Privacy notice

Fiveleaf Ltd is the data controller for personal data collected through this website. We are registered in England, company number 14653555.

For anything in this notice, including a request to exercise your rights under section 8, contact support@fiveleaf.co.uk.

Where we build and run AI agents for a client, that client is the controller and we act as their processor. Section 10 explains the difference and why it matters to which notice applies to you.

Less than most. We have checked this rather than assumed it.

No cookies, no tracking

We set no cookies of our own on this website, and there is no advertising network, no Meta pixel, no LinkedIn insight tag and no Google Analytics. Nothing here follows you to another site.

The chat agent

The agent in the corner of the page stores one entry in your browser’s local storage. It holds a randomly generated visitor reference and your conversation with the agent, so that a conversation survives a page refresh rather than restarting every time.

Two things worth being straight about. That entry is written when the page loads, not when you first open the chat. And the reference is a random string that identifies a browser rather than a person — it is not linked to your name or email unless you give them to the agent, and it is never shared with advertisers. Clearing your browser’s site data removes it.

Anything you type to the agent is processed to answer you and to improve how it answers. Please don’t put confidential information or anyone else’s personal data into it.

Aggregate analytics

We use Vercel Analytics and Vercel Speed Insights to see which pages are read and how quickly they load. Both are cookieless by design: they store no identifier on your device and do not follow you between sites. We see counts and page performance, not people.

If you book a call

The booking calendar is embedded from Cal.com. Booking gives us your name, email address and the time you chose, and anything you write in the booking notes. Because the calendar is served by Cal.com, it may set cookies in its own context when it loads — that is Cal.com’s processing under their privacy policy, not ours, and we have not audited it.

If you came to this site from one of our LinkedIn adverts and book a call, we tell LinkedIn that a booking happened, so we can see which adverts work. We send LinkedIn a one-way scrambled (hashed) copy of your email address and, if you followed an advert, LinkedIn’s own reference for that click. Nothing is stored on your device to do this, and we send nothing else: not your name, the time you chose or anything you wrote. We rely on our legitimate interest in knowing whether our advertising works. You can object at any time by emailing support@fiveleaf.co.uk.

If you sign up for updates

The form at the foot of the homepage takes your email address and nothing else. It is sent to our own inbox through our email delivery provider, and we use it only to send you what we publish. Reply to any update, or email support@fiveleaf.co.uk, and we will take you off the list.

If you email us

We keep the correspondence and your address so we can reply and pick up the thread later.

Internal pages

A small number of internal demo pages are password-protected. Those set one strictly-necessary cookie recording that the password was entered correctly. It holds no personal data and is not used for anything else.

We set no cookies on this website for advertising, analytics or tracking. Our analytics store nothing on your device at all, and the only cookie we set anywhere is the password gate on internal pages, which is strictly necessary for a page you asked to open.

The one thing stored on your device by an ordinary visit is the chat agent’s local storage entry described above. Under the Privacy and Electronic Communications Regulations, storage is exempt from consent when it is strictly necessary for a service you have asked for. A chat you have opened qualifies. A chat you have not opened yet is a weaker case, and we would rather say so here than argue it.

We are changing the agent so that nothing is written until you open it, which removes the question entirely. Until that ships, you can block it by refusing site data for this domain in your browser, and the rest of the site works normally without it.

• Email updates: until you ask to be taken off the list.
• Booking and enquiry correspondence: for as long as there is a live conversation or relationship, and up to 24 months after the last contact.
• Contract and billing records: six years, as required by the Companies Act 2006.
• Aggregate analytics: held by Vercel under their retention schedule. It contains no identifier that could be traced back to you.

Retention for data we process on behalf of clients is a separate matter, set by the client, and covered in section 10 and on the data processing page.

We do not sell personal data and we do not share it for anyone else’s marketing. We use a small number of service providers to run the business:

Each is bound by a contract restricting them to processing on our instructions. We will also disclose data where the law requires it.

Hosting and analytics are primarily UK or EEA where possible. Some service providers operate outside the UK — the AI model and communications platforms in particular are global services.

Where personal data is transferred outside the UK, that transfer is made under an appropriate safeguard required by Chapter V of the UK GDPR, which may be an adequacy decision, the International Data Transfer Agreement, or standard contractual clauses with the UK addendum. We keep documentation of these safeguards and will provide it to a client on reasonable request.

Under the UK GDPR you have the right to:

• Ask what personal data we hold about you, and get a copy.
• Have inaccurate data corrected.
• Have data erased, where we have no overriding reason to keep it.
• Restrict or object to how we use it, including any processing based on legitimate interests.
• Receive data you gave us in a portable format.
• Withdraw consent at any time, where we relied on consent.

Email support@fiveleaf.co.uk and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you came to us first, but you are not obliged to.

This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18 through it.

This is the situation most people reading this page are actually in, and the answer is that this notice is probably not the one you need.

When you chat with an AI agent on another company’s website or WhatsApp number, that company is the data controller. They decide what is collected, why, and how long it is kept. Fiveleaf is their processor: we build and run the agent on their instructions. Your rights are exercised against them, and their privacy notice governs.

We will always help a client answer a request about data in a system we run. If you are not sure who to contact, email us and we will point you to the right controller.

What we do on their behalf, what we can see, how long it is kept and who else touches it is set out on the data processing page.

We update this page when what we do changes, and the date at the top moves with it. If a change materially affects people who have already given us data, we will tell them directly rather than relying on this page being re-read.