Privacy Policy
Last updated: 20 May 2026
Ferrous Labs takes your privacy seriously. This policy explains what data we collect, how we use it, who we share it with, and the choices you have. It is written to comply with UK GDPR and the Data Protection Act 2018.
Who we are
Ferrous Labs is the data controller for personal data collected through this website.
- Address: 1 Empire Mews, Streatham, London SW16 2BF, United Kingdom
- Email: privacy@ferrouslabs.co.uk
- Director: Elliott Prince
- ICO registration number: ZC148566
What data we collect
When you complete the Lean AI Strategy Diagnostic on this site:
- Your name and work email address
- Your company name and website URL
- Your answers to the eight diagnostic questions
When you speak with Catalyst, our AI guide, in a live video conversation:
- Your name, work email address, company name and website URL (from the short form before the conversation, or the email box on the conversation page)
- Your camera and microphone streams during the conversation, processed in real time to run the video call — we do not record or store the video or audio
- A text transcript of the conversation, which we summarise to produce your opportunity report
When you book a Discovery call:
- Your name, email address, and selected time slot (collected via Google Calendar appointment scheduling)
When you reply to our emails:
- The content of your message
When you visit our website:
- Standard request information (IP address, user agent, referrer, requested page) collected by Cloudflare for security and performance purposes
If we approach you on LinkedIn before you have had any contact with us:
- Your name, job title, company name and the address of your public LinkedIn profile, taken from that public profile
- Whether you opened a link we sent you and whether you downloaded the guide it points to, recorded against a random reference contained in the link rather than against your name
We do not obtain your email address this way, and clicking a link we send you does not add you to any email sequence. You only receive email from us if you give us your address yourself.
We do not knowingly collect special category data (health, religion, political opinions and similar) or data from anyone under 18. The diagnostic and the Catalyst conversation are intended for business contacts in commercial capacities, and Catalyst is instructed not to request sensitive personal information.
How we use your data
We use your data only for the purposes set out below.
| Purpose | Lawful basis under UK GDPR |
|---|---|
| Generate AI use case recommendations from your diagnostic answers | Legitimate interests — providing the service you requested |
| Run a live video conversation with our AI guide (Catalyst) and summarise its transcript into your opportunity report | Legitimate interests — providing the service you requested |
| Send follow-up emails (the Catalyst nurture sequence) | Legitimate interests — B2B marketing to a prospect who has engaged with our service |
| Operate Discovery calls and any subsequent engagement | Legitimate interests / contract performance |
| Site security and abuse prevention | Legitimate interests |
| Measure the effectiveness of paid advertising (Google Ads conversion tracking) | Consent — you can withdraw at any time via the Cookie settings link in the footer |
| Understand how the site is used so we can improve it (Google Analytics) | Consent — you can withdraw at any time via the Cookie settings link in the footer |
| Identify businesses our work may suit and approach them on LinkedIn, and measure whether the material we send is read | Legitimate interests — business-to-business marketing to a professional contact acting in a commercial capacity |
| Comply with legal and regulatory obligations | Legal obligation |
You can object to processing based on legitimate interests at any time by emailing us or by clicking the Unsubscribe link in any email.
AI processing and automation
Our diagnostic uses AI (Claude, built by Anthropic) to generate the suggested AI use cases from your questionnaire answers and publicly available content on your company website. The follow-up emails are drafted by an AI agent called Catalyst, also built on Claude.
The live conversation option is powered by Tavus, a conversational video AI platform: your camera and microphone streams are processed in real time to run the call, and Tavus produces a text transcript, which Claude then summarises into your opportunity report. Catalyst identifies itself as an AI agent and will confirm that if you ask.
These are AI-generated suggestions and drafts, not solely-automated decisions producing legal or similarly significant effects on you. Elliott Prince reads every reply to a follow-up email, and any commercial engagement involves human review and human decision-making.
Who we share your data with
We use the following service providers to deliver the service. They process your data only on our written instructions.
| Provider | Service | Location |
|---|---|---|
| Cloudflare, Inc. | Website hosting, security at the edge, database (Cloudflare D1), identity gateway (Cloudflare Access) | UK / EU / US |
| Anthropic PBC | AI model access (Claude) for diagnostic generation, conversation-transcript summarisation, and follow-up email drafting | United States |
| Tavus, Inc. | Real-time conversational video AI (the Catalyst conversation): processes camera/microphone streams during the call (WebRTC, delivered via its sub-processor Daily.co) and produces the conversation transcript | United States |
| Google Ireland Ltd. (Google Workspace, Google Calendar) | Email sending, calendar booking | Ireland (EU) |
| Google LLC (Google Ads) | Advertising measurement — records conversion events when a visitor completes our diagnostic or starts a conversation with our AI guide, and stores attribution cookies with your consent | United States |
| Ploy | Content platform hosting one article on this site (RAG evaluation framework), which we serve through our own domain. It receives the page views and a random visitor identifier for that article, and only if you have allowed analytics cookies | United States |
| Google LLC (Google Analytics) | Website analytics — records which pages you visit and how you move through the site, with your consent. Google Signals is switched off, so this is not used for cross-device advertising profiles | United States |
We do not sell your data or share it with anyone outside this list.
International data transfers
Some of your data is transferred to the United States (Anthropic, and Tavus if you use the live conversation). For these transfers we rely on the UK Information Commissioner's International Data Transfer Agreement (or the EU Standard Contractual Clauses as supplemented by the UK Addendum) as the lawful safeguard.
