Privacy Policy

Last updated: 15 October 2026 (measuring our Google and ChatGPT adverts on the Client Acquisition Map, if you allow it). This notice dates from 14 October 2026 and replaces our earlier notice (first published 28 September 2026, last updated 12 October 2026).

In short

Crescat Digital Ltd is the data controller. Our Data Protection Officer is Lee Thomas, lee@crescatdigital.com.
We keep one record for each person who contacts us, or whom we contact, in the database of our Client Acquisition Map tool, hosted in London. It includes the permissions you gave or refused, in the exact words you saw.
We collect your details when you ask for a free report at tools.crescatdigital.com, send us an enquiry, ask for our AI Visibility Index, book a call, buy from us, become a client, or apply for a job or for our laptop donation scheme. We also find the work details of people at law firms in Apollo.io, a business-contact database, and on firms' own websites, so we can offer our services (section 7).
The Client Acquisition Map reads your Google Search Console, Google Ads and Google Analytics data only when you connect them, only to build your own report, and only in read-only mode. We revoke our access to your Google account as soon as your report is built.
We send marketing emails only if you tick the box that asks for them. Your free report comes with two follow-up emails unless you ask us to stop. Every automated email we send has an Unsubscribe link at the bottom, and most email apps can unsubscribe you in one click. Receipts and invoices from Stripe, and booking emails from Calendly, come from those companies without our Unsubscribe link.
We never sell your data and never use it to train AI models. We never use your Google account data for advertising. Our website's advertising and tracking tools load only if you accept them in our cookie banner; our cookie policy explains them.
Report data is deleted 90 days after your report is delivered. Website enquiries that go no further are deleted after 90 days. Section 14 lists every period. If you ask us to stop contacting you, we stop (emails about something you bought still come), and keep a scrambled (hashed) copy of your address so that we never contact you again. If we contacted you first, we also delete the map we built for you, and your details, straight away (section 7.5).
You can ask for a copy of your data, or ask us to correct or delete it, at any time. You can complain to us, and to the Information Commission, the UK regulator for data protection.

Contents: 1. Who we are · 2. What this notice covers · 3. The Client Acquisition Map and your Google data · 4. Where we keep your details · 5. The data we collect · 6. How we collect it · 7. Firms we contact first · 8. How we use it · 9. Our emails, and how to stop them · 10. Cookies · 11. Who we share it with · 12. International transfers · 13. Security · 14. How long we keep it · 15. Job applicants and the laptop donation scheme · 16. Your rights · 17. Complaints · 18. Changes to this notice · 19. Glossary

1. Who we are and how to contact us

Crescat Digital Ltd ("Crescat Digital", "we", "us") is the controller of your personal data. Company number 09369289, registered in England and Wales. Registered office: Unit 2 The Bramley Business Centre, Station Road, Bramley, Guildford, Surrey GU5 0AZ. Information Commission registration number [ICO registration number].

Our Data Protection Officer is Lee Thomas. Contact him with any question about this notice or to exercise your rights:

Email: lee@crescatdigital.com (or hello@crescatdigital.com)
Post: Crescat Digital Ltd, Unit 2 The Bramley Business Centre, Station Road, Bramley, Guildford, Surrey GU5 0AZ

If you are unhappy with how we have handled your data, section 17 explains how to complain to us and to the Information Commission, the UK regulator for data protection.

2. What this notice covers

This notice explains how we collect and use personal data when you:

use the Client Acquisition Map at tools.crescatdigital.com, including buying the 90-day plan;
send us an enquiry from this website, ask for our AI Visibility Index, book a call with us, or talk to us at an event;
ask us for a quote or proposal, or become a client;
work at a law firm we contact to offer our services, having found your work details ourselves (section 7);
use this website, or ask for our emails;
apply for a job with us, or take part in our laptop donation scheme (section 15).

Our website and tools are for businesses. They are not intended for children and we do not knowingly collect data about children.

We may give you a separate notice when we collect data for a specific purpose. That notice adds to this one; it does not replace it.

Our site links to other websites and services. We do not control them and are not responsible for their privacy practices. Read their notices before you share data with them.

3. The Client Acquisition Map and your Google data

The Client Acquisition Map is a free report on how your law firm's website wins clients from Google. To build it, we ask for read-only access to Google services you already use. This section explains exactly what we access, why, who sees it, how we protect it and when we delete it.

3.1 What we ask Google for, and when

We only ask for access when you click a connect button, and Google shows you a consent screen each time. You choose which property or account we may read. Two of the three connections are optional, and your report is built either way.

Connection	Google permission (scope)	What it lets us do
Google Search Console (required for the report)	`https://www.googleapis.com/auth/webmasters.readonly`	Read the search performance of the website you choose. Read-only.
Google Ads (optional)	`https://www.googleapis.com/auth/adwords`	Read the Google Ads account you choose. Google offers one scope for Ads that technically allows changes. We only read. We never change anything in your account unless you are a client and have instructed us in writing.
Google Analytics (optional)	`https://www.googleapis.com/auth/analytics.readonly`	Read reporting data from the Google Analytics 4 property you choose. Read-only.

