Privacy Policy

Last updated: 22 July 2026

Who we are

Neubor is the trading name of Kieran Bourne, a sole trader based in Stoke-on-Trent, Staffordshire, UK, building websites, AI assistants and automation systems for SMEs and trades businesses. For anything in this policy, including data-rights requests, contact kieran@neubor.co.uk.

For the data described here, Kieran Bourne, trading as Neubor, is the data controller. We process personal data in line with the UK GDPR and the Data Protection Act 2018, and with the EU GDPR where it applies to visitors in the EU.

What we collect

Enquiry details — when you use a contact form: your name, email, phone number, company name and the message you send.
AI chat messages — whatever you choose to type into the assistant, a random per-session id generated in your browser to keep a single conversation together, and your IP address (stored with the conversation for security and abuse-prevention).
Analytics — only if you opt in: anonymous, aggregate usage (e.g. which pages and CTAs are used). This is cookieless and never includes your name, email or chat messages.
Portal login — if you are an admin/client and log in to the portal, a secure session. This does not apply to ordinary visitors.

We do not use cookies or any non-essential storage before you consent. See our Cookie Policy for the full list.

Why we use it, and our lawful basis

Responding to your enquiry and scoping work — lawful basis: taking steps at your request before entering a contract (UK GDPR Art 6(1)(b)), and our legitimate interest in answering business enquiries (Art 6(1)(f)).
Running and improving the AI assistant — legitimate interest in providing and maintaining the service (Art 6(1)(f)).
Analytics — your consent (Art 6(1)(a)), which you can withdraw at any time.
Security and keeping the site working — legitimate interest (Art 6(1)(f)).

We do not use your data for third-party advertising, and we never sell or rent it.

The AI assistant

The chat widget is an AI assistant and identifies itself as such. When you send a message, the text is sent to one of our configured AI inference providers — Anthropic (Claude), OpenAI, Groq, Hugging Face, Cloudflare Workers AI, NVIDIA NIM, OpenRouter, GLM (Zhipu AI), Mistral AI or Google Gemini — to generate a reply. Which one answers depends on availability and configuration; the message content is the same in each case. Our reviewed production lanes may process your message outside the UK and EEA (see International transfers, below). A small number of additional fleet lanes are wired for diagnostic failover but stay disabled until their provider contract, account and transfer position have been reviewed. We then store the conversation in our database, together with your IP address and which model replied, so we can follow up and improve the service. The assistant provides general information only, can be inaccurate, and is not used to make any automated decision about you — a person handles anything that matters. Please don't enter sensitive personal information into the chat.

Who processes your data (sub-processors)

We use the following providers, who process data on our behalf under contract. Where we have not been able to confirm a processing location from our own deployment configuration, we say so rather than guess:

Vercel — Website hosting, serverless functions and cookieless web analytics. Processed in: The United States by default, plus a global content-delivery network with edge locations worldwide.
Appwrite Cloud — The database that stores enquiries and chat logs. Processed in: Frankfurt, Germany (EU) *(we have not yet confirmed this against our live deployment configuration)*.
Anthropic (Claude) — AI inference for the chat assistant. Processed in: The United States and other regions used by the provider.
OpenAI — AI inference for the chat assistant. Processed in: The United States and other countries used by the provider and its sub-processors.
Groq — AI inference for the chat assistant. Processed in: The United States and other countries where the provider or its sub-processors operate.
Hugging Face — AI inference for the chat assistant. Processed in: Not yet pinned; the routed provider may process in the United States and other regions *(we have not yet confirmed this against our live deployment configuration)*.
Cloudflare Workers AI — AI inference for the chat assistant. Processed in: The United States and other regions used by Cloudflare and its sub-processors.
NVIDIA NIM — AI inference for the chat assistant. Processed in: The United States and other regions used by NVIDIA and its sub-processors.
OpenRouter — AI inference routing for the chat assistant. Processed in: Not yet pinned; the routing service and selected underlying model may process in multiple regions *(we have not yet confirmed this against our live deployment configuration)*.
GLM (Zhipu AI) — AI inference for the chat assistant. Processed in: Not yet pinned; the provider may process outside the UK and EEA *(we have not yet confirmed this against our live deployment configuration)*.
Mistral AI — AI inference for the chat assistant. Processed in: The European Union by default, with possible temporary transfers to sub-processors outside the EU.
Google Gemini — AI inference for the chat assistant. Processed in: Not yet pinned; Google's applicable AI service and account region require confirmation *(we have not yet confirmed this against our live deployment configuration)*.
Resend — Sends us the email notification when you make an enquiry. Processed in: The United States.

International transfers

Some of your data is processed outside the UK and EEA. We previously described this more narrowly than the evidence supports; the following is what our providers' own current documentation actually says.

Vercel — Request metadata (including IP address) for every page you load. Processed in: The United States by default, plus a global content-delivery network with edge locations worldwide.
Anthropic (Claude) — The message you type into the chat. Processed in: The United States and other regions used by the provider.
OpenAI — The message you type into the chat. Processed in: The United States and other countries used by the provider and its sub-processors.
Groq — The message you type into the chat. Processed in: The United States and other countries where the provider or its sub-processors operate.
Cloudflare Workers AI — The message you type into the chat. Processed in: The United States and other regions used by Cloudflare and its sub-processors.
NVIDIA NIM — The message you type into the chat. Processed in: The United States and other regions used by NVIDIA and its sub-processors.
Mistral AI — The message you type into the chat. Processed in: The European Union by default, with possible temporary transfers to sub-processors outside the EU.
Resend — Your enquiry details (name, contact details and message). Processed in: The United States.

For each of these transfers we rely on the provider's Data Processing Addendum, which incorporates the Standard Contractual Clauses together with the UK Addendum (International Data Transfer Addendum). We name that mechanism specifically rather than listing alternatives: saying a transfer is covered by "one of" several safeguards does not establish that any of them actually applies. You can ask us for the relevant DPA for any provider above.

Our website hosting runs in the United States by default, and our content-delivery network has locations worldwide. We are reviewing whether to pin processing to an EU region; until we have done so and confirmed it, we will not claim it.

How long we keep it

We keep personal data no longer than necessary. As a guide, enquiry and chat data is kept for up to 24 months after our last contact, unless an ongoing relationship or a legal obligation requires longer. You can ask us to delete it sooner at any time.

Your rights

Under UK and EU GDPR you have the right to:

Access a copy of your personal data (a subject access request);
Have inaccurate data corrected;
Have your data erased;
Restrict or object to our processing;
Data portability;
Withdraw consent (e.g. for analytics) at any time.

We do not carry out solely-automated decision-making that produces legal or similarly significant effects. To exercise any right, email kieran@neubor.co.uk — we'll respond within one month.

Complaints

If you're unhappy with how we handle your data you can complain to the UK Information Commissioner's Office (ICO). If you're in the EU, you can complain to your local supervisory authority. We'd appreciate the chance to put things right first.

Cookies

We set no advertising or tracking cookies. Analytics is cookieless and runs only with your consent. Manage your choice any time via or read the full Cookie Policy.

Changes to this policy

We'll update this page when our practices change and revise the date above. Material changes to cookies or analytics will re-prompt you for consent.

Contact

For any privacy question: kieran@neubor.co.uk.