Who We Are
Quackstart.Labs ("we", "us", "our") is an AI consultancy and software products company that helps small and medium-sized businesses adopt artificial intelligence and blockchain technology. We provide strategic advisory services, custom-built AI solutions, team training, and a suite of software products including ConciergeAI, ChainProof, FlowMind, and BriefBot.
We operate globally on a remote-first basis. For the purposes of data protection law, Quackstart.Labs is the data controller in respect of personal information collected through our website and services.
Our contact details are set out in Section 12 of this policy.
Information We Collect
Information you provide directly
When you use our website contact form or book a discovery call, we collect:
- Your name and email address
- The industry or sector your business operates in
- Which of our services or products you're interested in
- Any additional information you choose to share in your message
Information collected automatically
When you visit our website, we may automatically collect certain technical information:
- Your IP address and approximate geographic location (country/region level)
- Browser type, version, and operating system
- Pages visited, time spent on pages, and referring URL
- Device type (desktop, mobile, tablet)
Information from client engagements
If you become a client, we may process additional information necessary to deliver our services — including business process data, staff information, and operational details you share with us during the engagement. This is governed by a separate Data Processing Agreement.
We do not collect: payment card details (handled by our payment processor), sensitive personal data such as health or biometric information, or personal data about children under 16.
How We Use Your Information
We use the information we collect for the following purposes:
| Purpose | Description |
|---|---|
| Responding to enquiries | To review your contact form submission and respond to your request for information or a discovery call. |
| Service delivery | To provide and manage AI consultancy services, product access, and training engagements you have contracted with us. |
| Service communications | To send information directly related to your engagement — such as onboarding details, project updates, and support responses. |
| Marketing (with consent) | To send case studies, product updates, and insights relevant to AI adoption — only where you have explicitly opted in. |
| Product improvement | To analyse how our website and products are used. Only aggregated or anonymised data is used for this purpose. |
| Legal compliance | To meet obligations under applicable law, including financial record-keeping and responding to lawful requests. |
We do not use your personal data for automated decision-making that produces legal or similarly significant effects without human review.
Legal Basis for Processing
Where the GDPR or equivalent data protection law applies (including for individuals in the UK, EU, and EEA), we rely on the following legal bases:
- Legitimate interests — for responding to enquiries and improving our services, where our interests do not override your rights and freedoms.
- Contractual necessity — to deliver services you have engaged us to provide.
- Consent — for marketing communications. You may withdraw consent at any time by emailing us or using the unsubscribe link in any email.
- Legal obligation — where processing is required to comply with applicable law.
Who We Share Data With
We do not sell, rent, or trade personal data. We share data only in the following limited circumstances:
Service providers
We work with a small number of trusted third-party providers who process data on our behalf and under our instruction:
- Email & CRM — to manage enquiry responses and client communications
- Analytics — to understand website usage (using privacy-respecting tools configured to anonymise IPs)
- Cloud hosting & infrastructure — to host our website and product services securely
- Payment processing — handled by PCI-DSS compliant processors; we do not store card data
- AI model providers — see Section 6 for our specific disclosure on AI processing
All third-party providers are subject to appropriate data processing agreements and are required to handle data in accordance with applicable law.
Legal requirements
We may disclose personal data if required to do so by law, court order, or government authority, or where we believe in good faith that such disclosure is necessary to protect our legal rights or the safety of others.
Business transfers
In the event of a merger, acquisition, or sale of all or part of our business, personal data may be transferred to the relevant third party. We will notify affected individuals before data is transferred and becomes subject to a different privacy policy.
AI Processing Disclosure
As an AI services company, we believe in being transparent about how AI is used in our own operations.
When you contact us: Your enquiry may be reviewed or summarised using AI-assisted tools to help us understand your needs and route your request to the right team member. A human always reads your message and makes the decision on how to respond.
