Privacy policy

01Who we are

Shapes (“we”, “us”) is an AI workflow agency that designs, builds, and runs automation for businesses. This policy explains how we handle personal information collected through this website, through enquiries and bookings, and in our business relationships.

For this information, Shapes is the data controller. How we handle personal information inside client projects, where we act on a client's instructions, is covered by our Customer privacy policy.

You can contact us about privacy at any time by email to shapesai.connect@gmail.com, through our contact page, or by replying to any email you have received from us.

02Information we collect

Information you give us

Enquiries: your name, work email, company, and anything you tell us about your business and the workflow you want to improve.
Bookings: the name, email, and answers you provide when booking a call.
Correspondence: the content of emails, messages, and calls with us, including notes we take to prepare proposals.
Business relationship: contact and billing details of people at client and supplier businesses.

Information collected automatically

Our hosting provider records standard technical information when you visit, such as IP address, browser type, pages requested, and the time of the request, to deliver the site securely and investigate abuse. We do not use analytics or advertising tools that build a profile of you.

Information we do not seek

We do not ask for special category data (such as health or religious beliefs) through this website. Please do not include it in enquiries.

03How we use it and why

Purpose	Legal basis (EU and UK GDPR)
Replying to enquiries and holding calls you book	Steps at your request before a contract, and our legitimate interest in responding to business enquiries
Preparing proposals and delivering services	Performance of a contract, or steps before entering into one
Invoicing, accounting, and record-keeping	Legal obligation, and performance of a contract
Keeping the website secure and working	Legitimate interest in protecting our systems and visitors
Occasional updates about our services to business contacts	Legitimate interest, or consent where the law requires it. You can opt out at any time

04Who we share it with

We do not sell personal information or share it for advertising. We use trusted providers to run our business:

Vercel: website hosting and delivery.
Calendly: the scheduler on our booking page. Details you enter there are also handled under Calendly's own privacy policy, and Calendly may set its own cookies inside the scheduler.
Google: Gmail and Google Calendar for booking confirmations, enquiries, and correspondence.
FormSubmit: relays messages sent through our contact form to our inbox.
Email, document, and video-call providers: for correspondence and meetings with you.
Accounting and payment providers: for invoicing clients.

These providers process information only to provide their services to us. We may also disclose information where the law requires it, or to protect our rights, our clients, or the public.

05International transfers

We work with clients in many countries, and some of our providers are based outside the European Economic Area, the United Kingdom, or your country. Where personal information is transferred internationally, we rely on appropriate safeguards such as adequacy decisions or the European Commission's Standard Contractual Clauses and their UK equivalent, together with the provider's security commitments.

06How long we keep it

Enquiries that do not lead to a project: up to 24 months after our last contact, then deleted.
Client and supplier records: for the relationship, then as long as tax and accounting law requires.
Technical logs held by our hosting provider: for the short periods set by that provider.

07Your rights

Depending on where you live, you may have the right to:

access the personal information we hold about you and receive a copy;
have inaccurate information corrected;
have information deleted, or its use restricted;
object to processing based on legitimate interests, including any direct marketing;
receive information you provided in a portable format;
withdraw consent where we rely on it.

These rights apply under the EU and UK GDPR. Residents of California and other US states with privacy laws have similar rights to know, correct, and delete, and we do not sell or share personal information for cross-context behavioural advertising. People in Australia, New Zealand, Singapore, Malaysia, and other countries have rights of access and correction under their local laws.

To exercise any right, contact us by email to shapesai.connect@gmail.com, through our contact page, or by replying to any email you have received from us. We will respond within the time the applicable law requires and will not treat you differently for exercising your rights. You can also complain to your local data protection authority.

08Cookies

This website does not use analytics, advertising, or tracking cookies of its own. If we add any non-essential cookies in future, we will update this policy first and ask for your consent where the law requires it. The embedded Calendly scheduler and any video-call service you join are governed by their own cookie policies. See our Cookie policy for details.

09Security

We protect personal information with access controls, encrypted connections, and providers that maintain recognised security standards. No system is perfectly secure, but we take care to keep information safe and to act quickly if something goes wrong.

10Children

Our website and services are for businesses and are not directed at children.

11Changes to this policy

We may update this policy as our services or the law change. The date at the top shows when it was last updated. Significant changes will be highlighted on this page.