Privacy Policy

Last updated: 20 July 2026

1. Who We Are

CRUMBLX AI LTD is a company registered in England and Wales (company number 16961442) with its registered office at 4 Bunnsfield, Welwyn Garden City, AL7 2DZ, United Kingdom. We trade as crumbless.agency (the managed growth agency arm of the business) and crumbless.ai (the product arm).

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, we are the “data controller” for personal data we collect through our website and in the course of providing our services.

We are registered with the Information Commissioner’s Office (ICO). Our registration number is available on request or via the ICO’s public register.

2. What Data We Collect

We collect only the minimum personal data necessary to operate our website and deliver our services. We never buy, rent, or trade personal data.

2.1 Enquiry Data

When you submit our book-a-call form, we collect:

• Name — so we can address you personally.
• Work email — so we can respond to your enquiry.
• Brand URL (optional) — so we can review your brand before the call.
• What you want to fix (optional) — so the call opens with substance, not slides.

This data is submitted voluntarily by you. We do not use any pre-submission tracking or form analytics. No third-party form provider is involved — submissions are handled on our own infrastructure.

2.2 Website Analytics

We use Cloudflare Web Analytics to understand aggregate website usage (page views, performance metrics). Cloudflare Web Analytics is privacy-first by design:

• It does not use cookies.
• It does not track individual users across sites.
• It does not collect personal data or create user profiles.
• It does not fingerprint visitors.

No cookie consent banner is required, and no data from Cloudflare Web Analytics is used for advertising, retargeting, or any purpose other than understanding aggregate site performance. See our Cookie Policy for full detail.

2.3 Client Data

If you engage our services, we collect the information necessary to deliver the Service as defined in your service agreement. This typically includes:

• Contact details for your designated point(s) of contact (name, email, phone).
• Billing and payment information.
• Access credentials for your advertising accounts, analytics platforms, and content management systems (to the extent you grant us access).
• Any brand assets, style guides, customer personas, or performance data you choose to share with us.

The specific scope of client data processing is defined in your individual service agreement.

3. How We Use Your Data

We use personal data only for the specific purpose for which it was collected, and only to the extent necessary for that purpose:

• Enquiry data: to respond to your enquiry, schedule and prepare for a call, and follow up as appropriate. We do not add enquiry data to any marketing list without your explicit consent.
• Analytics data: to understand aggregate website usage, identify performance issues, and improve the site. We do not attempt to de-anonymise analytics data or combine it with other data sources to identify individuals.
• Client data: to deliver the Service as defined in your service agreement — managing campaigns, creating content, producing reports, and communicating with you about your account.

We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects. We do not sell, rent, or trade personal data to any third party.

4. Lawful Basis for Processing

Under UK GDPR, we process personal data on the following lawful bases:

5. Client Data Processing

When we process personal data on your behalf in the course of providing the Service (for example, when managing your advertising accounts or analysing your customer data), we act as a “data processor” and you act as the “data controller.”

In this capacity, we commit to:

• Processing personal data only on your documented instructions, as set out in your service agreement.
• Ensuring that any personnel who access that data are subject to appropriate confidentiality obligations.
• Implementing and maintaining appropriate technical and organisational measures to protect the data.
• Notifying you without undue delay if we become aware of a personal data breach affecting your data.
• Assisting you in responding to data subject rights requests relating to data we process on your behalf.
• At your choice, deleting or returning all personal data to you at the end of the engagement, unless we are required by law to retain it.
• Making available to you all information necessary to demonstrate compliance with our data processing obligations.

Where we engage any sub-processor in the delivery of the Service (such as our cloud infrastructure provider), we shall ensure equivalent data protection obligations are contractually imposed on that sub-processor and shall remain fully liable to you for their performance.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law:

• Enquiry data: up to 12 months after your last interaction with us, after which it is deleted. If your enquiry leads to a client relationship, the data is retained as client data.
• Client data: for the duration of the engagement plus 12 months after termination, to allow for a smooth handover and to address any post-termination queries. Financial records are retained for 6 years from the end of the financial year in which the transaction occurred, as required by UK tax law.
• Analytics data: Cloudflare Web Analytics retains aggregate, non-personal data in accordance with Cloudflare’s data retention policies.

7. Who We Share Data With

We share personal data only where necessary and only with trusted providers who are contractually bound to equivalent data protection standards:

We do not share personal data with any advertising networks, data brokers, analytics companies (beyond the privacy-first Cloudflare Web Analytics described above), or any other third party for their own commercial purposes. We will disclose personal data if required to do so by law, court order, or regulatory authority.

8. International Transfers

Our website is hosted on Cloudflare Pages. Cloudflare operates a global network and may process data at edge locations worldwide, including in the United States. Cloudflare, Inc. participates in the EU-US Data Privacy Framework, the UK Extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework, which provide adequate safeguards for international data transfers. Cloudflare also relies on Standard Contractual Clauses (SCCs) approved by the European Commission and the UK Information Commissioner.

9. How We Protect Your Data

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction:

• Encryption: all data in transit is encrypted via HTTPS/TLS. Data at rest is encrypted by our infrastructure provider.
• Access control: access to personal data is restricted to personnel who need it to perform their role. Access is granted on a least-privilege basis and is regularly reviewed.
• Operational security: we maintain security practices including secure credential management, regular software updates, and principle-of-least-access across all systems.
• Breach response: we have procedures in place to detect, investigate, and respond to personal data breaches. We will notify affected individuals and the ICO where legally required.

10. Your Rights

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct inaccurate or incomplete data.
• Right to erasure (“right to be forgotten”) — you can ask us to delete your personal data in certain circumstances.
• Right to restriction of processing — you can ask us to limit how we use your data in certain circumstances.
• Right to data portability — you can ask us to provide your data in a structured, commonly used, machine-readable format and, where technically feasible, to transmit it directly to another controller.
• Right to object — you can object to processing based on legitimate interests, including for direct marketing purposes (we do not engage in direct marketing, but the right applies nonetheless).
• Right to withdraw consent — where processing is based on consent, you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Rights relating to automated decision-making — we do not engage in automated decision-making that produces legal or similarly significant effects, but the right applies insofar as the law provides.

To exercise any of these rights, contact us at [email protected]. We will respond within one month (which may be extended by a further two months for complex or numerous requests, in which case we will inform you within the first month). There is no fee for exercising your rights unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act.

We may need to verify your identity before fulfilling certain requests. This is to ensure personal data is not disclosed to someone who does not have the right to receive it.

11. Cookies and Analytics

crumbless.agency does not use tracking cookies, advertising cookies, or analytics cookies that identify individual users. Full detail is set out in our Cookie Policy.

12. Children’s Data

Our website and services are not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

13. Changes to This Policy

We may update this policy from time to time to reflect changes in our practices, legal obligations, or the law. We will notify active clients of material changes at least 30 days before they take effect. The latest version is always available at this URL, with the effective date stated at the top of the page.

14. Contact and Complaints

For any privacy-related enquiries or to exercise your data rights, contact us at:

Email: [email protected]
Post: CRUMBLX AI LTD, 4 Bunnsfield, Welwyn Garden City, AL7 2DZ, United Kingdom

You have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO), the independent regulator for data protection in the United Kingdom. You can contact the ICO at:

Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the opportunity to address your concerns directly before you contact the ICO. Please reach out to us first at [email protected].