Last updated: 10 November 2026

Who we are

Louis Williams trading as Cyborg Group is the controller of the personal data described here. Louis is a sole trader, not a limited company.
Address: 91 Cedar Way, Penarth, CF64 3PW, United Kingdom. Email: [email protected]. Phone: 07417 511 880.
This notice explains our use of personal information under the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Enquiries and client work

When you contact us, we receive your name, email, message and any optional phone, company, service, product interest, project requirements, budget, timescale and referral details you supply. We store enquiries in our suite and CRM so that we can reply, prepare a quote and manage the relationship. Product interest is an enquiry, not a mailing-list subscription.
Form security and attribution records can include an IP address, browser, page and referral information. Existing enquiry, Funnel and server-security records may contain a full IP address. This is separate from our first-party Analytics module, which never stores the full visitor IP.
We also process correspondence, contact and billing details and information needed to provide agreed services. Please do not send sensitive personal information through a general form or chat.

Why we use information

We do not sell personal information. We do not add enquiry contacts to marketing lists automatically. Any separate marketing must have its own lawful basis and comply with PECR.

Anonymous website statistics before a choice

Before you choose, our first-party script may add to anonymous totals for the day, page, broad device type, event, scroll threshold and time spent. The aggregate table contains no session or visitor ID, IP address, IP hash, form-field name, campaign, screen dimensions or geography. Its temporary tab ID stays in your browser and is not sent to us. These totals cannot be joined into an individual journey or linked to an enquiry.
The sole purpose is to understand and improve this website, not to identify people, advertise or make decisions about them. We rely on the applicable PECR statistical-purpose exception for the limited browser storage and our legitimate interests where UK GDPR applies. Legitimate interests does not replace consent for non-exempt tracking.
You can object free of charge at any time: open Cookie settings and choose Reject analytics. Rejection stops these totals as well as detailed analytics. We also stop all analytics when your browser sends Do Not Track (DNT) or Global Privacy Control (GPC), even if you previously accepted.

Detailed analytics after permission

Only after you allow analytics, we record random visitor, session and event IDs; public page paths without query strings; referrer host and sanitised campaign tags; active time; scroll thresholds of 25, 50, 75 and 100%; navigation, CTA and outbound-link clicks; 404 visits; and form starts, field names touched, abandonment and successful submission.
We record field names, never the values you type, in first-party analytics. Device type, browser, operating system, language, screen and viewport dimensions help us identify layout problems. We do not infer your age, gender or other demographic traits.
For approximate location, a local DB-IP Lite database can look up country and city on our own server. Your IP is not sent to an external geolocation service. Location is approximate, may be absent and can be wrong.
The Analytics module stores only a truncated IP prefix, /24 for IPv4 or /48 for IPv6, plus a daily-salted hash. The full IP is used transiently to receive the request and perform the local lookup, then is not saved in Analytics. A separately scoped, short-lived daily hash protects the collector against abuse. A prefix or hash is not proof of your identity.
With analytics consent, a successfully saved enquiry or Funnel lead can be linked to its journey by record ID. Contact details and message contents are not copied into analytics tables. Our dashboard uses rules to describe trends, not external AI or automated decisions about people.

Google Analytics 4 and Microsoft Clarity

These services are used only if we configure their project IDs and you allow analytics. They are not loaded before permission. GA4 is provided by Google and helps measure website use. Advertising storage, advertising personalisation and Google Signals are disabled in this site's integration; we do not currently enable demographic reporting.
Microsoft Clarity can produce session recordings and heatmaps after permission. Forms and the concierge chat are masked in our integration, and advertising storage is denied. Clarity may still process page and device interaction data. Do not include personal information in URLs or other public page content.
Our own retention setting does not erase data already held by Google or Microsoft. Provider settings, their privacy terms and their own retention schedules apply. Clarity normally retains playback data for 30 days and click/heatmap data and labelled or favourited sessions for up to nine months, as described in its documentation.
See Google's privacy policy, Microsoft's privacy statement and our Cookie Policy for storage and withdrawal details.

