Privacy notice
How we use information when you visit this website or contact us. Last updated: 5 November 2026.
1. Who we are
We operate this website as Northlane. We decide how information from our website visits and enquiries is used, which makes us its controller for those purposes. For privacy questions, requests or complaints, email [email protected].
This notice covers our website and enquiries. If a project involves additional personal information or processing on your behalf, we will explain those arrangements before that work starts.
2. Enquiries and website visits
Preparing an enquiry. Our contact tool prepares an email draft on your device. It asks for your name and message, with optional business name, town, website needs and package choice. Opening the draft does not send it to us. Copying places the draft on your clipboard, where your device and applications control how long it remains. You can also email us directly.
Receiving your message. When you send an email, we receive your email address, message and any details or attachments you include. We use them to answer your enquiry and discuss the website you need. Your email provider also handles the message under its own terms. Please leave out passwords, payment details, health information and other sensitive personal information.
Where you ask us to take steps towards a contract with you personally, including as a sole trader, our lawful basis is taking those requested steps before a contract. For other business correspondence, including contact with a company's staff, we rely on our legitimate interests in answering enquiries and discussing our services. Giving us information is your choice, but we need a way to contact you if you want a reply. We do not add enquirers to a marketing mailing list.
Delivering and protecting the website. Cloudflare processes technical information such as IP addresses, requested pages, request times and browser information. Supported browsers may also send connection-error reports to Cloudflare under the site's Network Error Logging headers. Our lawful basis is our legitimate interests in providing a working, secure website. Optional analytics is explained in section 6.
The businesses in our concept websites are fictional. Their enquiry and booking actions are disabled; please use sample information in their tools.
3. AI-assisted website work
We use OpenAI tools, including ChatGPT and Codex, and Anthropic tools, including Claude and Claude Code, to help write, build and edit websites. We use personal subscription accounts with model-improvement training turned off.
We use these tools with non-personal, non-confidential business content and sample details. We keep people's names, personal contact details, identifiable photographs, private enquiry emails, customer lists, passwords and sensitive records outside them. A business name, location, logo or combination of facts can also identify a person, so removing their name alone is not enough. We add actual identifying details locally, outside the AI workspace, and ask the client to approve the completed website before publication.
These providers receive the material entered into their tools and handle it under their consumer privacy terms, including processing for service delivery, safety and legal purposes. Turning off training does not mean zero retention or prevent all authorised human review. See OpenAI's privacy policy and Anthropic's privacy policy. We review the resulting work before use.
4. Providers and overseas processing
- Proton Mail, operated by Proton AG: receives and stores our email and sends our replies. Proton lists its mail servers in Switzerland, Germany and Norway, with encrypted backups kept for up to 30 days. See its Mail privacy policy and data processing agreement.
- Proton Drive, operated by Proton AG: stores website recovery copies in our existing account. File contents and names are end-to-end encrypted. Proton lists its Drive servers in Switzerland, Germany and Norway. See its Drive privacy policy and data processing agreement.
- Cloudflare: hosts, delivers and protects this website and provides Web Analytics. Its data processing addendum covers instructed processing; its privacy policy explains processing for its own purposes, including network protection.
- OpenAI and Anthropic: receive the limited website material explained in section 3. Their consumer services also process information for their own purposes, as explained in the policies above.
Processing can take place outside the UK, including in the United States. The UK recognises Switzerland and the European Economic Area, including Germany and Norway, as providing adequate protection. Cloudflare's published transfer terms include standard contractual clauses with the UK Addendum for relevant restricted transfers. OpenAI and Anthropic describe their international transfers and safeguards in the policies linked above. Contact us for information about the safeguards relevant to your information.
We share relevant information with authorities or professional advisers only where legally required or necessary for a specific matter. We do not sell personal information or share it for advertising.
5. How long we keep information
- Enquiries that do not lead to work: 12 months after the last message, then deleted from our active correspondence and working copies.
- Information needed for an agreed project: for the period needed to deliver and maintain the agreed website. Any additional project-record or processing arrangements are explained before the work starts. We remove website material from active AI conversations when it is no longer needed for that work.
- Website recovery copies: project-specific backup scope, retention and deletion arrangements are agreed before client work starts. These copies are separate from Proton's own backup systems. Removing a Drive file to Trash alone does not permanently delete it or its earlier versions.
- Privacy requests, complaints or disputes: for the period needed to handle the matter and retain a proportionate record of our response. A specific legal duty or claim may require limited information to be kept longer, with its use restricted to that purpose.
- Provider records: deletion from an active system may be followed by backup expiry. Proton's encrypted backups can remain for up to 30 days. Cloudflare makes the previous six months of Web Analytics available; this is not a deletion deadline for every technical or security record. Its own retention criteria are explained in its privacy policy.
OpenAI and Anthropic retain AI content under their service policies, including safety or legal exceptions. Deleting a conversation does not guarantee immediate removal from every provider system. Their linked policies explain the applicable periods and exceptions.
7. Your rights
Depending on the information and applicable legal conditions, you can request access, correction, erasure, restriction or a portable copy. You can object to processing based on legitimate interests. We will consider your circumstances and stop that processing unless the law allows us to continue, for example because of compelling overriding grounds or a legal claim.
Email us to make a request. We normally respond within one month; if a lawful extension or identity check is needed, we will explain it. There is normally no fee. We do not make decisions about you with legal or similarly significant effects solely by automated means. Sending an enquiry is not consent to unrelated uses of your information.
8. Complaints
Email [email protected] if you are unhappy with how we handle your information. We acknowledge data-protection complaints within 30 days, investigate, keep you informed and explain the outcome without undue delay. You can also complain to the Information Commissioner's Office. You do not have to complain to us first.
9. Changes to this notice
We update this page and its date when our processing changes. Where a change materially affects how we use your information, we will provide an appropriate notice.