Privacy Policy.

Last updated: June 2026

1. Who we are

Staple & Code is the data controller for personal data collected through this website. Contact: hello@stapleandcode.ai

2. What data we collect

Website visitors: Name and email address if you submit a contact or booking form. Basic usage data via analytics (pages visited, browser type, approximate location).

Customers: Business contact details (name, job title, company, email). Contract documents you submit for review, which may contain personal data relating to third parties. Communications via email or Slack.

3. How we use your data

To respond to enquiries and book calls.
To scope, deliver, and invoice for services.
To process and review contracts you submit.
To comply with legal obligations.

4. Legal basis (UK GDPR)

Legitimate interests: responding to enquiries, delivering services, improving our systems.
Contract performance: where you are a customer.
Legal obligation: where required by law.

4a. Legal basis (EU GDPR)

If you are located in the European Economic Area, we process your personal data under the EU General Data Protection Regulation (2016/679). The legal bases are the same as set out in section 4: legitimate interests, contract performance, and legal obligation.

Your rights under EU GDPR are the same as those set out in section 9, which applies to both UK and EEA individuals. To exercise them, contact hello@stapleandcode.ai.

5. Contract documents

When you submit a contract for review, you may be sharing personal data belonging to third parties (counterparty names, contacts, or employees). You are responsible for ensuring you have a lawful basis to share that data with us. We process it solely to deliver the contracted service.

6. Data retention

We retain contact enquiry data for 12 months. Customer data, including contract inputs and outputs, is retained for the duration of the engagement and for 3 years afterwards, unless you request earlier deletion or we are required to retain it by law.

7. Who we share data with

We do not sell personal data. We share it only with:

Technology providers used to deliver the service (e.g. cloud infrastructure, AI processing).
Professional advisers under confidentiality obligations.
Regulators or courts where required by law.

All processors are subject to data processing agreements.

8. International transfers

Some of our technology providers process data outside the UK or EEA. Where data is transferred from the EEA to the UK, we rely on the European Commission's adequacy decision for the UK. Where data is transferred to other third countries, we use UK International Data Transfer Agreements or EU standard contractual clauses as appropriate. We do not transfer personal data to countries without adequate protections in place.

9. Your rights

Under UK GDPR and EU GDPR, you have the right to access, correct, delete, or restrict processing of your personal data, and to object to processing based on legitimate interests. This section applies to both UK and EEA individuals. To exercise any right, contact hello@stapleandcode.ai. We will respond within one month.

We comply with mandatory data breach notification obligations, including the requirement to notify the relevant supervisory authority within 72 hours where a breach is likely to result in risk to individuals.

10. Cookies

This website does not use cookies. We use Plausible Analytics to collect basic usage data (pages visited, browser type, approximate location). Plausible is cookieless by design and does not track individuals across sites or sessions. No personal data is collected or stored by our analytics tool. You do not need to accept or reject cookies to use this website.

11. Changes

We may update this policy. The current version is always published at stapleandcode.ai/privacy with the date it was last updated.