3.2 What data we read

Search Console: the last 90 days of search queries, page addresses, clicks, impressions and average positions for your site.
Google Ads: the last 90 days of search terms, costs, clicks and conversions, plus the account's structure: campaigns, ad groups, keywords, negative keywords, conversion tracking settings, landing pages and change history.
Google Analytics: the last 90 days of sessions, engaged sessions, key events and users, grouped by landing page and by traffic channel. These are totals. We do not read data about individual visitors to your site.
Your website: we also crawl the public pages of your site, as a search engine would, to read titles, headings, links, forms and contact details.

3.3 What we do with it

We use this data for one purpose: to build your report and, if you buy it, your 90-day plan. That means:

mapping the searches your site can win to the pages that should own them;
showing which pages win visits but record no enquiry, and which paid search spend overlaps with your organic rankings;
scoring your site and comparing it with anonymous averages from other reports;
writing the plain-English summary and the metadata rewrites in your plan.

We keep anonymous aggregate statistics from all reports, such as the range of scores, so we can show you how your site compares. These statistics cannot identify you or your firm.

By requesting a report you agree that a member of our team may look at your report before it is sent, to check it is correct, and may discuss it with you if you book a call. Our team does not browse your Google accounts.

Our use of Google data follows Google's rules. The Client Acquisition Map's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In plain terms: we use your Google data only to provide the report and plan you asked for. We do not sell it, do not use it for advertising, do not use it to decide creditworthiness, and do not use it to train AI or machine-learning models.

3.4 Who else processes it

These providers process data on our behalf, under contracts that stop them using it for their own purposes:

Google (Search Console, Google Ads and Google Analytics APIs; PageSpeed Insights receives the addresses of a few of your pages to measure speed).
Semrush supplies the public record of search rankings used for the maps described in sections 3.8 and 3.9, and the competitor and search-volume figures in every report. It receives domain names and search phrases, never your personal details.
OpenAI writes the summary sentences in your report and the metadata rewrites in the 90-day plan. It receives search phrases, page addresses, page titles and aggregate counts from your report. It does not receive your name, email or Google account details.
OpenAI, Google Gemini, Perplexity and Anthropic answer test questions for the "AI answers" section, such as whether an assistant names your firm for a search like "employment solicitor Leeds". They receive only the search phrases and locations from your report. Our contracts with these providers do not allow them to train their models on this data.
Resend sends our emails. It receives your name, your email address and the link to your report.
Stripe takes payment if you buy the 90-day plan. Your card details go directly to Stripe; we never see your card number.
DigitalOcean hosts the tool and its database, in London. That database is also where we keep the records described in section 4.
Cloudflare protects our websites and sees the technical data of every request, such as your IP address.
Monday.com, for client firms only: we copy findings and scores into your project boards.

3.5 How we protect it

Your Google access tokens are encrypted at rest. The keys are held separately from the database.
All connections use HTTPS.
Your report is served on a private link that cannot be guessed. The link expires after 30 days (365 days for the 90-day plan). You can ask for a fresh one.
Only staff who need access have it, and they are bound by confidentiality.

3.6 When we let go of your Google account

We revoke our access to your Google account automatically, at Google, as soon as your report has been built. We hold the access for minutes, not months. You can also remove it yourself at any time at myaccount.google.com/permissions. Removing access does not delete the report we have already built; see section 3.7 for that.

If you buy the 90-day plan we ask you to reconnect Search Console once, about 80 days later, so we can measure what moved. That access is revoked in the same way once the re-run is complete.

3.7 How long we keep report data, and how to delete it sooner

Free report: your details, the data we read and the report itself are deleted 90 days after the report is delivered. If you started but did not finish, they are deleted 90 days after your last activity, and any Google access is revoked at the same time.
90-day plan: kept for 365 days from purchase, then deleted. Your purchase record is kept for six years for tax, with your email address removed at deletion.
Client firms: kept for as long as you are a client, then deleted under section 14.
On request: email us and we will delete your report, the data behind it and your details. We do this within 30 days and usually within a few working days.

Keeping your contact details for another reason in section 14, such as a call you booked or your request for our emails, does not keep your report any longer. When report data is deleted we keep a short record with none of your contact details, to count what our marketing produced; section 14 explains it.

3.8 Maps built from the public record, with no account connected

You can ask for a Client Acquisition Map without connecting any Google account. We then build it from the public record of your firm's search rankings and a crawl of your firm's own web pages. No account of yours is accessed, no password is asked for, and nothing is changed. The demand figures in a map built this way are estimates, and every one of them is labelled as an estimate in the report.

The public ranking data comes from Semrush, a search-data provider (see section 3.4). We send Semrush the firm's domain name; we do not send it your name, your email address or anything else about you. The only personal data involved is the contact details you gave us on the form, which we handle exactly as described in sections 4 to 9. We process the firm's public ranking data and public pages under our legitimate interest in giving you the report you asked for.

You can connect Search Console at any time afterwards. If you do, the estimates are replaced by figures measured in your own account, and section 3.1 onwards applies from that moment.

