time, the tools you already use, what you would like help with, a rough budget and when you would want to start — and for a phone number, which is optional. We also record the time and your IP address to stop spam and abuse.
• We use this to reply to you, to decide whether and how we can help, to prepare a scope and quote, and — if you become a client — as the starting point for your project. We send you one email to confirm we have received it. Lawful basis: taking steps at your request before entering a contract, and our legitimate interest in responding to enquiries.
• If you don't become a client we keep enquiry data for 24 months from your last contact with us in case you come back, then delete it.

When you create an account

• Your name, email address and a password (stored only as a one-way hash, by our authentication provider — we cannot read it). The name of your organisation, the members you invite and their roles, and the invitations you send.
• We use this to run your account, to secure it (including emailing you confirmation, sign-in and password-reset links), and to let you and your colleagues use the portal together. Lawful basis: performance of our contract with you.

When you buy something

• We record what you bought, when, for how much, the delivery type, the status of your subscription or order, and each payment you make — including every monthly renewal — with any refund against it. Payment itself is handled by Stripe: they collect your card details and billing address directly; we never see or store full card numbers. We hold a Stripe customer reference, so we can show you your billing history.
• Stripe also sends us a notification each time something happens to your payment or subscription — a checkout completed, an invoice paid, a payment failed. We store each notification as Stripe sends it. These can contain your name, email address and billing address as Stripe holds them. We keep them so that a notification that arrives twice is only acted on once, and so we can see what happened to a payment. Section 6 says how long, and what happens to them if you ask us to delete your account.
• Lawful basis: performance of our contract with you, and our legal obligation to keep accounting records.

When we do work for you

• The briefs and questionnaire answers you give us, project milestones, deliverables and links, approval requests and your decisions on them, messages between us, and an activity log of who did what in your workspace and when.
• Lawful basis: performance of our contract with you. The activity log also serves our legitimate interest in being able to show what was done and by whom.
• If you ask us to delete your data, the activity log in your workspace goes with the workspace. Where you appear in another organisation's activity log — for example if you were a member of theirs — those entries stay, because they are that organisation's record of its own work, but they stop naming you: your name, address and identifier are removed and the entry keeps only what was done, to what, and when.

When you talk to a chatbot we run

• Our own site has a chat window — on its public pages, its sign-in pages and inside the client portal — and clients can buy the same one for theirs. Using it while you are signed in does not link the conversation to your account. What you type into it, the replies, and the time are kept as a conversation. A random identifier is stored in your browser so that a conversation continues when you come back; it is not a cookie, it is not linked to any account, and clearing your browser's site data removes it. If you leave your name, email address and question for a person to follow up, those are kept as an enquiry, as above.
• Conversations with the chat window on our own site are kept for 12 months after the last message, then deleted.
• To write each reply, your message and the relevant pages of the site are sent to our AI provider, named in section 4. The reply is generated from those pages only.
• On our own site we are the controller: lawful basis, our legitimate interest in answering questions about what we do. On a client's site the client is the controller and their privacy notice applies; we process the conversation for them under our Data Processing Agreement (section 9).

When we email you

• We send service emails: account confirmation, sign-in links, password resets, invitations, purchase receipts, notices about your billing or these terms. You can't opt out of these while you have an account, because they are how the service works. Our email provider records the address, subject, and whether the email was delivered.
• We send marketing emails only if you have ticked the box asking for them, on our sign-up or enquiry forms. The box is never ticked for you, and never a condition of signing up or getting a reply. We record which form you ticked it on, the exact words you were shown, and the date — so we can show what you agreed to.
• You can stop them at any time, using the unsubscribe link in any marketing email, or by emailing hello@georgeautomation.com. Unsubscribing needs no account and no sign-in. We record when you unsubscribed and keep that record so you are not added back.
• Lawful basis: performance of our contract with you for service emails; your consent for marketing.

When you email us

• Emails to hello@georgeautomation.com are forwarded to and stored in our mailbox, hosted by Microsoft. We keep correspondence for as long as we have a relationship with you and for six years after, for our records.

