Privacy notice

This notice explains what personal data we collect when you use this website, contact us, book a call, hear from us or work with us, and what we do with it.

Aethon Ventures Limited is the controller. Company number 16546017, registered in England and Wales. Registered office: 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. ICO registration reference: ZC108563. Contact: itdepends@aethonventures.co.uk.

• Our analytics count visits in aggregate and don’t identify you.
• Cloudflare checks the form and booking for automated misuse. It sees your IP address and browser details to do it.
• The contact form goes to us and nobody else. We use it to reply.
• We contact businesses we think we can help, using business contact details from public sources. Tell us to stop and we will.
• Data in your systems that a fix reads or writes is handled under a written agreement with your business.

Hosting. The site is hosted by Vercel. Vercel’s systems record the IP address, browser type and page requested for each visit, in short-lived logs kept for security and to keep the site running.

Analytics. We use Vercel Web Analytics, which counts page views, referring sites, country and device type in aggregate. It does not identify you.

“Your own number”. Some pages let you type in figures to estimate what a problem costs you. The sum is worked out in your browser. Nothing you type is sent to us or stored.

What stays in your browser. If you start the form on our Talk to Us page, what you type is kept in your browser’s session storage, so it is still there if you leave the page and come back. Nothing reaches us until you press Send. It is cleared once the message is sent, or when you close the tab. The How We Work page also notes, for that tab only, that you have seen its opening animation, so it doesn’t play again. Neither is used to track you.

The contact form

When you send the form on our Talk to Us page (/talk-to-us), we receive your name, work email, business name, the problem you picked and anything you wrote. It goes through our server to HubSpot, our customer records system, and a copy reaches our Microsoft 365 mailbox. Lawful basis: legitimate interests (replying to you) and taking steps at your request before a contract.

Before the form is sent, Cloudflare Turnstile checks that a person, not an automated program, is using it. To do this, Cloudflare sees your IP address and information about your browser and device. To stop the form being sent too many times, we keep a scrambled version of your IP address for ten minutes with Upstash. Lawful basis: legitimate interests (keeping the form and our systems secure).

Booking a call

Our Talk to Us page (/talk-to-us) shows open times for a call. Booking a call is handled by HubSpot, our customer records system. When you book, your name, work email, business name and the problem you’d like fixed go through our server to HubSpot, which records the meeting and the details you gave, checks Apurva’s calendar so the time is free and sends your confirmation. The same Cloudflare check and limit apply when you book. We use those details to prepare for the call and follow up. If the times can’t be shown or a booking fails, the page offers a link to HubSpot’s own booking page instead; HubSpot’s privacy policy covers that page, including any cookies it sets there. Lawful basis: taking steps at your request before a contract.

Emailing us

If you write to us, we keep the correspondence in Microsoft 365 while the conversation is live, and for six years afterwards if it leads to a job. Lawful basis: legitimate interests, or contract if you become a client.

When we contact you first

We approach businesses we think have a problem we can fix: in person, by phone and by email. We use business contact details (name, role, business, work email, work phone) from public sources such as company websites, business data providers such as Apollo.io, and LinkedIn, gathered with our own lead-sourcing system hosted in London, and keep them in HubSpot. We send email to businesses through Smartlead.

We rely on legitimate interests, and for email on the corporate subscriber rules in the Privacy and Electronic Communications Regulations. We don’t send marketing email to personal addresses, or to sole traders and partnerships, without consent. Every email tells you how to stop hearing from us; one reply is enough, and we keep only the fact that you opted out.

Working with us

If your business becomes a client, we hold the contact details of the people we work with for the length of the job and six years after, for our records. Lawful basis: contract and legal obligation.

Personal data held in your systems that a fix reads or writes (your customers’ names and contact details, for example) is a separate matter. There, your business is the controller and we act on its instructions as processor, under a written agreement that sets out what we process, where and for how long.

Suppliers

We hold the business contact and payment details of our suppliers for the length of the relationship and six years after, for our accounts and tax.

AI processing

Every AI model we use runs through Amazon Bedrock, in EU Regions, with zero data retention. Personal data is used to do the job and nothing is written to storage afterwards. No prompts or outputs are stored, and none are used to train models. The companies that make the models have no access to them. We don’t put personal data into free or consumer AI services. Personal data we process with AI stays in the UK and EU.

We don’t sell personal data, and we don’t share it with anyone for their own marketing.

We keep data in the UK or EU where we can. Where a supplier is outside the UK and EEA (Vercel, Cloudflare, Apollo.io and Xero’s hosting in the United States; Upstash, a US company, though our data sits on its servers in London, UK; and Smartlead in Australia), we rely on its data processing terms together with the UK International Data Transfer Addendum or the UK Extension to the EU-US Data Privacy Framework, whichever applies. Ask us for a copy of the relevant safeguard.

Under UK data protection law you can ask for a copy of your personal data, and ask us to correct it, delete it, limit or stop using it, or give it to you in a portable format. You can withdraw any consent you’ve given. Email itdepends@aethonventures.co.uk; we respond within one month.

You can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d rather you told us first.

We make no decisions about you by automated means that have a legal or similarly significant effect.

We store on your device only what the site needs to work: today, the two session storage items described in section 2, which are cleared when you close the tab. The Cloudflare check on our Talk to Us page collects only what it needs to tell people from automated programs. If we add analytics or anything else that stores information on your device, we will update this notice first and, where the law requires it, ask for your consent before anything is stored. If you use the link to HubSpot’s own booking page, HubSpot’s terms cover any cookies it sets there.

The site is served over HTTPS. Our systems need multi-factor sign-in. If a personal data breach affects you, we’ll tell you without undue delay, and tell the ICO within 72 hours where the law requires it.

This site and our services are for businesses. We don’t knowingly collect personal data from anyone under 18.

We’ll update this notice when what we do changes. The version and date are at the top.