3.9 Maps we build for firms that did not ask

We sometimes build a Client Acquisition Map for a law firm that has not asked for one, from the public record and a crawl of that firm's own pages, exactly as described in section 3.8, and send it to a named person at the firm. We do not access any account belonging to the firm. Section 7 explains how we choose the firm and the person, where we find their details, the law we rely on, and how to stop us.

4. Where we keep your details

We keep one record for each person in our sales records, in the database of the Client Acquisition Map, which DigitalOcean hosts for us in London. Your record brings together:

your name, role, firm, email address and, if you gave it, your phone number;
the reports you asked for (section 3);
your enquiries from our website, with the page you sent them from;
how you heard about us, if you told us, and the campaign that brought you, if the page you came from said (section 5);
calls you booked with us, and where our conversations about working together have got to;
what you bought from us;
each permission you gave or refused, with the exact words you saw, the form or page where you saw them, and when;
any request to stop contacting you, and whether an email to you bounced or was marked as spam.

Each record has a deletion date, worked out from the periods in section 14. A job in the tool runs every day and deletes what is due.

Other services hold a copy of some of your details, for one job each:

Microsoft 365 hosts our email, including hello@crescatdigital.com and our staff mailboxes. When you send a form on our website, our website emails us about it through Resend. If the enquiry is saved in our records, that email carries only a reference and a link. If it could not be saved, the email carries the whole enquiry and is our record of it. Your replies to our emails, and any email you send us, also arrive in Microsoft 365.
Calendly holds the calls you book with us through our calendar.
Stripe holds your payments.
Resend sends our emails. If you ask for our marketing emails, Resend also keeps you on the list they are sent to, and takes you off it when you unsubscribe.
Apollo.io is a business-contact database we search for people at law firms (section 7). We do not upload our records to it.

Our staff reach your record through two staff pages in the Client Acquisition Map:

The staff tool, which each person signs in to separately, with a link sent to their own crescatdigital.com address. Every export, deletion, request to stop and permission recorded there is logged against the name of the member of staff who made it. Deletions, requests to stop and additions to our suppression list are made only here.
The page where we check each report before it is sent (section 3.3). It shows the name, firm and email address of each person who asked for a report, or to whom we are sending a map, so that we can approve it. It is protected by one password shared by the staff who check reports, so what is done there is logged as done from that page, not against a person's name.

Job applications and the laptop donation scheme are kept apart from these records; section 15 explains how.

5. The data we collect about you

Personal data means information that can identify you. It does not include anonymous data. We collect these kinds:

Identity data: your name, job title or role and the firm you work for.
Contact data: email address, telephone number, and postal or invoicing address.
Financial data: payment card details, handled by Stripe, and bank details for invoiced work.
Transaction data: details of payments and services you have bought from us.
Enquiry data: what you tell us in a form, an email, a call or a meeting, and where our conversations about working together have got to, such as a call booked or a proposal sent.
Permission data: the permissions you gave or refused, the exact words you saw, where and when; your requests to stop contacting you; and whether an email to you bounced or was marked as spam.
Source data: how you heard about us, if you tell us; the campaign tags (such as utm_source) and advert click IDs (such as gclid) in the address of the page you came from; the page you sent a form from; and, if we contacted you first, where we found your details.
Firm data: your firm's legal form (company, limited liability partnership, partnership or sole practice) and Companies House number, which decide which email rules apply to it. For a sole practitioner, this can be personal data.
Technical data: IP address, browser type and version, device and operating system, and how you reached our site. When you send one of our forms, we use your IP address to stop spam; the Client Acquisition Map keeps it with your report for the same period.
Google account data: the Search Console, Google Ads and Google Analytics data described in section 3, and the email address of the Google account you connected.
Website performance data: what we read when we crawl your firm's public website.
Usage data: how you use our website, tools and services, including which parts of your report you opened (section 10).
Marketing and communications data: your marketing preferences and how you have responded to our emails.

Job applicants and people in our laptop donation scheme: section 15 lists what we collect.

We also use aggregated data, such as statistics across all reports. It is derived from personal data but cannot identify you, so it is not personal data in law. If we ever combine it with personal data, we treat the result as personal data.

We do not ask for special categories of personal data (such as health, religion, politics or sexuality) or data about criminal convictions.

Where we need data to perform a contract with you and you do not provide it, we may not be able to provide the service. We will tell you if that is the case.

6. How we collect your data

Directly from you: when you fill in our report form or a form on this website, book a call, email or phone us, give us your details at an event such as the London Law Expo, contact us on LinkedIn, sign a contract or buy from us.
From your Google accounts: only when you connect them in the Client Acquisition Map, as set out in section 3.
Automatically: technical and usage data through cookies, server logs and similar technologies when you use our website and tools. The tools on our website that are not strictly necessary collect it only with your consent. When you send our discovery-call form or our AI Visibility Index sign-up form, or follow a link to the Client Acquisition Map, our own code also reads the campaign tags and advert click IDs from the address of the page, without cookies. See section 10.
From a business-contact database and public sources: if we contact you first, we find your work details in Apollo.io, on your firm's own website or in a public professional directory, and your firm's legal form on Companies House. Section 7 explains this.
From the companies that provide services to us: Calendly (the calls you book), Stripe (payments), CallTrackingMetrics (calls to our tracking numbers), and analytics, advertising and visitor-identification providers (technical data, only if you accept them in our cookie banner).

