Privacy
policy

Cognivise Limited ("Cognivise", "we", "us") is the controller of the personal data described in this policy. We are a company registered in England and Wales under number 16461721, and our registered office is Flat 65 Sherborne Court, 180-186 Cromwell Road, London SW5 0ST.

For anything about your personal data, write to hello@cognivise.co.uk.

This website runs no advertising and no tracking unless you say yes. With your permission, we use Google Analytics and Microsoft Clarity to see how the site is used; if you refuse, they never load. We only receive personal data you choose to send us, through the contact form, CogniBot or email, plus the technical information any web server needs to deliver a page and keep out abuse.

We use it to answer you and, if it goes further, to do the work. We do not sell it, we do not use it for marketing you did not ask for, and what you send through the form is kept in a private database that only our team can read.

Under UK data protection law we need a lawful basis for each use. For the data below it is our legitimate interests in answering enquiries, running and protecting this website, and finding work for people who ask us to; where you become a client, it is also to take steps towards and perform a contract with you; and for business and accounting records, it is our legal obligations.

Project and team enquiries

Your name, email address, optional phone number, company, the roles you need (for team enquiries) and your message. Used to reply, to understand what you need and, if we work together, to scope and deliver it.

Job enquiries

Your name, email address, optional phone number, where you are based, the role you are after, an optional profile link and your message. Used to consider you for suitable roles. We will not put your details forward to any client without your agreement first.

CogniBot questions

The text you type into CogniBot and its answers, used to answer your question in the context of the conversation. Explained in full below.

Emails and calls

Whatever you send us directly, and our notes of calls and meetings, used to deal with what you asked and to run the relationship.

Technical data

Your IP address and the details your browser sends with every request, used to deliver the site, to limit how often one visitor can send a message or ask a question, and to keep automated spam out of the contact form.

Website analytics (only if you accept)

Which pages you read, how long you stay, where you click and scroll, roughly where you are, and what device and browser you use, from Google Analytics and Microsoft Clarity. Used to see what is useful and to find parts of the site that are confusing. Our lawful basis is your consent, which you can withdraw at any time with the Cookie settings link in the footer. Clarity masks what you type into forms and CogniBot, so it is not recorded. The cookie policy lists every cookie.

Giving us any of this is voluntary, but we cannot answer an enquiry without a way to reply. Please do not send us sensitive information, such as health details, ethnicity, religion or criminal records, through the form or CogniBot. We do not need it.

Before the form can be sent, Cloudflare Turnstile checks that a person is using it. It loads from Cloudflare when you open the contact page, so Cloudflare receives your IP address and technical details about your browser and device. When you submit, our server also sends Cloudflare the check's token and your IP address to confirm the result.

Our server then validates your details and saves them in our enquiries database, hosted by Supabase on servers in Ireland. Only signed-in members of our team can read it: the public website can add an enquiry to it but cannot read one back.

We read enquiries in our team's admin panel, which reads them from that database; your details are not emailed to us. We reply to you by email from our inbox at hello@cognivise.co.uk (hosted by Google Workspace). If the database cannot be reached, the form tells you your message was not sent, and nothing is kept.

To stop one visitor flooding the form, our server counts submissions per IP address. The count is held in the server's memory only, never written to a database or log, and forgotten within 24 hours.

CogniBot is the question box on this site. Your question goes from your browser to our server, and our server sends it to OpenAI to generate the answer. Your browser never contacts OpenAI.

We send OpenAI only the text of your question, the earlier questions and answers of the same conversation, and our own instructions. We send no name, email address or IP address, and no identifier for you. OpenAI processes the request as our processor. The request is made with storage switched off, so OpenAI does not keep the answer for later retrieval, but under its standard terms it may keep requests and responses for up to 30 days to detect and prevent abuse, or longer where the law requires. OpenAI does not use this data to train its models.

On our side, nothing is kept. So that a follow-up question makes sense, the earlier questions and answers travel with each new one: our server hands the conversation back to your browser with a signature, so it cannot be altered, and your browser keeps it in the page's memory and sends it back with your next question. It is never written to a database or a file, it is gone when you reload or close the page or start over, and our server stops accepting it one hour after your last message. We do not log the text of your questions; our logs record only that a safety check was triggered or that a request failed.

As with the form, our server counts questions per IP address in memory to limit abuse, and forgets them within an hour.

Please do not put confidential information, or personal details about anyone else, into CogniBot. It is there to answer questions about what we do; the contact form is the right place for anything that matters.

We do not use advertising pixels or social media plug-ins. Analytics and session recording run only if you accept them in the cookie banner, and they stop if you withdraw. We do not buy or sell personal data, build profiles, or add you to a mailing list you did not ask for.

