Privacy notice

Fiveleaf Ltd is the data controller for personal data collected through this website. We are registered in England, company number 14653555.

For anything in this notice, including a request to exercise your rights under section 8, contact support@fiveleaf.co.uk.

Where we build and run AI agents for a client, that client is the controller and we act as their processor. Section 10 explains the difference and why it matters to which notice applies to you.

Less than most. We have checked this rather than assumed it.

By default, nothing

Browsing the site — the homepage, the blog, the answers hub — creates no cookie, no local storage entry and no identifier of any kind on your device. There is no advertising network, no Meta pixel, no LinkedIn insight tag and no Google Analytics.

Aggregate analytics

We use Vercel Analytics and Vercel Speed Insights to see which pages are read and how quickly they load. Both are cookieless by design: they store no identifier on your device and do not follow you between sites. We see counts and page performance, not people.

If you book a call

The booking calendar is embedded from Cal.com. Booking gives us your name, email address and the time you chose, and anything you write in the booking notes. Because the calendar is served by Cal.com, it may set cookies in its own context when it loads — that is Cal.com’s processing under their privacy policy, not ours, and we have not audited it.

If you email us

We keep the correspondence and your address so we can reply and pick up the thread later.

Internal pages

A small number of internal demo pages are password-protected. Those set one strictly-necessary cookie recording that the password was entered correctly. It holds no personal data and is not used for anything else.

Because we do not set cookies that need consent. Under the Privacy and Electronic Communications Regulations, consent is required for storage that is not strictly necessary for a service you asked for. Our analytics store nothing on your device, and the only cookie we set is the password gate on internal pages, which is strictly necessary by definition.

A banner asking permission for nothing would be theatre. If we ever add analytics or advertising that does require consent, a banner arrives at the same time, and this section will say so.

• Booking and enquiry correspondence: for as long as there is a live conversation or relationship, and up to 24 months after the last contact.
• Contract and billing records: six years, as required by the Companies Act 2006.
• Aggregate analytics: held by Vercel under their retention schedule. It contains no identifier that could be traced back to you.

Retention for data we process on behalf of clients is a separate matter, set by the client, and covered in section 10 and on the data processing page.

We do not sell personal data and we do not share it for anyone else’s marketing. We use a small number of service providers to run the business:

Each is bound by a contract restricting them to processing on our instructions. We will also disclose data where the law requires it.

Hosting and analytics are primarily UK or EEA where possible. Some service providers operate outside the UK — the AI model and communications platforms in particular are global services.

Where personal data is transferred outside the UK, that transfer is made under an appropriate safeguard required by Chapter V of the UK GDPR, which may be an adequacy decision, the International Data Transfer Agreement, or standard contractual clauses with the UK addendum. We keep documentation of these safeguards and will provide it to a client on reasonable request.

Under the UK GDPR you have the right to:

• Ask what personal data we hold about you, and get a copy.
• Have inaccurate data corrected.
• Have data erased, where we have no overriding reason to keep it.
• Restrict or object to how we use it, including any processing based on legitimate interests.
• Receive data you gave us in a portable format.
• Withdraw consent at any time, where we relied on consent.

Email support@fiveleaf.co.uk and we will respond within one month.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you came to us first, but you are not obliged to.

This site is aimed at businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18 through it.

This is the situation most people reading this page are actually in, and the answer is that this notice is probably not the one you need.

When you chat with an AI agent on another company’s website or WhatsApp number, that company is the data controller. They decide what is collected, why, and how long it is kept. Fiveleaf is their processor: we build and run the agent on their instructions. Your rights are exercised against them, and their privacy notice governs.

We will always help a client answer a request about data in a system we run. If you are not sure who to contact, email us and we will point you to the right controller.

What we do on their behalf, what we can see, how long it is kept and who else touches it is set out on the data processing page.

We update this page when what we do changes, and the date at the top moves with it. If a change materially affects people who have already given us data, we will tell them directly rather than relying on this page being re-read.