Privacy Policy

1. Who we are

LaunchUp is run by LaunchUp Ltd, registered in England and Wales (company number 17498191), at 23 Kendal Avenue, Urmston, Manchester, England, M41 8SH. We are registered with the Information Commissioner's Office under number [ICO registration number].

This policy explains how we handle personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR). If you're in the European Economic Area, the EU GDPR gives you the same rights and we apply the same standards.

2. Our two roles

• We are the controller of data about our customers and their users, about visitors to our own website and app, and about businesses we contact to offer our service. This policy covers that data.
• We are a processor for the data your website collects about your own customers and visitors: enquiries, chat messages, contacts, reviews and visit counts. You decide how that data is used. If you're a visitor to a business's website and have a question about your data, contact that business first. Section 7 explains what we do on their behalf.

3. What we collect

4. How and why we use it

UK GDPR requires a lawful basis for each use of personal data. These are ours:

Where we rely on legitimate interests, we've weighed our interests against yours, and you can object at any time (see section 15). We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

5. Google Analytics and Mouseflow

We use two analytics tools on our marketing website and in the LaunchUp app. Neither loads until you accept analytics cookies in our cookie banner. You can change your mind at any time from the cookie settings link in the footer or your account menu, and both stop collecting data straight away.

Google Analytics

We use Google Analytics 4, provided by Google Ireland Limited and Google LLC, to measure how many people visit, how they find us, which pages and features they use, and where they leave. This tells us what's working and what to improve. Google Analytics collects:

• the pages and screens viewed, how long they were viewed, and actions such as clicks, scrolls, sign-ups and starting a trial;
• how you arrived, for example from a search engine, an advert or another website;
• browser, device type, operating system, screen size and language;
• an approximate location (country and city), worked out from your IP address. Google Analytics 4 doesn't log or store IP addresses;
• a random identifier stored in a cookie, so repeat visits can be counted.

How we set it up:

• Consent first. We use Google's Consent Mode. Until you accept analytics cookies, no Google Analytics cookies are set and no identifiable data is sent.
• No advertising. Google Signals, advertising features and ads personalisation are turned off, and we don't link Google Analytics to any advertising account.
• No sharing. We've turned off Google's data sharing settings, so Google doesn't use our analytics data for its own products.
• No personal details sent. We don't send names, email addresses, phone numbers or anything you type into forms to Google Analytics. We remove them from page addresses before they're recorded.
• Not on your customers' websites. Our Google Analytics isn't on the websites we host for you. If you add your own Google Analytics to your website, that's your account, and you are the controller of that data (see section 7).
• Limited retention. Google Analytics data about individual visitors is deleted after 12 months. After that we only keep totals.

Google acts as our processor for Google Analytics under its data processing terms. Data may be transferred to Google LLC in the United States, which is certified under the UK Extension to the EU–US Data Privacy Framework. You can read how Google uses data from sites that use its services. To stop Google Analytics on every website, you can install Google's opt-out browser add-on.

Mouseflow

We use Mouseflow, provided by Mouseflow ApS in Denmark, to understand how people use our marketing website and the LaunchUp app, so we can fix what's confusing and improve what's slow. Mouseflow can record:

• session recordings of a visit (mouse movements, clicks, scrolling and the pages viewed), which we can replay;
• heatmaps showing where people click and how far they scroll;
• funnels and form analytics showing where people drop off;
• technical details such as browser, device, screen size, an approximate location based on IP address (IP addresses are anonymised), and the page you came from.

How we use Mouseflow:

• Only with your consent. Like Google Analytics, Mouseflow doesn't load until you accept analytics cookies. Mouseflow also respects the "Do Not Track" setting in your browser.
• Typing is hidden. We configure Mouseflow to mask everything typed into form fields, so passwords, card details, codes and messages are never recorded. We also hide pages and screen areas that show customer data, such as your inbox, contacts and billing details.
• Not on your customers' websites. We don't put Mouseflow on the websites we host for you, so your visitors aren't recorded.
• Limited access and retention. Only our staff can view recordings, and only to improve the service. Recordings are deleted after 90 days.

If we add or change analytics tools, we'll update this section and ask for consent where it's needed. Mouseflow's own privacy policy is at mouseflow.com. If you want Mouseflow to stop recording you on every website that uses it, you can opt out at mouseflow.com/opt-out.

Analytics without cookies

We also keep basic, aggregate figures about how the app is used and how it's performing, such as error rates, page load times and which features get used. This doesn't use cookies, and it isn't used to profile individuals.

6. Cookies

We use a small number of cookies. Strictly necessary cookies are always on, because the service doesn't work without them. Everything else needs your consent.

You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, you won't be able to sign in.

7. Visitors to our customers' websites

Each business that uses LaunchUp is responsible for its own website and for telling its visitors how their data is used. What we do on their behalf:

• Visit counting. We count page views on the server, without cookies, so the business can see how its website is doing. A visitor is represented by a one-way hash of their IP address, browser and the date, with a secret salt. It changes every day, can't be reversed, and can't be used to follow anyone from one day to the next. We filter out bots and don't store IP addresses alongside these counts.
• Enquiry forms and live chat. What you type is stored for the business and emailed to it so it can reply. Chat uses a random token stored in your browser to keep your conversation going.
• The business's own tools. If the business has added Google Analytics, Google Tag Manager or a Meta Pixel, those tools only load after you accept them in that website's cookie banner. The business is the controller of that data.
• Hosting and security. Like every website, our servers and our network provider (Cloudflare) briefly process your IP address to deliver pages and protect against attacks.