3. What we don't do

• We don't sell personal data, or share it with anyone for their own marketing.
• We don't use advertising trackers or social-media pixels.
• We don't make decisions about you by automated means that have legal or similarly significant effects.
• We don't use your confidential information or your customers' personal data to train AI models, and we choose AI providers whose terms say the same about data sent to them through our services.
• Our services are for businesses. We don't knowingly collect data from anyone under 18.

4. Who we share data with

We use a small number of service providers to run George. Each one processes data only on our instructions, under a written contract that meets UK GDPR requirements or, for our mailbox and mail forwarding, under the provider's standard terms.

Provider	What they do for us	Where the data is held
Supabase	Database and authentication — your account, organisation, projects, billing records	European Union (Ireland)
Vercel	Hosts the website and application; keeps server logs	Serves worldwide; logs held in the United States
Stripe	Takes payments; stores card details and issues receipts and invoices	United States and European Union
Resend (using Amazon Web Services)	Sends our emails to you	European Union (Ireland)
Microsoft	Our mailbox for replies to hello@georgeautomation.com	United States and European Union
Porkbun	Forwards email sent to our domain to our mailbox	United States
OpenRouter (routing to Anthropic)	Generates chatbot replies: the visitor's message and the pages it is answered from go to Anthropic's Claude model through OpenRouter. Neither uses them to train models; OpenRouter deletes each exchange once the reply is produced and Anthropic keeps it for up to 30 days. Used only by products whose page names them	United States

We may also share data when the law requires it (for example a lawful request from a regulator or court), to enforce our terms, or with professional advisers under confidentiality. If George is ever sold or transferred, your data would pass to the new owner on the same terms, and we would tell you.

5. International transfers

Some of our providers are in the United States. Where personal data leaves the UK we make sure it is protected: either the provider is certified under the UK Extension to the EU-US Data Privacy Framework, or we rely on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the provider's own security measures. Transfers to the European Economic Area are covered by the UK's adequacy regulations. You can ask us for details of the safeguard used for any provider.

6. How long we keep data

Scheduled deletion is being brought into service. The periods below are the periods we apply. Until the automatic deletion behind each one is switched on, data is retained rather than deleted on its date, and deletion is carried out by hand on request. We will update this section as each is switched on.

Data	How long
Account, organisation and workspace data	While your account is active, and for up to 30 days after you ask us to close or delete it. We do this by hand, within 30 days of your request, unless we must keep something longer for the reasons below
Project deliverables and briefs	While the related product is active, plus 30 days in which you can ask for a copy, then deleted
Billing and payment records	Six years from the end of the tax year they relate to, as required for tax and accounting
Payment notifications from Stripe	12 months
Enquiries that don't lead to a purchase	24 months from the last contact
Chatbot conversations	12 months after the last message, or less if the business whose chatbot it is chooses. A business's chatbot conversations are also deleted 30 days after it stops using the chatbot
Email correspondence	Six years after our relationship ends
Marketing consent and unsubscribe records	Six years after you unsubscribe or ask us to delete your account
Server logs, including sign-in records	Up to 90 days
Email delivery logs at our provider	Up to 90 days
Activity log in your workspace	24 months, then deleted
Records of each AI model call (what it cost and how long it took)	24 months
Records of what our staff changed, and of each deletion request carried out	Six years
Data protection complaints	Six years after the complaint is closed

What we keep after you ask us to delete your account

Where we keep something after you have asked us to delete your account, it is kept for a specific reason and for that reason alone. This is the whole list:

• Your billing and payment records, with the links to your account removed, because tax law requires us to keep them. We also keep the Stripe references of your payments with those records, so that anything Stripe sends us about you afterwards is stored without your details.
• Our record that we carried out your deletion request — what was deleted, when, and the identifier of the account — because that is our evidence the request was honoured.
• Entries in other organisations' activity logs where you appear, with your name, address and identifier removed, because they are that organisation's record of its own work.
• A data protection complaint you made to us, and how we handled it, for six years after the complaint is closed. We keep this because it is the record a regulator or a court would ask for, and we would need it to defend or answer a claim. This is an exception to deletion and it ends at six years.
• Our record that a workspace proved it controls a particular website, including the website address, when it was checked and the result, for six years. We keep this because a complaint that someone put a chatbot on a site they did not own is most likely to arrive after the account is gone, and this is the evidence needed to answer it. This is an exception to deletion and it ends at six years.
• If you had asked for marketing emails: the record that you did, and that it ended. We unsubscribe you first, then remove your address from the record and replace it with a one-way scramble of it that cannot be read back. What is left is which form you used, the exact words you were shown, the date you agreed and the date it ended. We keep this for six years so that if anyone ever asks whether we had permission to email you, we can answer — you give us the address, we scramble it the same way, and compare. We cannot get your address back out of it.
• Details you left with a client's chatbot are that client's data, not ours to delete. If you ask us, we will tell you which of our clients holds them and help you ask that client.

Outside our own systems, Stripe keeps your customer record, payment methods and invoices as a separate controller under its own policy.

Backups

Deleting your data from our live systems does not reach a backup taken before the deletion. Our backups are kept for seven days, so deleted data can remain inside a backup for up to seven days before that backup expires and it is gone.

We never restore a backup into use without first applying again every deletion we have carried out since that backup was taken.

7. Security

We take reasonable technical and organisational steps to protect your data: every connection to the site is encrypted (HTTPS); data is isolated per organisation at the database level so one client can never read another's; passwords are hashed by our authentication provider; access to production systems is limited to those who need it and protected by strong authentication; and secrets are stored in our hosting provider's encrypted configuration, never in code. No system is perfectly secure, and if we ever discover a breach that puts your rights at risk we will tell you and the ICO as the law requires.

8. Cookies

We use only the cookies the site needs to work:

• Sign-in cookies set by our authentication provider (names beginning sb-), which keep you logged in. They last for the length of your session and a refresh window, and are deleted when you log out.
• portal_org, which remembers which of your workspaces you are looking at.

These are "strictly necessary" cookies, which the Privacy and Electronic Communications Regulations allow us to set without asking, so there is no cookie banner. We do not set analytics, advertising or tracking cookies.

When you pay, you are on Stripe's checkout page and Stripe may set its own cookies for fraud prevention under Stripe's privacy policy.

The chat window stores nothing until you send a message; then it keeps the random identifier described in section 2 in your browser's local storage, which is strictly necessary for the conversation to continue.

You can delete or block cookies in your browser, but the sign-in cookies are needed to use the portal.

9. Data you bring to us about other people

If you buy a service in which we handle personal data on your behalf — your customers' orders, your contact lists, your prospects — then for that data you are the controller and we are your processor. That means:

• We process it only on your documented instructions and for the purpose of providing the service.
• Our Data Processing Agreement (georgeautomation.com/legal/dpa) sets out our obligations, our sub-processors and your rights of audit, and forms part of our contract with you.
• You are responsible for having a lawful basis to give it to us, and for telling the people concerned about it in your own privacy notice.
• If someone contacts us about data we hold for you, we will refer them to you and help you respond.

10. Your rights

Under the UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is wrong;
• delete it, where we have no continuing reason to keep it;
• restrict how we use it while a question about it is resolved;
• give it to you in a portable form where we hold it under contract or consent;
• stop using it where we rely on legitimate interests, unless our reasons override yours;
• withdraw consent where consent is the basis, without affecting what was done before.

If you own a workspace, you can download everything in it yourself, at any time, as a structured file — sign in and go to Settings. For anything else — your own account details, or a request from someone who is a member of a workspace but does not own it — email hello@georgeautomation.com and we will do it by hand.

Deletion is carried out by hand on request rather than by a button in the portal. Email hello@georgeautomation.com and we will carry it out within 30 days.

We will reply to any request within one month and won't charge you unless a request is clearly unfounded or excessive. We may need to confirm who you are first.

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can use our data protection complaint form, which does not need an account. We will acknowledge your complaint within 30 days and tell you what we are doing about it. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.

11. Changes

We will update this policy when our practices change. The date at the top shows the current version. For a change that matters to how we use your data, we will email account holders before it takes effect.