Privacy policy

Who we are

Zelvorm ("we", "us") is the controller of personal data collected through this website and the Mission Control client portal. This policy explains what we collect, why, and your rights under the UK GDPR and the Data Protection Act 2018.

What we collect

Contact details you give us (name, email, company, phone) through forms, the AI Brief Builder, the AI Concierge, bookings and account sign-up.

Project information you share with us in the portal: messages, files, feedback, meeting transcripts and approvals.

Technical data such as IP address, device and browser type, used to secure and operate the service. Analytics (Vercel Analytics and Google Analytics) run only with your consent: see the cookie policy.

How we use AI

Some features send the text you provide to our AI provider (Anthropic) to generate answers, briefs, summaries and estimates. We do not use your data to train models, and our provider does not train on API data by default.

AI outputs are reviewed by a human before they become binding, such as quotes and change orders.

Introducing our services to businesses

We contact a small number of businesses we think we could help. We find them in public sources: Google Maps, OpenStreetMap, Overture Maps (open data), Companies House, business directories and the business's own website. We keep only business details: the business name, address, website, business phone and email, the names and roles of people the business or Companies House lists publicly, and our own assessment of its website (speed, accessibility, search readiness) and of its local market.

Our lawful basis is legitimate interests: introducing relevant services to businesses, business to business. In the UK we email only companies, LLPs and PLCs (not sole traders or partnerships, who need to have agreed first), and we follow each country's rules elsewhere. Every email says where we found your details and how to opt out.

To stop hearing from us, use the unsubscribe link in any email or reply "unsubscribe". We stop at once and keep only a one-way code of your address (a hash) so we never contact it again. If you'd like everything we hold about your business deleted, email us and we'll erase it.

If a business doesn't engage, we delete the personal details within 12 months. Our service providers here are Resend (email), Anthropic (writing the email), Google (search and maps data) and Supabase (database), each under a data processing agreement.

Lawful bases

Contract: to deliver services and run your client account.

Legitimate interests: to respond to enquiries, secure our systems and improve our services, and to introduce our services to businesses (see above).

Consent: for optional analytics and marketing emails, which you can withdraw at any time.

Sharing

We share data only with processors who help us run the service, including Supabase (database and authentication), Vercel (hosting), Stripe (payments), Resend (email) and Anthropic (AI). Each is bound by a data processing agreement. Where data leaves the UK, we rely on adequacy regulations or the UK International Data Transfer Addendum.

Retention

Enquiry data is kept for up to 24 months. Client project data is kept for the life of the engagement plus 6 years for legal and accounting purposes, unless you ask us to delete it sooner where the law allows.

Your rights

You can request access, correction, deletion, restriction or portability of your data, and object to processing. Email us to exercise these rights. You can also complain to the Information Commissioner's Office (ico.org.uk).

Contact

Zelvorm, Office 18077, 182-184 High Street North, East Ham, London, E6 2JA. Email contact@zelvorm.com.