Privacy Policy
This notice explains how we handle personal data when you browse this site, contact us, request a meeting, apply for work or use its interactive features. Read it alongside our Cookie Policy and Website Terms & Conditions. Separate client agreements may explain additional processing when we deliver a service.
1. Who is responsible for your data
Neovogent AI Solutions UK Ltd is the data controller for personal data collected through this website. Registered office: Suite 5, The Cloisters, 11–12 George Road, Edgbaston, Birmingham B15 1NP. Contact: hello@neovogent.com.
Registered in England and Wales. Company number: 15946429.
2. What we collect
We collect information you send us, technical data needed to deliver and secure the site, and advertising measurement data as described below:
- Contact form and NeoChat enquiry form: your name, email address, and, if you give them, your company, phone number, area of interest and message. If you send the NeoChat enquiry form, the conversation you had with NeoChat is sent with it.
- Website brief and meeting request: your name, email address, location, phone number and business name; your answers about the website you want (type, budget, what you need); the meeting date, time and app you choose, and your device’s time zone.
- Job applications: your name, email address, phone number, the role you are interested in, what you tell us about yourself, and the CV file you upload (PDF or Word, up to 4 MB).
- NeoChat, if made available: the assistant is currently paused on the public website. If re-enabled, messages are used to generate replies. Conversation content is not stored as chat history, but is included if you explicitly send a chat enquiry. Usage records contain a random browser id, a coded IP address and, for a connected model, usage/cost information for fair-use controls.
- Case-study ratings and comments: the stars you give, and the name and comment you post. Approved comments are published on the site with the name you gave.
- Technical data: our application uses a keyed, one-way hash of your IP address for abuse prevention and removes those stored hashes after 30 days. This does not mean your IP address is never processed: hosting, delivery and enabled third-party services receive network information, and infrastructure/security logs may contain request metadata.
We use Google Analytics 4 to understand website traffic and successful form submissions, and Meta Pixel and Meta Conversions API to measure advertising. Browser measurement starts automatically unless you have opted out or your browser sends a supported privacy signal. See section 9 for the data involved and how to switch it off.
3. How we use it
We process only information relevant to the purpose for which it is needed. The usual purposes and legal bases are:
- Enquiries, briefs and meetings: taking steps at your request before a contract, or our legitimate interest in responding to business enquiries and managing correspondence.
- Recruitment: our legitimate interest in assessing applicants and, where relevant, steps towards an employment or services contract. Providing requested contact and application information allows us to assess and reply to your application; optional information is not required.
- Comments and ratings: our legitimate interest in operating and moderating feedback that you choose to submit publicly. A person decides whether a comment is published.
- Security and administration: our legitimate interest in preventing fraud, spam and unauthorised access, maintaining service availability and handling legal claims; legal obligations where a specific law requires processing.
- Measurement: understanding site use and advertising effectiveness. A business interest in measurement does not replace consent where cookie or data-protection law requires it. The site's current automatic-loading behaviour and opt-out controls are explained in section 9.
Sending a form is not consent to marketing or advertising tracking, and does not subscribe you to a newsletter. Where we ask for consent for a separate purpose, you can withdraw it without affecting earlier lawful processing. We do not use the site's analytics or assistant to make solely automated decisions producing legal or similarly significant effects about you. Spam controls can reject a submission; contact us by email if you believe this happened in error.
4. Where it is stored and who processes it
Information submitted through the site’s forms (including your CV) is stored in our own database. We do not sell your form submissions. Limited identifiers and conversion information may be shared with Meta for advertising measurement, as explained in section 9; your message, project description, application answers and CV are not sent to Meta. We use the following service providers:
- Microsoft Azure: our website and PostgreSQL database are hosted in the UK South region. Your CV is stored in the database with no public link; only authorised Neovogent staff can download it.
- Google (Gmail): our outgoing email provider processes team notifications, customer acknowledgements and meeting confirmations (see section 5).
- Google Analytics and Meta: enabled analytics and advertising services receive the information described in section 9. Hashing contact information for Meta does not make it anonymous.
- Cloudflare: provides authoritative DNS for our domain. Our current web records are DNS-only; this is not a claim that every website request is proxied through Cloudflare.
- OpenAI or Microsoft (Azure OpenAI), only if we connect NeoChat to an AI model: the messages you type in NeoChat are sent to that provider to generate a reply. Otherwise NeoChat replies with our own built-in assistant and your messages go nowhere else.
- Microsoft (Azure AI Content Safety), only if we enable it: the text of a comment you post may be checked there for abusive content before a person reviews it.