Our AI products
If you engage with our products — such as ConciergeAI — on behalf of a client business, the AI interactions that take place are processed in accordance with the data processing agreements established with that client. Those agreements specify what data is processed, for what purpose, and on what basis.
AI model providers
Our products and internal tools may use AI models from third-party providers. When client or personal data is processed through these models:
- We use providers with appropriate data protection agreements in place
- We configure models to avoid training on client or personal data where such controls are available
- We disclose specific providers to clients as part of our onboarding process
No autonomous decisions about you
We do not use AI to make autonomous decisions that have legal or similarly significant effects on individuals who interact with our website or marketing. All material decisions are made or reviewed by a human.
Cookies & Tracking
Our website uses a minimal set of cookies. We do not use advertising or behavioural tracking cookies.
| Type | Purpose | Duration |
|---|---|---|
| Strictly necessary | Required for the website to function — for example, remembering form state during a session. | Session |
| Analytics | Aggregated, anonymised data on how pages are used. IP addresses are anonymised before storage. | Up to 13 months |
You can control cookies through your browser settings. Disabling analytics cookies will not affect your ability to use the website. If we introduce additional cookies in future, we will update this policy and, where required by law, seek your consent.
Data Retention
We retain personal data only for as long as necessary for the purpose for which it was collected, and in accordance with our legal obligations.
- Enquiry data — retained for 12 months from last contact, then deleted unless a client relationship has been established
- Client engagement data — retained for the duration of the engagement plus 7 years to meet legal and financial record-keeping requirements
- Marketing contacts — retained until you withdraw consent or request deletion, plus a brief suppression period to honour your opt-out
- Analytics data — retained in aggregated, anonymised form indefinitely; IP-level data deleted after 13 months
When data is no longer needed, it is securely deleted or irreversibly anonymised.
Your Rights
Depending on where you are located, you may have the following rights in relation to your personal data. We honour these rights regardless of jurisdiction — we don't use geography to narrow your entitlements.
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate or incomplete data
- Erasure — request deletion of your data, where we have no overriding legal obligation to retain it
- Restriction — ask us to pause processing of your data in certain circumstances
- Portability — receive your data in a structured, machine-readable format and transfer it to another controller
- Objection — object to processing based on legitimate interests, including direct marketing
- Withdraw consent — where processing is based on your consent, withdraw it at any time without affecting the lawfulness of prior processing
To exercise any of these rights, contact us at the details in Section 12. We will respond within 30 days. In most cases there is no charge; we may charge a reasonable fee only where requests are manifestly unfounded or excessive.
You also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office at ico.org.uk.
Data Security
We take the security of personal data seriously and maintain appropriate technical and organisational measures to protect it against unauthorised access, loss, or disclosure.
- Encryption of data in transit (TLS) and at rest
- Access controls and least-privilege principles for all internal systems
- Regular security reviews of our tools, providers, and configurations
- Multi-factor authentication for all accounts with access to personal data
- Vendor security assessments for third-party providers
In the event of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected individuals without undue delay.
International Transfers
As a globally operating, remote-first business, your data may be processed in countries outside your own — including countries that may not have equivalent data protection laws.
Where we transfer personal data outside the UK or EEA, we ensure an appropriate safeguard is in place, such as:
- An adequacy decision by the relevant authority
- Standard Contractual Clauses (SCCs) approved by the European Commission
- The UK International Data Transfer Agreement (IDTA)
You can request details of the specific safeguards in place for any transfer by contacting us.
Contact & Complaints
If you have questions about this policy, want to exercise your rights, or have a concern about how we handle your data, please reach out. We aim to respond to all privacy-related requests within 5 business days.
For all data protection and privacy enquiries:
If you are not satisfied with our response, you have the right to complain to your local data protection authority. We would always prefer to resolve concerns directly with you first.
Updates to this policy
We may update this privacy policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the "Last updated" date at the top of this page. If changes are significant, we will notify active clients directly.