Privacy notice · v4
Privacy notice
Who we are
Appiloom Ltd, company number 17417764, registered in England and Wales, designs, builds and operates digital platforms and products. For the enquiries you send us and the accounts of businesses we work with directly, Appiloom is the data controller. For the customer data that a business collects through its own Appiloom-operated platform (bookings, customer names and contact details), Appiloom is the data processor, acting on that business's instructions. Contact us at [email protected].
What we collect and why
When you send us an enquiry: your name, business name, email or phone number, and whatever you tell us in your message, so that we can reply. When you use an Appiloom-operated platform as a customer of one of our clients: the details that business needs to serve you, such as your name, phone number and booking history, so that the platform can be operated on that business's behalf. Our lawful bases are legitimate interests (replying to enquiries and keeping the service secure), contract (operating the platform for the clients we work with) and legal obligation, where one applies.
Website requests
When you ask us to build you a website, including from the page our letter links to, we collect your name, your role if you give it, your email address and phone number, the name of your business, the domain names you would like and anything you tell us about the website you want. If you choose to give them, we also collect the details needed to register a domain in your business's name: the type of business, its company number, and the registrant's name, address, email address and phone number. If you attach a logo, we keep the file, which only our team can open. If you use the code printed on our letter, we keep that code so we can apply the welcome credit. We use this to reply to you, prepare a quote and, if you go ahead, set up your domain, email and website. Our lawful basis is taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)), and you confirm on the form that we may contact you about the request. Requests that do not lead to a contract are kept for up to 12 months from our last contact; if you become a customer, they become part of your account record. To ask us to delete a request, email [email protected].
Domain checks, letters and security
When you type a name into the domain search, we look it up in the public domain registries (Nominet for .uk and .co.uk, Verisign for .com), so the names you type are sent to them; checking a name does not reserve it. If you go ahead, the registrant details are passed to Cloudflare, Inc., our domain registrar, and through them to the relevant registry, to register the domain in your business's name; we do not share them otherwise and we do not sell them. When the page is opened with the code printed on our letter, we note that it was opened and when, against that letter, so we know whether our letters are useful; we do not record your IP address or device details for this. To protect the form from abuse we use Cloudflare Turnstile and limit how often one address can use the search and the form, and we may keep a salted, one-way hash of your IP address, never the address itself.
The AI chat
This website offers an AI-powered chat built on Claude, a model provided by Anthropic, available on the main pages of this website. When you use it, the message you type and the assistant's reply are sent to Anthropic to generate that reply, and we do not store the content of your chat messages ourselves. Separately, if a conversation looks like a genuine enquiry about working with Appiloom, we generate a short internal summary, not the full conversation, and send it to a private Telegram chat so someone at Appiloom can follow up with you; this happens automatically, at most once per conversation, and only for conversations that look like a real enquiry rather than casual questions. Our lawful basis for both steps is the same legitimate interest as replying to enquiries generally, in a way that is proportionate given how little is collected. Anthropic's own published policy is not to use API conversations like this to train its models, and to delete them from its systems within 30 days by default; unlike that, a Telegram summary is not deleted automatically and stays in that private chat until we remove it (see below). Anthropic is based in the United States and Telegram is operated by Telegram Messenger Inc, with group companies in the British Virgin Islands and Dubai, so using the chat can mean your message is transferred outside the UK; each provider's own terms set out the safeguards that apply. If you share something that looks like sensitive personal information, such as details about your health or finances, our systems are instructed to leave it out of any summary rather than including it; please avoid sharing that kind of detail here in any case. If you would rather not use the chat at all, our contact page reaches us the same way.
Cookies
This website sets a small number of cookies. ap_locale remembers a language you have chosen and is kept for up to a year. Signed-in users of the business portal also get a sign-in cookie and a cookie recording which business they are working in; both are strictly necessary, last up to 30 days, and are cleared when you sign out. When the security check (Cloudflare Turnstile) runs, on the contact form or at the start of a chat conversation, Cloudflare may also set cookies that are strictly necessary for telling people from bots. Separately, this website keeps two small preferences in your own browser rather than in a cookie: whether you have already seen the opening animation, and whether the chat has already introduced itself during this visit. The business portal keeps your light or dark appearance choice the same way. None of that is sent to us. We do not use analytics, advertising or any other tracking cookies.
Sharing
We do not sell personal data. It is shared only with the infrastructure and hosting providers that run the platform on our instructions, with Anthropic, which processes messages sent through the AI chat in order to reply to them (see "The AI chat" above), with Telegram, which delivers the short internal summary described in that same section when a conversation looks like a genuine enquiry, and with Cloudflare Turnstile: to protect the contact form and the start of a chat conversation, it processes limited technical signals from your browser, such as your IP address and browser characteristics, to tell people from bots. Cloudflare states this data is not used to identify or profile individuals. We do not pass personal data to any other third party.
International transfers
Some data may be processed on infrastructure outside the UK, with appropriate safeguards in place where that applies. The clearest examples are both part of the AI chat: Anthropic, which provides the Claude model behind it, is based in the United States, and Telegram, which delivers the short internal summary of a genuine enquiry described above, is operated by Telegram Messenger Inc, with group companies in the British Virgin Islands and Dubai. Each provider's own terms set out the safeguards used for that transfer.
How long we keep it
Enquiries sent through this website are kept for up to 12 months. Backups of platform data are kept for up to 30 days after deletion, after which they are purged in the normal course of backup rotation. We do not store the content of AI chat conversations ourselves, and Anthropic's own default is to delete them within 30 days; see "The AI chat" above. The short internal summary Telegram delivers for a genuine enquiry is the exception: it is not deleted automatically, and stays in our private Telegram chat, in the same way as any other message we send ourselves, until someone at Appiloom removes it.
Your rights
Under UK data protection law you can ask to access, correct, delete or restrict the personal data we hold about you, ask for it in a portable format, or object to how it is used, by writing to us using the address below. You can also complain to the Information Commissioner's Office at ico.org.uk if you are unhappy with how we have handled your data.