Legal
Privacy Policy
Last updated: 29 August 2026
Calyxio Ltd ("Calyxio", "we", "us") is the data controller for personal data collected through this website. This policy explains what we collect, why, how long we keep it, and the rights you have under UK GDPR and the Data Protection Act 2018.
Who we are
Calyxio Ltd
167–169 Great Portland Street, London, W1W 5PF, United Kingdom
Contact: hello@calyxio.ai
[Placeholder — confirm and insert your registered company number here before launch.]
What we collect, and why
| Where | What we collect | Why (lawful basis) |
|---|---|---|
| Contact form | Name, work email, company, your message, urgency | Legitimate interest — responding to your enquiry, which you initiated |
| Readiness Assessment | Your quiz answers, chosen focus area and, only if you provide it, your work email | Consent — the email step is optional and clearly opt-in |
| Cookie preference | Your accept/reject choice, stored locally in your browser | Legitimate interest — remembering your choice |
| All pages | Basic technical/security logs (e.g. IP address, timestamp) via our hosting provider, used only for abuse prevention (see Bot & Spam Protection below) | Legitimate interest — securing the site |
We don't use analytics or advertising cookies at present. See our Cookie Policy for details and how that would change if we add analytics in future.
Bot & spam protection
To stop automated abuse of our forms, submissions are checked with Cloudflare Turnstile, a privacy-preserving challenge that runs without tracking you across sites, plus basic rate-limiting and a hidden honeypot field. Turnstile may process your IP address and browser signals for this sole purpose; see Cloudflare's privacy policy.
Who we share it with
We use a small number of processors to run this site and respond to enquiries:
- Resend (email delivery) — delivers form submissions to our inbox. Resend's privacy policy
- Vercel (hosting) — serves the website and runs the form's backend function. Vercel's privacy policy
- Cloudflare (Turnstile bot protection) — see above.
These providers may process data outside the UK/EEA (e.g. in the United States). Where that happens, we rely on their Standard Contractual Clauses and equivalent safeguards. We do not sell personal data, and we don't share it for advertising purposes.
How long we keep it
Enquiry and assessment data sent to our inbox is kept for as long as reasonably needed to respond and follow up — typically no longer than 24 months, unless you become a client (in which case it becomes part of the ordinary engagement record) or ask us to delete it sooner.
Your rights
Under UK GDPR, you have the right to:
- – Access the personal data we hold about you
- – Have inaccurate data corrected
- – Ask us to delete your data ("right to be forgotten")
- – Restrict or object to how we use it
- – Receive your data in a portable format
- – Withdraw consent at any time, where we rely on consent
To exercise any of these, email hello@calyxio.ai. We'll respond within one month. You also have the right to complain to the UK Information Commissioner's Office (ICO) if you're unhappy with how we've handled your data.
Children's data
This site is intended for business audiences and isn't directed at children. We don't knowingly collect data from anyone under 16.
Changes to this policy
We'll update the date at the top of this page when this policy changes. Material changes will be reflected here before they take effect.