Skip to main content
NEUBOR
Legal

Privacy Policy

How we collect, use and protect your personal data — written to match exactly what the site actually does.

Last updated: 22 July 2026

Who we are

Neubor is the trading name of Kieran Bourne, a sole trader based in Stoke-on-Trent, Staffordshire, UK, building websites, AI assistants and automation systems for SMEs and trades businesses. For anything in this policy, including data-rights requests, contact kieran@neubor.co.uk.

For the data described here, Kieran Bourne, trading as Neubor, is the data controller. We process personal data in line with the UK GDPR and the Data Protection Act 2018, and with the EU GDPR where it applies to visitors in the EU.

What we collect

  • Enquiry details — when you use a contact form: your name, email, phone number, company name and the message you send.
  • AI chat messages — whatever you choose to type into the assistant, a random per-session id generated in your browser to keep a single conversation together, and your IP address (stored with the conversation for security and abuse-prevention).
  • Analytics — only if you opt in: anonymous, aggregate usage (e.g. which pages and CTAs are used). This is cookieless and never includes your name, email or chat messages.
  • Portal login — if you are an admin/client and log in to the portal, a secure session. This does not apply to ordinary visitors.

We do not use cookies or any non-essential storage before you consent. See our Cookie Policy for the full list.

Why we use it, and our lawful basis

  • Responding to your enquiry and scoping work — lawful basis: taking steps at your request before entering a contract (UK GDPR Art 6(1)(b)), and our legitimate interest in answering business enquiries (Art 6(1)(f)).
  • Running and improving the AI assistant — legitimate interest in providing and maintaining the service (Art 6(1)(f)).
  • Analytics — your consent (Art 6(1)(a)), which you can withdraw at any time.
  • Security and keeping the site working — legitimate interest (Art 6(1)(f)).

We do not use your data for third-party advertising, and we never sell or rent it.

The AI assistant

The chat widget is an AI assistant and identifies itself as such. When you send a message, the text is sent to one of our AI inference providers — Anthropic (Claude), OpenAI or Groq — to generate a reply. Which one answers depends on our configuration; the message content is the same in each case. Each of them may process your message outside the UK and EEA (see International transfers, below). We then store the conversation in our database, together with your IP address and which model replied, so we can follow up and improve the service. The assistant provides general information only, can be inaccurate, and is not used to make any automated decision about you — a person handles anything that matters. Please don't enter sensitive personal information into the chat.

Who processes your data (sub-processors)

We use the following providers, who process data on our behalf under contract. Where we have not been able to confirm a processing location from our own deployment configuration, we say so rather than guess:

  • Vercel — Website hosting, serverless functions and cookieless web analytics. Processed in: The United States by default, plus a global content-delivery network with edge locations worldwide.
  • Appwrite Cloud — The database that stores enquiries and chat logs. Processed in: Frankfurt, Germany (EU) *(we have not yet confirmed this against our live deployment configuration)*.
  • Anthropic (Claude) — AI inference for the chat assistant. Processed in: The United States and other regions used by the provider.
  • OpenAI — AI inference for the chat assistant. Processed in: The United States and other countries used by the provider and its sub-processors.
  • Groq — AI inference for the chat assistant. Processed in: The United States and other countries where the provider or its sub-processors operate.
  • Resend — Sends us the email notification when you make an enquiry. Processed in: The United States.

International transfers

Some of your data is processed outside the UK and EEA. We previously described this more narrowly than the evidence supports; the following is what our providers' own current documentation actually says.

  • Vercel — Request metadata (including IP address) for every page you load. Processed in: The United States by default, plus a global content-delivery network with edge locations worldwide.
  • Anthropic (Claude) — The message you type into the chat. Processed in: The United States and other regions used by the provider.
  • OpenAI — The message you type into the chat. Processed in: The United States and other countries used by the provider and its sub-processors.
  • Groq — The message you type into the chat. Processed in: The United States and other countries where the provider or its sub-processors operate.
  • Resend — Your enquiry details (name, contact details and message). Processed in: The United States.

For each of these transfers we rely on the provider's Data Processing Addendum, which incorporates the Standard Contractual Clauses together with the UK Addendum (International Data Transfer Addendum). We name that mechanism specifically rather than listing alternatives: saying a transfer is covered by "one of" several safeguards does not establish that any of them actually applies. You can ask us for the relevant DPA for any provider above.

Our website hosting runs in the United States by default, and our content-delivery network has locations worldwide. We are reviewing whether to pin processing to an EU region; until we have done so and confirmed it, we will not claim it.

How long we keep it

We keep personal data no longer than necessary. As a guide, enquiry and chat data is kept for up to 24 months after our last contact, unless an ongoing relationship or a legal obligation requires longer. You can ask us to delete it sooner at any time.

Your rights

Under UK and EU GDPR you have the right to:

  • Access a copy of your personal data (a subject access request);
  • Have inaccurate data corrected;
  • Have your data erased;
  • Restrict or object to our processing;
  • Data portability;
  • Withdraw consent (e.g. for analytics) at any time.

We do not carry out solely-automated decision-making that produces legal or similarly significant effects. To exercise any right, email kieran@neubor.co.uk — we'll respond within one month.

Complaints

If you're unhappy with how we handle your data you can complain to the UK Information Commissioner's Office (ICO). If you're in the EU, you can complain to your local supervisory authority. We'd appreciate the chance to put things right first.

Cookies

We set no advertising or tracking cookies. Analytics is cookieless and runs only with your consent. Manage your choice any time via or read the full Cookie Policy.

Changes to this policy

We'll update this page when our practices change and revise the date above. Material changes to cookies or analytics will re-prompt you for consent.

Contact

For any privacy question: kieran@neubor.co.uk.

Get in touchCookie Policy