We make no decisions about you by automated means alone. CogniBot answers questions; it does not decide anything about you.

We use a small number of service providers. Each acts on our instructions under a written data processing agreement, and uses its own sub-processors under equivalent terms.

Vercel Inc. (USA)

Hosts this website. Pages are served from the Vercel location nearest to you; the contact form and CogniBot run on Vercel servers in Washington, D.C., USA. Vercel keeps short-lived request logs (IP address, browser details, the page requested and the time) for security and troubleshooting, and also processes some of that data as a controller to operate and protect its platform, under its own privacy notice.

Cloudflare, Inc. (USA)

Runs the Turnstile check on the contact form, as described above.

Google Ireland Limited (Ireland)

Provides Google Tag Manager and Google Analytics, which load only if you accept analytics. Google LLC in the USA and other Google companies act as its sub-processors.

Microsoft Corporation (USA)

Provides Microsoft Clarity, which loads only if you accept analytics. It records how pages are used, as heatmaps and session replays, with form fields and CogniBot masked.

Supabase, Inc. (USA)

Hosts the database where contact form submissions are stored, on servers in Ireland, as described above.

Google Cloud EMEA Limited (Ireland)

Provides Google Workspace, which hosts our email. Google LLC in the USA and other Google companies act as its sub-processors.

OpenAI OpCo, LLC (USA)

Generates CogniBot's answers, as described above.

Beyond these, we share personal data only with our professional advisers (such as accountants and lawyers) where needed, with a client when you have agreed to us putting you forward for a role, with anyone who acquires our business, or where the law requires it. We never share it for anyone else's marketing.

Several of the providers above are based in the United States, or use sub-processors there, so your data may be processed outside the UK. Where a US recipient is certified under the UK Extension to the EU-US Data Privacy Framework, the transfer relies on the UK's adequacy regulations for the US. Otherwise, and as a back-up, it relies on the European Commission's Standard Contractual Clauses with the ICO's International Data Transfer Addendum, which are part of each provider's data processing terms. OpenAI's transfers rely on those clauses.

You can ask us for more information about these safeguards at hello@cognivise.co.uk.

We keep personal data only as long as we need it for the reason we collected it:

Enquiries

Enquiries that do not lead to work, including job enquiries that do not go further, are deleted 12 months after our last contact; our enquiries database does this automatically. Messages we mark as spam are deleted 30 days after we mark them. An enquiry that leads to work becomes part of the client and candidate records below.

Clients and candidates

Correspondence and records for work we do, or for people we place, are kept for the length of the relationship and then for up to six years, to meet accounting and tax rules and to deal with any legal claims.

CogniBot

Not kept on our server. The page holds the conversation until you reload, close it or start over, and our server stops accepting it one hour after your last message. OpenAI may keep it for up to 30 days, as described above.

IP address counters

Held in server memory only; forgotten within 24 hours for the contact form and within one hour for CogniBot.

Hosting logs

Kept by Vercel for a short period, no more than 30 days, then deleted.

Analytics

Only if you accepted. The cookies last up to two years (Google Analytics) or up to a year (Clarity), as listed in the cookie policy. Google and Microsoft keep the reports for a limited period under the retention settings in each tool.

The site is served only over HTTPS. Form submissions are kept in a database that the public website can add to but not read: only signed-in members of our team can see them, and the database checks that on every request. Our email account is protected by access controls too, and access to both is limited to the people who need it. We choose providers with strong security and bind them by contract to protect your data.

Under UK data protection law you have the right to:

Access

Ask for a copy of the personal data we hold about you.

Rectification

Ask us to correct anything that is wrong or incomplete.

Erasure

Ask us to delete your personal data.

Restriction

Ask us to limit how we use it while a concern is resolved.

Objection

Object to our use of it where we rely on legitimate interests. We will stop unless we have compelling grounds to continue.

Portability

Where we process data you gave us for a contract, ask for it in a machine-readable format.

Withdrawing consent

Where we rely on your consent, which is the case for analytics cookies, withdraw it at any time with the Cookie settings link in the footer. Withdrawing does not affect what we did before.

To use any of these rights, write to hello@cognivise.co.uk. It is free, we may ask you to confirm your identity, and we will respond within one month, or tell you within that month if a complex request needs longer.

If you are unhappy with how we have handled your personal data, please tell us first, at the same address, and we will look into it and reply. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

This website and our services are meant for businesses and adults. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us their details, tell us and we will delete them.

When this policy changes, the new version appears on this page with a new date at the top. If a change affects how we use personal data you have already given us, we will tell you directly where we can.