7. Firms we contact first

We look for law firms we believe we can help, and write to a named person there, usually a partner or the person who runs marketing, often with a Client Acquisition Map we have built from the public record (section 3.8). This section is our notice to you if we found your details ourselves rather than getting them from you.

7.1 Where we find your details

Apollo.io, a business-contact database run by ZenLeads Inc. (trading as Apollo.io) in the United States. We take your name, job title, firm, work email address and, sometimes, your work phone number and the address of your LinkedIn profile.
Your firm's own website and public professional directories, for your name, role and work email address.
LinkedIn, and events such as the London Law Expo, for your name, role and work email address.
Companies House, the public register of companies, for your firm's legal form and registered number.

We record where we found your work email address, and our first email to you says where it was (section 7.3).

Apollo.io decides for itself how it collects and keeps business contact details. Its privacy policy explains how, and how to ask Apollo to remove yours.

7.2 Who we write to

We email only people at firms that are companies or limited liability partnerships, at their work address. We check the firm's legal form first, on Companies House or the firm's own website.
If your firm is a sole practice or a partnership, we do not email you unless you have asked us to. We may write to you by post, or phone you.
We write to no more than two people at any one firm. We do not write to a firm that is already our client, or that has had a map from us in the last 90 days, or to anyone on our suppression list (section 9).
Before any marketing call, we check the number against the Telephone Preference Service and Corporate Telephone Preference Service registers, as they stood within the previous 28 days, and against our own list.

7.3 What we send, and how to stop us

Our first email says who we are, where we found your details and how to stop us writing, and tells you where to find this notice. To stop us, reply "no thanks" to any of our emails, or use the Unsubscribe link at the bottom of any email our Client Acquisition Map sends you. If you open the map we sent, we may send up to two short follow-ups about it, about three and twenty days later. We count the map as opened only when someone reads more than one part of it or uses one of its buttons, so a security scanner that checks the link does not start them.

7.4 The law we rely on

We rely on legitimate interests: our interest in offering our services to law firms we believe we can help. We have weighed that interest against your rights in a written assessment. We write about your professional role, to your work address, to no more than two people at a firm, with something useful in the first message, and we stop as soon as you ask. You have an absolute right to object to direct marketing. If you do, we stop, delete the map we built and your details (section 7.5), and keep only the hashed entries described in sections 9.2 and 14.

The law on electronic marketing, the Privacy and Electronic Communications Regulations (PECR), lets us email people at companies and LLPs without asking first, provided we say who we are and give a way to stop. It does not let us email sole practitioners or partnerships out of the blue: we need their consent, or the soft opt-in (section 19), which is why we do not.

7.5 How long we keep your details

If you do not reply, we delete your details and the map 90 days after we send it. If you ask us to stop, by unsubscribing, replying or telling our staff, we delete the map and your details straight away, unless you have since bought from us, connected your own data to the map or become our client, and keep only the hashed entries described in sections 9.2 and 14, so that we never write to you again.

When we check a list from Apollo against our records before writing, nothing about the people on the list is stored, except the number of rows in each outcome. If the check looks a firm up on Companies House, we keep a record of the firm: its web domain, its registered name, its company number and its legal form. We keep that record indefinitely, because it copies the firm's public entry on the register and tells us which email rules apply to the firm (section 14).

We also remove you from any list we have saved in Apollo.io itself 90 days after our last email to you, or as soon as you ask us to stop.

8. How we use your personal data, and the law that allows it

We only use your data when the law allows it. Most often that is because:

you have asked us to do something, or we are performing a contract with you;
it is in our legitimate interests, and your interests and rights do not override them;
we must comply with a legal obligation;
you have given your consent.

We rely on consent for five things: sending you marketing emails, sending you the AI Visibility Index, reading your Google account data in the Client Acquisition Map, the advertising and tracking tools, videos and map on our website, and the advert measurement you can allow on the Client Acquisition Map's report form (section 10). You can withdraw any of them at any time.

