Privacy policy

Last updated: 19 October 2026

This policy explains what personal information Little Bot Labs Ltd collects, why, how we look after it, and the choices you have. We've written it to be read, not skimmed past, so it's in plain English.

1. Who we are

Little Bot Labs Ltd ("we", "us") is the data controller for the personal information described in this policy.

• Company number: 17522005
• Registered office: Suite RA01, 195-197 Wood Street, London E17 3NU
• ICO registration number: [ICO REGISTRATION NUMBER]
• Contact: hello@littlebotlabs.co.uk

We're a small business, so there's no separate data protection officer. Any privacy question goes to the email address above, and a real person will reply.

2. What we collect

When you contact us (contact form or email): your name, email address, phone number if you give it, your business name and anything you write in your message.

When you apply for a free trial: your name, role, email, phone number, business name, business type and size, the town or area you work in, and your answers to our application questions (for example, the tasks you'd like to automate and the tools you use now).

When we work together (trial or paid project): contact and billing details, notes from our conversations, and access to the systems we've agreed to work on. Where that work involves information about your customers or staff, see section 7.

When you visit the website: our hosting provider automatically records basic technical information (such as IP address, browser type and pages requested) to keep the site secure and working. We don't use advertising or tracking cookies. If we ever add analytics that need cookies, we'll ask for your consent first and update this policy.

We don't ask for, and you shouldn't send us, special category information (such as health, religion or ethnicity) through our forms.

3. Why we use it, and our lawful basis

Where we rely on legitimate interests, we've weighed them against your rights. You can object at any time (see section 10).

4. Who we share it with

We never sell your information or share it with anyone for their own marketing.

We use a small number of trusted service providers who process data on our behalf, under contract and only on our instructions:

• Website hosting and database: Lovable (built on Supabase), with data stored in Europe
• Email: Microsoft 365 (provided through GoDaddy), plus a transactional email service that sends form notifications
• AI tools: services we use to help build and run automations. We only use providers whose business terms say they don't use your data to train their models
• Accountancy and banking: for invoicing and tax records

We may also disclose information if the law requires it, or to protect our legal rights.

5. How long we keep it

When the retention period ends, we delete the information securely or fully anonymise it.

6. Marketing, case studies and anonymisation

Showing what we've built helps other small businesses understand what's possible. We'll never do that at your expense.

Our default is anonymous. Unless you've given us separate written consent to be named, anything we publish about our work with you (a case study, social media post, video, talk or example on our website) will be anonymised so that you, your business, your staff and your customers can't reasonably be identified. In practice, that means we:

• Remove names: no business name, people's names, logos, branding, website addresses or social handles
• Generalise details: we describe you broadly, e.g. "a hair salon in the Midlands", never your street, town or anything that would single you out in a small sector
• Replace real data: screenshots, spreadsheets and demos use made-up example data, never your real customer, staff or financial information
• Soften numbers: results are shown as rounded figures, ranges or percentages (e.g. "around 5 hours a week saved") rather than exact figures that could identify you
• Combine where we can: some results are reported as totals across several clients, so no single business can be picked out
• Remove hidden information: we strip file metadata and check images for names, addresses or numbers in the background

You see it first. We'll send you anything that features your project, even when it's anonymised, before it's published. If you're not comfortable with it, we won't use it.

Being named is opt-in. We'll only use your business name, logo, photos or a quote attributed to you if you've given specific written consent, separate from your trial or project agreement. Saying no won't affect your trial or our work together in any way.

You can change your mind. You can withdraw consent at any time by emailing us. We'll remove the content from our website and social media within 14 days. We can't recall anything already printed or shared by other people, but we won't use it again.

Our demo videos and website examples use fictional businesses and made-up data. They show the kind of thing we build, not real client results.

7. Your customers' data during our work

If a trial or project involves information about your customers, staff or suppliers, you remain the data controller for it, and we act as your data processor. We:

• only use it to carry out the agreed work, on your instructions
• keep it confidential and secure, and give access only to systems that need it
• don't copy it into our own records or use it for marketing
• return or delete it when the work ends (see section 5)
• tell you without undue delay if we become aware of any data breach affecting it

The full terms are in our trial or project agreement, which includes a data processing agreement.

8. How we keep it secure

We use reputable, secure providers. Data is encrypted in transit and at rest, and accounts are protected with strong passwords and two-factor authentication. Access to client systems is limited to what each piece of work needs and is removed when the work ends. No method is completely secure, but we take reasonable steps to protect your information and review them regularly.

9. International transfers

Some of our providers may process data outside the UK (for example in the EU or the US). When that happens, we make sure appropriate safeguards are in place, such as UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement or Addendum.

10. Your rights

Under UK data protection law, you have the right to:

• access the personal information we hold about you
• correct anything that's wrong or incomplete
• have your information deleted
• restrict or object to how we use it, including objecting to anything based on legitimate interests
• data portability: receive your information in a reusable format
• withdraw consent at any time, where we rely on consent

To use any of these rights, email hello@littlebotlabs.co.uk. We'll respond within one month. It's free, unless a request is clearly unfounded or excessive.

11. Complaints

If you're unhappy with how we've handled your information, please tell us first and we'll try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint or 0303 123 1113.

12. Children

Our services are for businesses, and our website isn't aimed at anyone under 18. We don't knowingly collect children's personal information.

13. Changes to this policy

We'll update this policy if what we do changes. The date at the top shows when it was last updated. If we make a significant change that affects you, we'll let you know directly.