Access is limited to authorised personnel and providers that need it for their role. We may also disclose relevant information to professional advisers, regulators or authorities where legally required, or where reasonably necessary to establish or defend legal rights. Approved public comments are visible to other visitors and search engines.
5. Notification emails
When you send an enquiry, website brief or meeting request, a copy of what you sent is emailed to our team’s notification mailbox so we can respond. For a job application, the team notification contains only your name, email address and the role; your CV and the rest of your application are never emailed. These emails are kept in our mailbox under its own retention policy, and are included when you ask us to delete your data.
After your submission is saved, we also send an acknowledgement to the email address you provided, subject to delivery availability and safeguards against repeated messages. It confirms receipt and explains the next steps; it does not contain your message, CV or application answers. A meeting request is not a confirmed meeting: we send the joining details separately after our team confirms it. These are service emails, not a marketing subscription, and contain no advertising tags or email-open tracking pixels. Your email app may request our logo and illustration from our website when displaying the email.
6. Third-party services on this site
Our fonts are hosted with this website; loading them does not contact Google Fonts. The contact page includes an embedded Google Map. When your browser requests the map, Google receives technical data such as your IP address and may process it under its own privacy policy. Form data is not passed to the map; our separate use of Gmail for email is described above.
7. International transfers
The primary website database is hosted in Microsoft Azure's UK South region. UK hosting does not mean every processing activity happens in the UK: Google, Meta and other providers may process data internationally, and our UK-led delivery model includes a hub in Dhaka, Bangladesh. Access from another country can itself be an international transfer.
International transfers require an applicable legal mechanism, such as adequacy regulations or contractual safeguards together with any required risk assessment. This notice does not claim that a particular provider or recipient is certified under a transfer framework. Ask hello@neovogent.com for the locations and transfer safeguards applicable to your information.
8. How long we keep it
Our database has the following retention rules, enforced by a scheduled daily cleanup. A due record is removed on the next successful run. Separate client, employment or legally required records may follow a different schedule, which we explain where relevant.
| Data | Kept for |
|---|---|
| Enquiries, website briefs and meeting requests | 24 months |
| Meeting requests we have not confirmed | released after 72 hours (the request itself is kept with its enquiry) |
| Job applications | 6 months |
| CV files | 6 months (may be deleted sooner than the application) |
| NeoChat usage records (no conversation content) | 90 days; the browser id and coded IP address are removed after 30 days |
| Comments awaiting review | 90 days |
| Comments we decline or remove | 30 days after the decision |
| Published comments | while published (the browser id and coded IP address are removed on approval) |
| Ratings | 24 months; the coded IP address is removed after 30 days |
| Coded IP addresses on any submission | 30 days |
| Records of staff actions (they contain no visitor contact details) | 24 months |
| Staff sign-in sessions and failed sign-in attempts | 30 days and 7 days |
| Our database provider’s backup history | up to 7 days; deleted data stays there until this period passes |
| GA4 event and user-level data | 14 months in the configured property; this does not set the lifetime of every aggregated report or provider-held record |
| Azure application/infrastructure logs | 30-day configured Log Analytics retention |
| Notification emails in our company mailbox | under the mailbox’s own policy; deleted on request |
9. Cookies and browser storage
Meta advertising measurement loads automatically on public pages without an upfront cookie prompt. It can receive your IP address and browser information, the page address and conversion events, and set or read identifiers such as _fbp and _fbc. The latter can associate a visit with a Meta ad click. Meta processes this data under its privacy policy.
Use Cookie choices in the footer to switch off Advertising. The switches apply immediately; no acceptance or save confirmation is needed. We respect previously saved refusals and supported Global Privacy Control and Do Not Track signals. Refusing does not prevent you using the site or submitting a form. An opt-out stops future measurement through our integration; it does not recall data already sent. Automatically loading measurement is not a record of your affirmative consent.
We also use the following strictly necessary staff cookies:
| Cookie | Who gets it | Purpose and lifetime |
|---|---|---|
__Host-nv_admin | Neovogent staff who sign in to our dashboard | Keeps the staff member signed in; ends after 12 hours at most (2 hours if unused) or on sign-out. |
nv_cms_oauth | Our content editors signing in to our content editor with GitHub | Protects the GitHub sign-in against forgery; 10 minutes. |
Some features save the functional identifiers and preferences below in local storage. They stay on your device until you clear this site's data. They are distinct from Google/Meta measurement cookies; the preference record controls whether those measurement integrations run.