Purposes and lawful bases

Purpose	Type of data	Lawful basis
Build your free Client Acquisition Map report and send it to you	Identity, Contact, Google account, Website performance, Technical	Steps taken at your request before a contract. Consent, for reading your Google accounts
Send two follow-up emails after your report, about putting it to work and about our 90-day plan, and invite you to a walkthrough call	Identity, Contact, Usage	Legitimate interests (helping you act on the report you asked for; winning your business). You can say no in every email, or in one of the other ways in section 9.2.
Answer your enquiry, whether it reaches us through our website, by email, by phone or at an event	Identity, Contact, Enquiry, Source	Steps taken at your request before a contract; legitimate interests (answering the people who contact us)
Send you the AI Visibility Index when it is published	Contact, Source, Permission	Consent: you asked for that one email by pressing "Get the index the moment it is published", above the line "One email, when the index is published." We record your request with those words, and when you made it
Book a call with you through the calendar on our website, which Calendly provides for us, and prepare for it	Identity, Contact, Enquiry, Technical	Steps taken at your request before a contract; legitimate interests (preparing for the call you booked)
Keep track of where our conversations about working together have got to, prepare proposals and record the outcome	Identity, Contact, Enquiry, Firm	Steps taken at your request before a contract; legitimate interests (running our sales)
Send you our occasional marketing emails	Identity, Contact, Marketing and communications	Consent, given by ticking "Send me Crescat's occasional emails about winning clients online. Unsubscribe any time." on our report form or our discovery-call form, or by telling a member of our staff, who records it with a note of what you were asked and what you said. Withdraw it at any time (section 9)
Contact people at law firms that have not contacted us (section 7)	Identity, Contact, Source, Firm	Legitimate interests (offering our services to firms we believe we can help). You can object at any time, and we will stop
Sell and deliver the 90-day plan, including the day-90 re-run	Identity, Contact, Financial, Transaction, Google account, Website performance	Performance of a contract with you
Register you as a client and deliver our services	Identity, Contact, Google account, Website performance	Performance of a contract with you
Manage payments, fees and money owed to us	Identity, Contact, Financial, Transaction	Performance of a contract; legitimate interests (recovering debts)
Manage our relationship, including notices about changes to our terms or this notice, and asking for reviews or feedback	Identity, Contact, Marketing and communications	Performance of a contract; legal obligation; legitimate interests (keeping records up to date)
Find out which of our marketing brings enquiries and clients: how you heard about us, the campaign tags and advert click IDs, and the stages your enquiry reached	Source, Enquiry, Usage	Legitimate interests (knowing which of our marketing works, so we spend on what helps firms find us). We do not send the details we keep to Google, LinkedIn or any other advertising company, unless you tick the box on the Client Acquisition Map's report form that lets us measure our adverts (section 10). If you accept Advertising and tracking in our cookie banner, the tools it loads read the page's address, tags included, when they count a visit.
Check a firm's legal form, so we apply the right email rules to it	Firm	Legitimate interests (keeping our marketing within the law)
Keep a record of the permissions you gave or refused, and of your requests to stop, so we respect them and can show that we have	Permission	Legal obligation (to show consent was given, and to respect objections to direct marketing); legitimate interests
Run and protect our business, websites and tools: troubleshooting, testing, security, hosting and reporting, keeping spam out of our forms, and a log of what our staff do with personal data	Identity, Contact, Technical	Legitimate interests (running the business, security, preventing fraud); legal obligation

Job applications and the laptop donation scheme: section 15.

Marketing and measurement tools

Purpose	Type of data	Lawful basis	Providers
Measure how our website is used and improve it	Technical, Usage. Contact details you type into our forms, which Google receives in scrambled (hashed) form	Consent: Advertising and tracking in our cookie banner. Withdraw it at any time in Cookie settings	Google Analytics
Send email marketing about our services and content	Identity, Contact, Marketing and communications	Consent only. You opt in with the unticked box on our report form or our discovery-call form, and can opt out with the unsubscribe link in any email or by contacting us. We keep a record of your consent, with the exact words you saw and when, in the Client Acquisition Map's database	Resend
Measure our adverts and show them to people who have visited our website	Technical, Usage. Contact details you type into our forms, which Google receives in scrambled (hashed) form	Consent: Advertising and tracking in our cookie banner. Withdraw it at any time in Cookie settings	Google Ads, LinkedIn (the LinkedIn Insight Tag) and OpenAI (its pixel for our ChatGPT adverts)
Measure our adverts on Google and in ChatGPT: tell Google or OpenAI when a click on one of them led you to request a map, book a call, buy our 90-day plan or become a client (section 10)	Source (the reference Google or OpenAI added to the web address for your click), Enquiry (the step, when it happened, and our own reference for that step, so that it is counted only once) and, for the 90-day plan, Transaction (its price). Never your name, email address or phone number	Consent: ticking the box on the Client Acquisition Map's report form. Withdraw it at any time by emailing us; anything already sent cannot be recalled	Google (Google Ads) and OpenAI (our ChatGPT adverts), each as an independent controller
Track which marketing brought in each phone call	Contact, Technical, Usage	Consent: Advertising and tracking in our cookie banner. Withdraw it at any time in Cookie settings. Your number is recorded when you call and is not used for anything else without your permission	CallTrackingMetrics
Work out which organisations visit our website and which pages they view. If you browse from home or a small office, the result may point to you rather than to an organisation	Technical, Usage	Consent: Advertising and tracking in our cookie banner. Withdraw it at any time in Cookie settings	Lead Forensics, which calls Demandbase, LiveIntent and a service at a.usbrowserspeed.com
Play our videos and show our office on a map	Technical	Consent: pressing play or Show map, for that one video or map	Vimeo, YouTube (Google) and Google Maps
Link to our company page on LinkedIn	None until you press the link	Not needed: it is a plain link, and LinkedIn receives nothing from our pages until you press it. LinkedIn's own notice applies on its site	LinkedIn

We do not upload your details to Google, LinkedIn or any other advertising platform so that they can show you our adverts. If you tick the box on the Client Acquisition Map's report form, we send Google or OpenAI only the data the table above lists for measuring our adverts on Google and in ChatGPT (section 10).