8. AI processing

We use AI models to help design websites, write copy, read a business's existing website or flyer, draw logos and images, draft replies and posts, answer live chat for a business (if applicable), and check how businesses appear in AI assistants. To do this, we send the relevant information to our AI providers (see section 11). That might be your business details, a page of text, or a chat message.

• Our providers process this data to return an answer. Under our agreements with them, they may not use it to train their models.
• We send only what each task needs. Payment details and passwords are never sent.
• Live chat answered by AI tells the visitor they're talking to an assistant. A person at the business can take over at any time.

9. Google account data

If you sign in with Google, we receive your Google account ID, name and email address. We use them only to sign you in.

If you connect your Google Business Profile, we access your business locations, profile details, reviews, posts and performance figures. We use this access only to show them to you, audit the profile, and make the changes, replies and posts you approve. LaunchUp's use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. We don't use Google user data for advertising, we don't sell it, we don't use it to train AI models, and our staff only read it with your permission, for support or security. You can disconnect at any time from SEO > Business Profile or from your Google account settings. When you disconnect, we revoke our access and delete the tokens.

10. Businesses we contact

To find businesses that might want a website, we collect publicly available business information. That includes company details from Companies House, listings on directories such as Yell, Checkatrade and Google, and what a business says on its own website. We use it to build a sample website for the business, and to get in touch by post, phone or email.

• Lawful basis: legitimate interests in offering our service to businesses that may benefit from it.
• What we collect: business name, trading address, business phone number, business email address, website, trade, company number, and the names of company officers where they're published.
• Email: we only send marketing emails to limited companies and LLPs, and only to general business addresses such as info@ or enquiries@. We never email sole traders or partnerships without consent, and we never email a named individual's address.
• Phone: we check numbers against the Telephone Preference Service (TPS) and the Corporate TPS before calling, and we don't call numbers that are registered.
• Opting out: every email has an unsubscribe link, or you can email privacy@launchup.co.uk. When you opt out, we take down any sample website we made for you, and we add your details to a suppression list so you aren't contacted again. We keep that list for as long as we do this kind of outreach, because otherwise we couldn't honour your request.
• We keep information about a business we've contacted for up to 24 months after we last contacted it, unless it becomes a customer.

11. Who we share data with

We use trusted suppliers (processors) to provide the service. Each one only receives what it needs, and each is bound by a contract that requires it to protect the data.

We also share data:

• with domain registries, such as Nominet for .uk, and ICANN, where their rules require registrant details;
• with our professional advisers (accountants, lawyers and insurers), when we need to;
• with the police, regulators or courts, where the law requires it or where it's needed to protect rights and safety;
• with a buyer or investor, if our business is sold or restructured. They would have to protect your data in the same way.

We never sell personal data.

12. International transfers

Some of our suppliers are based outside the UK, mostly in the United States. When personal data leaves the UK, we make sure it is protected in one of these ways:

• the destination has been found to provide adequate protection (UK adequacy regulations), which covers the EEA;
• the supplier is certified under the UK Extension to the EU–US Data Privacy Framework; or
• we use the ICO's International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, together with a transfer risk assessment.

Contact us if you'd like more detail about the safeguard for a particular supplier.

13. How long we keep data

We use soft deletion, which means a deleted item can be restored for a short time if it was deleted by mistake. Soft-deleted data is still covered by the periods above, and is permanently deleted when they end.

14. Security

We protect personal data with encryption in transit (HTTPS) and at rest for sensitive items such as access tokens, secrets and authenticator keys. Passwords and recovery codes are stored hashed. We offer two-step verification, limit staff access to what each person needs, and require our suppliers to meet equivalent standards. No system is completely secure. If we have a breach that puts your data at risk, we'll tell you and the ICO as the law requires.

15. Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• correct data that's wrong or incomplete;
• erase your data in some circumstances;
• restrict how we use it while a concern is looked into;
• data portability: receive data you gave us in a machine-readable format;
• object to processing based on legitimate interests. Objecting to direct marketing always stops it;
• withdraw consent at any time where we rely on it, for example for Google Analytics or Mouseflow, without affecting anything done before.

To use any of these rights, email privacy@launchup.co.uk. We'll reply within one month and won't usually charge. We may need to confirm who you are first. If your request is about data a business collected on its own website, such as an enquiry or a chat, we'll pass it to that business and help them respond.

16. Children

LaunchUp is a service for businesses and isn't intended for anyone under 18. We don't knowingly collect data about children.

17. Changes to this policy

We'll update this policy when our practices change, for example if we start using a new analytics tool. For significant changes, we'll email customers and show a notice in the app before the change takes effect. The date at the top shows when it was last updated.

18. Contact and complaints

For any question about privacy, email privacy@launchup.co.uk or write to LaunchUp Ltd, 23 Kendal Avenue, Urmston, Manchester, England, M41 8SH.

If you're unhappy with how we've handled your data, please tell us first so we can try to put it right. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.