| Key | Purpose |
|---|---|
nv-client-id | A random id created the first time you rate or comment on a case study. It is sent with your rating or comment so that a second rating from the same browser replaces the first instead of counting twice. We store it with your rating, and with a comment until it is published or for 30 days at most. |
nv-rated:case study | Remembers the stars you gave a case study, so the page shows your rating. It never leaves your browser. |
nvchat:cid | A random id created when NeoChat loads. It is sent with your NeoChat messages so that the fair-use limit applies per browser; we store it with the usage record and remove it after 30 days. |
nvchat:quota | Counts the NeoChat messages you have sent in the last 24 hours, so the chat can show when the limit is reached. It never leaves your browser. |
nv-consent | Your explicit cookie choices, including opt-outs. The preference record stays in your browser; forms send the effective advertising preference to our server so it can respect it. Clearing site data also clears this saved choice. |
Analytics, advertising measurement and your choices
Google Analytics 4 measures website use, and Meta measures advertising. Our settings also support other providers, but support alone does not load their tags. When a measurement provider is enabled for your visit:
- Those companies receive technical information from your browser, including its IP address, and can set measurement cookies. Google processes analytics data under its data-processing terms; Meta processes advertising data under its applicable terms and privacy policy.
- You can change analytics and advertising separately using Cookie choices in the footer.
- Only configured tags in an enabled category load. Privacy signals and saved opt-outs take precedence over automatic loading.
- Your explicit choice is remembered in your browser’s local storage under
nv-consent. Automatic loading does not write an acceptance record.
Google Analytics receives page addresses and titles, traffic-source tags, browser/device information, engagement events and successful submission events labelled by form type. Our explicit page and conversion events exclude arbitrary URL query parameters and fragments; we retain only restricted campaign and advertising-click parameters for attribution. We do not send your name, email, phone number, message, project description, application answers or CV to Google Analytics. Its _ga and _ga_* cookies distinguish browsers and sessions and can last up to two years, subject to browser limits. Google Signals and advertising personalization are disabled for this analytics integration. See Google’s privacy policy.
If advertising measurement is enabled for your visit and you send us a form, Meta can also receive that conversion from our server. Meta receives a one-way cryptographic hash of your email address and phone number, the event and form type, the page address without query parameters, your browser’s user agent, and Meta’s browser/click identifiers (_fbp and _fbc) when available. These are still personal data used for advertising measurement and matching, not anonymous data. We do not send your message, project description, application text or CV. No server-side advertising conversion is sent when your form carries an opt-out or supported browser privacy signal.
The embedded Google Map on our contact page is served by Google and may set its own cookies or similar technologies when that page loads; see Google’s privacy policy for details.
See the Cookie Policy for a consolidated list of storage, expected lifetimes and controls. Neither browsing this website nor submitting a form is affirmative consent to optional tracking. The current automatic mode does not collect prior opt-in; where applicable law requires prior consent, an opt-out control or this notice is not a substitute for obtaining it.
10. Your rights
Depending on the circumstances, UK GDPR gives you rights of access, correction, erasure, restriction, objection and portability. You may object to direct marketing at any time and withdraw consent where processing relies on it. These rights are subject to legal conditions; for example, we may need to retain information to meet a legal obligation or defend a claim.
Email hello@neovogent.com, preferably from the address associated with your enquiry. We may ask for proportionate information to verify identity. We normally respond within one month; if a lawful extension is needed, we will explain it. Requests are normally free, subject to the exceptions permitted by law.
Where erasure applies, we address relevant database records and our copies of notification emails. Backup copies expire within up to 7 days; information restored from a backup must remain subject to the erasure request. Anonymous-looking ratings and usage records may require a browser identifier to locate; please do not send passwords or unnecessary identity documents. Deleting information we hold does not automatically erase information a platform holds independently.
You can complain to the UK Information Commissioner’s Office, or another supervisory authority where applicable. You do not have to contact us first, although we welcome the chance to resolve a concern.
11. Security
Security and data protection are built into how we work: encryption in transit, least-privilege access, individual staff accounts with an audit trail of who viewed or changed personal data, and secure hosting. No method of transmission is 100% secure, but we take appropriate technical and organisational measures to protect your data.
12. Changes
We may update this policy from time to time; the current version is always posted here with its “last updated” date.
Children and sensitive information
This business website is not directed at children under 16. Please do not submit children's information or sensitive personal data unless we have specifically agreed a secure, lawful way to handle it. Job applicants should avoid including unnecessary health information, identity documents or third-party personal data in a CV. Contact us if you believe information has been supplied inappropriately.
13. Contact
Questions or requests about your data? Email hello@neovogent.com.