Change of purpose

We only use your data for the purpose we collected it for, or for a compatible purpose. If we need it for something unrelated, we will tell you and explain the lawful basis. We may process your data without your knowledge where the law requires or allows it.

9. Our emails, and how to stop them

9.1 The emails we send

Emails about something you asked for or bought: your report link, your plan, receipts, sign-in links, the plan's re-run, and our answer to your enquiry. These come while you use the service. Opting out of marketing does not stop them. We stop only if an email to you bounces or you mark one as spam. A bounce lifts when you next ask us for a report or send our discovery-call or AI Visibility Index form; either lifts if you tell us the address works again, or that you want our emails again (section 14).
Follow-ups to your free report: two short emails, about three and twenty days after your report is delivered, about putting it to work and about our 90-day plan. They come unless you unsubscribe from either email, or ask us to stop in one of the other ways in section 9.2. If you buy the plan, one check-in about two weeks later, which you can stop in the same way.
Marketing emails: our occasional emails about winning clients online. You get them only if you tick "Send me Crescat's occasional emails about winning clients online. Unsubscribe any time." on our report form or our discovery-call form, or ask a member of our staff for them. The box is never ticked for you.
The AI Visibility Index: one email when the index is published, if you asked for it.
Emails to firms we contact first: section 7.

If two years pass with no activity from you, we ask you once whether you still want our marketing emails. If you do not answer, we stop sending them, and delete your details unless we need them for another reason in section 14.

9.2 How to stop them

Press Unsubscribe at the foot of the email. It opens a page that asks you to confirm with one button. We act only when you press it, so a security scanner that opens every link in an email never unsubscribes you.
Use your email app's own unsubscribe button, if it shows one. Our emails carry the standard one-click unsubscribe, so Gmail, Yahoo and other apps can unsubscribe you without opening a page.
Reply "no thanks" or "unsubscribe" to any email from us, or email hello@crescatdigital.com or lee@crescatdigital.com.
Tell any member of our staff, by phone or in person. They record it straight away.

When you unsubscribe or object, your email address goes on our suppression list: one list that every email we send is checked against, whatever the reason for it. We keep only a scrambled (hashed) form of the address, never the address itself, so that we can recognise it if it reaches us again, from any source, and not write to you. Staff can also add a phone number, a firm's web domain or a postal name and postcode to the list in the same form. A hashed entry still counts as personal data. We keep it indefinitely, because its only use is to make sure we do not contact you again.

Unsubscribing stops the follow-ups, our marketing emails, the AI Visibility Index email and any email offering our services. It also withdraws any consent you gave to our marketing emails or to the Index email, so that consent no longer keeps your details (section 14), and takes you off our mailing list at Resend if you were on it. It does not stop emails about something you bought, such as your plan's day-90 re-run. The unsubscribe page says so before you confirm.

We do not share your data with anyone outside Crescat Digital for their marketing without your consent. If you accept Advertising and tracking in our cookie banner, Google, LinkedIn, OpenAI, LiveIntent and Demandbase receive details of your visits to our website and also use them for their own purposes, such as advertising. Our cookie policy explains this.

10. Cookies and similar tools

Our website asks for your consent, in our own cookie banner, before it uses cookies and similar tools that are not strictly necessary. Advertising and tracking loads Google Analytics, Google Ads, the LinkedIn Insight Tag, CallTrackingMetrics, and Lead Forensics with the services it calls (Demandbase, LiveIntent and a service at a.usbrowserspeed.com), and our own code loads OpenAI's pixel for our ChatGPT adverts. Nothing from them loads until you accept it. Each video, and the map, loads only when you press play or Show map, and a note under it says so. You can change your choice at any time with Cookie settings, at the foot of every page.

For anything about cookies, see our cookie policy. It lists the cookies and similar tools we know of on this website, who sets each one, what it does, how long it lasts and how to control it.

If you arrive at our website from one of our adverts or emails, the page's address often carries campaign tags (such as utm_source) or an advert click ID (such as gclid). On a page with our discovery-call form or our AI Visibility Index sign-up form, our own code copies those tags from the page's address into hidden fields in the form, and they reach us only if you send it. When you press a link to the Client Acquisition Map, it adds them to the link. The Client Acquisition Map's report form reads them from its own address in the same way. Nothing is stored in your browser for this, and nothing is read from cookies. The tags are kept with your enquiry or report, for the same period, so we can see which marketing brought it (section 8).

The Client Acquisition Map sets only essential cookies, and only when needed: one so your report page can open the plan checkout without a password, and one that keeps client firms signed in to their console. Neither is used for tracking or advertising, and neither needs your consent. It also keeps the address of your report in your browser's session storage, so pages you open from the report can link back to it; that clears when you close the tab.

The booking calendar on our Book a call page, and on two of our thank-you pages (/thank-you-partner and /thank-you-seo-offer), is provided by Calendly and runs inside our page. Calendly asks for your consent in its own banner inside the calendar; our banner does not cover it. Calendly sets its own cookies in it to make booking work and keep it secure, and, only if you choose Accept all in its banner, to measure how the calendar is used and for marketing. You can change that choice with Cookie settings at the foot of the calendar. Calendly's privacy notice explains them.

