Privacy policy

Last updated: 6 September 2026

This policy explains what personal data Ambit Labs Ltd collects through the website at ambitlabs.ai and through enquiries, why we collect it, and what rights you have over it.

1. Who is responsible

Ambit Labs Ltd is the data controller for the personal data described in this policy.

• Company number: 16980164
• Registered office: 5th Floor, 167-169 Great Portland Street, London, England, W1W 5PF
• Email: hello@ambitlabs.ai

Where we process personal data inside a client's systems as part of an engagement, the client is the controller and we act as a processor under the terms of that engagement. Section 4 explains this in more detail.

2. What we collect

Enquiries. When you email us, we receive your name, email address, any company or role you mention, and the content of your message.

Website logs. Our hosting provider records standard server logs for each request: IP address, browser type, pages requested and the time of the request. We use these to keep the website running and to investigate abuse.

Website analytics. We use PostHog, a product analytics service, to understand how the website is used. Our PostHog project runs on PostHog Cloud EU, operated by PostHog Inc. on servers in Frankfurt, Germany. We run it in cookieless mode, which limits what it can do:

• It sets no cookies and stores nothing in your browser, so it cannot recognise you when you come back.
• To count visitors, PostHog's servers compute a hash of your IP address, your browser's user agent string, our domain name and a random value that changes every day and is then deleted. The hash cannot be reversed, and the same visitor produces a different hash each day.
• Your IP address is dropped after that step and is not stored with your data. We do not derive your location from it.
• We never ask PostHog to attach a name, email address or any other identifier to your activity, and the script is configured so that it cannot.

While you are on the site it records:

• The pages you view, the site that referred you, and any campaign tags in the link you followed
• Your browser, operating system, device type, screen and window size, language and time zone
• Where on the page you click and scroll, so we can see which parts of a page get attention
• Clicks on links and buttons, including the text of the element you clicked
• JavaScript errors the page produces, with the technical details needed to fix them
• Messages that scripts on the page write to the browser console

We use this to see which pages get read and to find broken pages and confusing layouts. We do not record your screen, replay your visit or show surveys.

Engagement records. When you become a client, we hold the contact details of the people we work with, the agreements we sign, correspondence and invoices.

The website has no user accounts and does not ask you to register.

3. Why we use it and on what basis

Under UK data protection law we need a lawful basis for each use of personal data.

• Answering enquiries and discussing possible work: our legitimate interest in running the business, and steps taken at your request before entering a contract
• Running and securing the website: our legitimate interest in keeping the website available and safe
• Measuring how the website is used: our legitimate interest in knowing which pages get read and which ones break, using analytics that cannot recognise you across visits
• Delivering an engagement: performance of our contract with the client
• Keeping accounting and tax records: our legal obligations

We do not use personal data for advertising, and we do not sell it.

4. Client data and private deployments

Most of our work involves documents and records that clients cannot send to a public API. How we handle that data depends on where the system runs.

Private deployments. When a system runs on the client's servers or inside the client's own cloud account, the data stays there. We do not receive, copy or store it, and no third-party model provider is involved unless the client asks for one in writing.

Prototypes and pilots we host. When a client or prospect shares documents with a tool we operate during a pilot, we process those documents only to run that tool. We do not use them to train models. We delete them at the end of the pilot or earlier on request. If a pilot uses a cloud model provider, we name the provider in the engagement agreement before any data is sent.

Contracts. Confidentiality, security measures, sub-processors, retention and deletion for each engagement are written into that engagement's agreement or a data processing addendum.

5. Who we share it with

We share personal data only with:

• Service providers who host the website, deliver our email and store our files, under contracts that restrict what they can do with it
• PostHog Inc., which runs our website analytics on our behalf on servers in Frankfurt, Germany, under a data processing agreement
• Professional advisers such as accountants and lawyers, where needed
• Public authorities, where the law requires it
• A buyer or successor, if the business is sold or reorganised

6. International transfers

Ambit Labs Ltd is based in the United Kingdom. Some of our service providers process data outside the UK. Where they do, we rely on UK adequacy regulations or on approved contractual safeguards such as the International Data Transfer Agreement. Website analytics data is stored in the European Union and does not leave it. The UK treats the EU as providing adequate protection for personal data.

7. How long we keep it

• Enquiries that do not lead to an engagement: up to 24 months after our last contact
• Website logs: for a short period set by our hosting provider, then deleted
• Website analytics: up to 24 months
• Engagement records and invoices: 6 years after the engagement ends, to meet legal and accounting obligations
• Client documents in pilots we host: until the end of the pilot, or earlier on request

8. Security

We keep personal data encrypted in transit and at rest, limit access to the people who need it, and build systems so that sensitive data stays inside the client's perimeter wherever possible.

9. Your rights

Under UK GDPR you can ask us to:

• Give you a copy of the personal data we hold about you
• Correct data that is wrong
• Delete your data
• Restrict how we use it
• Provide it in a portable format
• Stop processing based on legitimate interests, where your situation justifies it

Website analytics data is not linked to your name, email address or any account, and the daily hash cannot be traced back to you. That means we cannot pick out your records to copy, correct or delete them. If you would rather the analytics script sent nothing at all, turn on Do Not Track or Global Privacy Control in your browser. When either signal is present, the website does not start the analytics script and nothing is sent.

To exercise any of the rights above, email hello@ambitlabs.ai. We respond within one month. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

10. Cookies

The website does not set cookies and stores nothing in your browser. Our analytics runs in cookieless mode, described in section 2, so there is no cookie banner. If we ever introduce cookies, we will update this policy and ask for consent where the law requires it.

11. Children

The website and our services are aimed at organisations, not at individuals under 18. We do not knowingly collect personal data from children.

12. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed.

13. Contact

• Ambit Labs Ltd
• 5th Floor, 167-169 Great Portland Street, London, England, W1W 5PF
• Email: hello@ambitlabs.ai
• Website: ambitlabs.ai