Privacy policy.

Lightvector (“Lightvector”, “we”) is the controller of the personal data described in this policy, except where we say that we act as a processor for a client. You can reach us at [email protected].

This policy covers people who visit our website, people who enquire or book a call, people who use our client portal, and the personal data we handle inside our clients’ accounts.

If you visit the site. Our servers record the usual technical details of a request: your IP address, your browser, the pages you open and the time. We do not run analytics or advertising trackers on the site.

If you book a call. The form asks for your name, your work email and your brand or company, and optionally your website, your role, your monthly ad spend and a note. We keep this as an enquiry. The calendar that follows is run by Calendly, which receives your name, your email and the time you choose under its own privacy policy.

If you use the client portal. Your name, your email, a hashed password, the invitation that brought you in, a session cookie, and a record of what you do there: the work you review, the approvals you give and the messages you send.

If you are a client. The brand material you give us, the connections you authorise to your store, your ad accounts and your email platform, and the data we read through them: products, performance figures, audience and segment statistics, orders and customer reviews. Some of this is personal data about your customers. We process it on your behalf and on your instructions.

If you email us. Your correspondence and the details in it.

• To answer an enquiry and to arrange and hold a call: our legitimate interest in responding to people who contact us, and the steps you ask us to take before a contract.
• To provide the service to a client, run the portal and keep accounts secure: performance of our contract with the client.
• To understand a client’s market and customers and to measure the work: performance of the contract, and the client’s instructions where we act as processor.
• To improve the platform, using records of what worked in a form that does not identify people: our legitimate interest in building a better service.
• To keep records, meet our legal obligations and deal with disputes: legal obligation and legitimate interest.
• To tell you about Lightvector, only where you have agreed or where you are a business contact and the law allows it. You can opt out at any time.

We do not sell personal data, and we do not make automated decisions about you that have a legal or similarly significant effect.

Our platform uses machine-learning models run by third-party providers, at present Anthropic, OpenAI and Google, to research, plan, write and design. We send them the material the work needs: brand material, product details, briefs and the results of research. We keep personal data out of what we send where we can, and to the minimum where we cannot. We use these providers under business terms that do not let them train their models on our data.

• Service providers who run things for us: hosting, storage, databases, email delivery, scheduling (Calendly) and the AI providers above. They act on our instructions, under contracts that protect your data.
• The platforms a client connects, such as Shopify, Meta and Klaviyo, when we publish work or read results. Each has its own privacy policy and terms.
• Professional advisers, and authorities where the law requires it.
• A buyer or successor of our business, who would take over this policy.

We are based in the United Kingdom. Some of our providers run in the European Economic Area or in the United States. When personal data leaves the UK we rely on the UK’s adequacy regulations where they apply, and otherwise on the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with further safeguards where they are needed.

• Enquiries and booking details: up to 24 months after our last contact with you, unless you become a client.
• Portal accounts and activity: for as long as the client engagement lasts and for 12 months after it, so that we can answer questions about the work.
• Client material and the data read through connections: for the engagement, then deleted or returned within 30 days of its end, unless the law requires us to keep something for longer.
• Server logs: up to 90 days.
• Records we must keep by law, such as invoices: for as long as the law requires, typically six years.

Learnings we keep for the platform are stripped of anything that identifies a person before the rest is deleted.

Data travels over encrypted connections. Passwords are stored hashed, never in clear. Access to client data is limited to the people who need it for the work, and the connections a client authorises can be revoked by the client at any time. No system is perfectly secure; if we learn of a breach that affects you, we will tell you and the regulator as the law requires.

The website itself sets no cookies. The client portal sets one strictly necessary cookie that keeps you signed in; it goes when you sign out or when it expires. The calendar on the booking page is loaded from Calendly and may set its own cookies under Calendly’s policy. We do not use advertising or analytics cookies. If that changes, we will update this policy and ask for consent where the law requires it.

Under UK data protection law you can ask us for a copy of the personal data we hold about you, ask us to correct it, delete it or restrict how we use it, object to our using it, ask for it in a portable form, and withdraw any consent you have given. Write to [email protected]; we reply within a month. If you are a customer of one of our clients, the client is the controller and we will pass your request on to them.

You can also complain to the Information Commissioner’s Office at ico.org.uk. We would rather hear from you first.

Our site and service are for businesses and are not aimed at anyone under 18. We do not knowingly collect personal data from children.

We post any change here with a new date at the top, and tell clients directly if a change matters to them.

Lightvector. For anything about your personal data, write to [email protected].