Your report page also sends us a small first-party signal when it is opened, when you read each part of it, and when one of its buttons is used, so we know which reports were read and which step was taken. It carries the report's own reference and the time. No cookie is set for it and no third-party tag is involved. It is kept with your report for the same period as the report. When the report data is deleted, only which parts were opened and the stage reached stay, with the short record described in section 14.

Our emails carry no tracking pixels: open and click tracking is switched off at Resend, which sends them.

We share personal data with the providers named in sections 3, 4 and 8, and with:

service providers who host our systems, send our emails, take payments and support our services. Vercel hosts our website at www.crescatdigital.com and sees the technical data of every request, such as your IP address, including the forms you send. Microsoft hosts our email;
professional advisers, such as lawyers, bankers, auditors and insurers;
HM Revenue & Customs, regulators and other authorities where the law requires it;
a buyer or merger partner if we sell or restructure our business. They may use your data only as set out in this notice.

We require every provider that processes data for us to keep it secure and to process it only on our instructions, and we do not allow them to use it for their own purposes.

Some of the companies we use are not only our providers: they also use what they collect for their own purposes, as their own notices explain. They are Google (Google Analytics with Google signals, and Google Ads), LinkedIn, OpenAI (through its pixel for our ChatGPT adverts), LiveIntent and Demandbase, which receive data only if you accept Advertising and tracking; Google and OpenAI again, as independent controllers of the advert measurement on the Client Acquisition Map, which they receive only if you tick the box for it on the report form (section 10); in part, Vimeo, YouTube and Calendly; Stripe, for fraud prevention and its own legal duties; and Apollo.io, for its own database (section 7). Our cookie policy names the website tools and links to their notices. OpenAI also writes text for our Client Acquisition Map reports as our provider (section 3.4). That service and the pixel are separate: nothing from your report goes to OpenAI's advertising, and nothing from the pixel goes into a report.

12. International transfers

Some of our providers are outside the UK, mainly in the United States: among them Resend, Calendly, Stripe, Apollo.io, Vercel, Cloudflare and the AI providers in section 3.4. Whenever we transfer your data out of the UK we make sure it has protection equivalent to UK law, by one of these routes:

the country has UK adequacy regulations, such as the European Economic Area;
the provider is certified under the UK Extension to the EU-US Data Privacy Framework (the UK-US "data bridge");
we use the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.

13. Security

We use appropriate technical and organisational measures to stop your data being lost, misused, accessed without authority, altered or disclosed. Access is limited to people who need it for their work, and they must keep it confidential. In particular:

our staff reach the records in section 4 through the two staff pages described there. In the staff tool each person signs in separately, and every export, deletion, request to stop and permission they record is logged against their name. The page where we check reports before sending them is protected by one shared password, and cannot delete a record, record a request to stop or add to our suppression list;
our suppression list holds only scrambled (hashed) values;
Google access tokens are encrypted at rest, with the keys held apart from the database (section 3.5);
the database is backed up every night, and each backup is overwritten after seven days, so anything we delete is gone from our backups within a week.

We have procedures for suspected data breaches and will tell you and the regulator where the law requires it.

14. How long we keep your data

We keep personal data only as long as we need it for the purpose we collected it, including legal, accounting and reporting requirements. When deciding how long, we consider how sensitive the data is, the risk of harm if it were misused, and whether we can achieve the purpose another way.

The Client Acquisition Map works out a deletion date for each record and deletes what is due every day. If more than one row below applies to you, the longest period applies to your contact details; your report is still deleted on its own schedule (section 3.7).