Our AI concierge

The default guide is the hosted Cyborg AI service at ai.cyborggroup.com. Its loader is requested when you open the guide; visitors who allow analytics may also preload it at idle. A tab where you already requested the guide can resume it. Rejecting website analytics does not prevent chat that you explicitly request.
The widget stores a random conversation ID, the last 16 chat entries, guide state, tour progress and whether the guide is open in your browser's session storage, normally until the tab closes. Our site also remembers your request to use the guide for that tab. Starting a new chat clears the widget's local conversation and tour state.
When you ask a question, the hosted service can store limited user and assistant messages, conversation state, selected guide options, navigation or tour events and submitted enquiries in its tenant database. The current message records are limited to 600 characters each. Common email and phone patterns are masked in question records, but this is not a guarantee that every personal detail is removed. Please do not enter sensitive or confidential information.
The guide may answer locally or reuse a cached answer. When a model is needed, limited question text and selected website information are processed by Anthropic through its Claude API. Automated replies may be inaccurate, so check important details with us. Operational usage logs contain status and token counts rather than prompts or replies; the separate conversation database can still contain messages. Chat and tour records support the requested guide and are separate from our consent-gated website analytics.
Enquiry details such as name, email, company and message are saved when you submit the guide's enquiry form. On a client's website, that client's privacy notice and our processor agreement also apply.
There is currently no automatic chat-message retention timer in the hosted product. Server chat and operational records require manual review and deletion. Its answer cache normally expires after seven days and expired cache entries are removed by product maintenance; this does not erase conversation messages. Contact us about access or erasure rather than assuming the Analytics purge covers chat.
If the hosted guide is disabled or its site key is empty, our built-in guide is used instead. It keeps the last 12 chat entries and an unsent contact draft in tab session storage. It sends questions to our suite and may use Anthropic or cached replies. Its model-usage log does not record question text or full IPs. Cached answers and routing decisions normally remain reusable for seven days, but expired files need separate deletion.
Anthropic's standard commercial API policy normally deletes inputs and outputs within 30 days, subject to contractual, safety and legal exceptions. We do not claim a zero-data-retention arrangement. See Anthropic's commercial retention notice.

Providers and international processing

We use hosting, email and other business-service providers to operate the website, answer enquiries and deliver work, plus Anthropic when the AI service is used and Google or Microsoft when the optional services above are enabled. We may share information with professional advisers or where required by law.
Some providers process information outside the UK. Applicable UK adequacy decisions or contractual safeguards, such as the UK Addendum or International Data Transfer Agreement, are needed where required. Ask us for details of the providers and safeguards relevant to your data. We do not promise that all processing stays in the UK.
When we process a client's customers' information to provide hosting, websites or AI tools, the client will normally be the controller and we act on their instructions as a processor under our service agreement.

Retention and security

Our first-party analytics has a default retention of 13 calendar months, including detailed events, conversion links and anonymous totals. The suite purge runs through its scheduled maintenance. The setting is configurable, so any change to the live retention period must be reflected in this notice. Security rate-limit buckets expire after one day; short-lived daily salts are rotated and purged separately. The local geographic reference is public reference data, not a visitor record.
We keep enquiry, CRM and client records for as long as needed to answer the enquiry, manage the relationship and meet accounting, legal or dispute-resolution duties. Server logs, backups, chat records and external-provider data follow separate schedules; they are not all covered by the Analytics purge. Please contact us for the schedule relevant to your records.
We use access controls and appropriate technical safeguards. No service can guarantee absolute security. We will notify affected people and the ICO where required by law.

Your choices and rights

Open Cookie settings to reject analytics or withdraw permission. Withdrawal stops future collection and vendor loading; it does not automatically erase information lawfully collected earlier. Browser DNT or GPC also blocks analytics. Blocking all cookies may prevent secure forms or admin sign-in from working.
Under the UK GDPR, rights can include access, correction, erasure, restriction, objection and portability, depending on the basis and circumstances. You can object to processing based on legitimate interests and withdraw consent without affecting earlier lawful processing. Contact [email protected]. We normally respond within one month and may need to verify your identity.
You can complain to the Information Commissioner's Office, the UK data protection regulator, or call 0303 123 1113. You do not have to contact us first.