Anthropic does not train its AI models on data submitted via its API by default. Cloudflare and Google Workspace data is held in UK or EU data centres where the relevant service supports it.
How long we keep your data
We retain identifying personal data for up to 24 months from your most recent interaction with us — your latest email reply, diagnostic submission, Catalyst conversation, or call. After this period, records are automatically anonymised: your name and email address are replaced with placeholders, leaving only aggregated statistical information for our internal analysis.
Where we approached you on LinkedIn and you never replied, we keep a shorter record: your name, job title, company and profile address are deleted 12 months from our last approach, along with any record of whether you opened the links we sent.
You can request earlier deletion at any time by emailing privacy@ferrouslabs.co.uk.
Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you (Subject Access Request)
- Rectify inaccurate or incomplete data
- Erase your data (the "right to be forgotten"), subject to limited legal exceptions
- Restrict processing while a query or complaint is investigated
- Port your data to another service in a structured, machine-readable format
- Object to processing based on legitimate interests, including for marketing — we will stop immediately on receipt
- Withdraw consent at any time where consent is the lawful basis for processing
To exercise any of these rights, email privacy@ferrouslabs.co.uk. We will respond within 30 days. We do not charge a fee unless your request is manifestly unfounded or excessive.
Marketing emails
If you completed the diagnostic, or spoke with Catalyst and shared your email, you will receive a short series of follow-up emails (typically five emails over approximately three weeks) from our marketing agent Catalyst, sent from catalyst@ferrouslabs.co.uk with replies routed to elliott@ferrouslabs.co.uk.
Every email contains a one-click Unsubscribe link. Clicking it stops further contact immediately. You can also reply to any email with the word "unsubscribe" and we will action it manually. We honour unsubscribes permanently — once you opt out, we will not contact you for marketing purposes again unless you ask us to.
Cookies and tracking
We use a cookie consent banner. Non-essential cookies are only set after you actively choose to accept them. You can change or withdraw your consent at any time by clicking Cookie settings in the footer of any page.
Essential cookies (always active, no consent required)
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
__cf_bm |
Cloudflare | Bot management and abuse prevention | 30 minutes |
cf_clearance |
Cloudflare | Records that a browser challenge was passed | Up to 24 hours |
fl_consent_analytics |
Ferrous Labs | Records whether you allowed analytics, so that our server can honour that choice on pages where the decision has to be made before any script runs. It holds a single character — 1 or 0 — and nothing that identifies you |
180 days |
Advertising cookies (set only with your consent)
These cookies are placed by Google Ads when you enable the Advertising category. They are used solely to measure whether someone who clicked one of our ads later completed our diagnostic or started a conversation with our AI guide. We do not use them for behavioural profiling, retargeting, or any other advertising purpose.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
_gcl_au |
Google (googletagmanager.com) | Links your website visit to our Google Ads account for conversion measurement | 90 days |
_gcl_aw |
Google (googletagmanager.com) | Stores the Google Click ID from an ad click to attribute a conversion to a campaign | 90 days |
IDE |
Google (doubleclick.net) | Used by Google's ad network to record and deduplicate conversion events | Up to 13 months |
Analytics cookies (set only with your consent)
These cookies are placed by Google Analytics 4, and on one article by Ploy, when you enable the Analytics category. We use them to understand which pages people visit and how they move through the site, so we can improve it. We have deliberately left Google Signals switched off, so these cookies are not used to build cross-device advertising profiles or to retarget you.
One article — RAG evaluation framework — is written in Ploy, a content platform, and served through our own site. It carries Ploy's analytics rather than Google's. If you have not allowed analytics, our server does not serve Ploy's analytics script at all, so none of the storage below is created.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
_ga |
Google (googletagmanager.com) | Distinguishes one visitor from another so visit counts are not double-counted | 2 years |
_ga_Q1Y5FPRRZP |
Google (googletagmanager.com) | Keeps track of the current session so a single visit is not recorded as several | 2 years |
ploy_anon_id |
Ploy | A random identifier that distinguishes one visitor from another on the Ploy-written article, so repeat views are not counted as new people. It is not linked to your name or email, and it is also kept in your browser's local storage under the same name | 1 year |
ploy_session (local storage, not a cookie) |
Ploy | Groups the pages you view in one sitting into a single session. Two further local-storage entries may appear alongside it: ploy_pending_events, which holds events not yet sent, and ploy_debug |
30 minutes |
Google's own privacy policy governs how Google processes data from these cookies: policies.google.com/privacy.
Security
Your data is protected in transit by HTTPS and at rest by Cloudflare's encryption. Access to our administrative tools is restricted via Google Workspace single sign-on with multi-factor authentication enforced. We log administrative actions for accountability.
If a personal data breach occurs that is likely to result in a risk to your rights, we will notify the UK Information Commissioner's Office within 72 hours and, where the risk is high, also notify you directly.
How to contact us
For any data protection question, complaint, or request:
- Email: privacy@ferrouslabs.co.uk
- Post: Ferrous Labs, 1 Empire Mews, Streatham, London SW16 2BF, United Kingdom
If you are not satisfied with our response, you have the right to complain to the UK Information Commissioner's Office:
- Online: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF, United Kingdom
Changes to this policy
We may update this policy from time to time. If we make material changes that affect how we process your personal data, we will notify active subscribers by email at least 14 days before the changes take effect. The "Last updated" date at the top of this page will always reflect the most recent version.