Your situation	What we keep	How long
You asked for a free report and went no further	Your details, the data we read and the report	90 days after the report is delivered, or 90 days after your last activity if you did not finish
You sent us an enquiry, from our website or at an event, and it went no further	Your details and your enquiry	90 days after the enquiry
You asked for the AI Visibility Index	Your email address, your request with the words you saw, and the campaign tags of the page you sent it from	30 days after we send that one email. If you ask us to stop before it goes, no longer than 90 days after your last contact with us
We contacted you first (section 7) and you did not reply	Your details and the map we built	90 days after we send it. If you ask us to stop, we delete them straight away (section 7.5)
We are talking about working together	Your details, your bookings and our notes	While the conversation is open. If you had a call with us and did not go ahead, 12 months after we close the conversation, in case you come back to it. If the conversation closes before any call takes place, 90 days after it closes
You bought the 90-day plan	Your details, your report and your plan; the purchase record	365 days from purchase. The purchase record (amounts, dates and payment references) is kept for six years for tax, with your email address removed after the 365 days
You are, or were, a client	Identity, contact, financial and transaction data	While you are a client, and six years after the relationship ends, for tax and to deal with any claim
You asked for our marketing emails	Your details and your consent	Until you unsubscribe. After two years with no activity from you, we ask you once whether you still want them. If you do not answer, we stop and delete your details (section 9.1)
You unsubscribed, objected, or asked us not to contact you	A scrambled (hashed) form of your email address, phone number, firm's web domain or postal name and postcode, with why and when it was added; never the address or number itself	Indefinitely, so we never contact you again (section 9.2). The rest of your record follows the other rows; if we contacted you first, it is deleted straight away (section 7.5)
Records of the permissions you gave or refused, and of your objections	What each one was for, yes or no, the exact words you saw, where, when and how you gave it, and the member of staff who recorded it if one did, under a scrambled (hashed) form of your email address. A note our staff wrote about it is deleted with the rest of your record	Indefinitely, even after the rest of your record is deleted, so that a refusal or an objection still counts if your address reaches us again. If you ask us to delete your data, a consent you gave loses the hashed address and is deleted with the short record below; a refusal or an objection keeps it
An email to you bounced or was marked as spam	That it happened, and when, under a scrambled (hashed) form of your email address. The message from the receiving mail server, which can quote your address, is deleted with the rest of your record	Indefinitely, so that we do not keep writing to an address that does not work, or to someone who complained. A bounce lifts when you next ask us for a report or send our discovery-call or AI Visibility Index form; our staff can lift either once you tell us the address works again, or that you want our emails again. The record that it happened stays
Short records of what our marketing produced	Your role, how we came to have your details (such as our report form, a website form or Apollo.io), how you heard about us from a fixed list of answers, the campaign that brought you (source, medium and campaign name), dates and the stages reached; no name, email address, phone number, web address or IP address	24 months after your details are deleted. If we discussed working together, or your firm is or was our client, the short record stays linked to your firm's record, for as long as that is kept (next row)
Your firm's record	Its web domain and name; its legal form and Companies House number, if we checked them; and, if we discussed working together, the record of that conversation (the stages it reached, its value, its dates, the reason it ended and which of our staff led it) and any invoices	Deleted the day after nobody at the firm is left in our records, unless the firm is or was our client, we discussed working together, we invoiced it, or we checked it on Companies House. If the firm is or was our client, we discussed working together or we invoiced it, we keep its record for six years after the conversation closes or the firm stops being our client, as we do for client records. A firm we checked on Companies House keeps its web domain, registered name, number and legal form indefinitely (section 7.5)
The log of what our staff did with personal data	The staff member, the action, the record and the time	Six years

Copies held elsewhere follow the same periods where we control them:

Emails in our Microsoft 365 mailboxes about a website enquiry: 90 days, unless the enquiry goes further, when they are kept with the rest of our conversation.
Bookings in Calendly: deleted 90 days after the call.
Resend keeps a log of each email it sends, including the address, for 30 days.
Stripe keeps its own payment records under its own legal duties.
Backups of our database are overwritten after seven days (section 13).

In some cases we anonymise data for research or statistics, so it can no longer be linked to you. We may keep anonymised data indefinitely.

Job applicants and people in our laptop donation scheme: section 15.

15. Job applicants and the laptop donation scheme

These forms are not part of our sales records. They are emailed to us through Resend, kept in our Microsoft 365 email, and never added to the Client Acquisition Map or used for marketing.

15.1 If you apply for a job

We collect your name, email address, your answers to the job's questions, and your CV and cover letter, with anything you choose to put in them. We use them to consider you for the role, to contact you about it and, if we make you an offer, to check your right to work in the UK, as the law requires. Our lawful bases are steps taken at your request before a contract, our legitimate interests in recruiting the right people, and, for the right-to-work check, a legal obligation.

Please do not include health or other special category information in your CV unless you want us to make an adjustment for you; if you do, we use it only for that.

If you are not offered the job, we delete your application six months after we fill the role, unless you ask us to keep it for future vacancies. If you join us, it becomes part of your staff record.

15.2 If you take part in our laptop donation scheme

If you donate devices, we collect your name, email address, company, phone number, the devices you are giving, your confirmation of their condition and, if you give it, your address. If you apply for donated devices for a school or council, we collect your name, email address, position, phone number, your organisation and its type, and its address. We use them to run the scheme: to arrange collection and delivery, and to keep a record of what was given to whom. Our lawful basis is our legitimate interest in running the scheme you asked to join.

We delete these details 12 months after the last collection or delivery we arrange with you.

16. Your legal rights

Under UK data protection law you have the right to:

Access the personal data we hold about you (a "subject access request"). We can give you everything in our records about you in one file.
Correct data that is inaccurate or incomplete.
Erase your data where there is no good reason for us to keep it. We may have to keep some data for legal reasons, such as a purchase record for tax, and will tell you if so. If you also ask us not to contact you again, we keep the hashed entry described in section 9.2, because without it we could not keep that promise. Any refusal or objection you made before, and any bounce or spam report, is kept in the same hashed form (section 14), so that it still counts if your address reaches us again.
Object to processing based on legitimate interests, including our contacting you if we found your details ourselves (section 7), and to direct marketing at any time. An objection to direct marketing always stops it.
Restrict processing while a question about accuracy, lawfulness or a legal claim is resolved.
Transfer data you gave us to you or another provider, in a machine-readable format, where we process it by automated means under consent or a contract.
Withdraw consent at any time, without affecting what was done before. For our emails, see section 9.2. For Google data, you can also revoke our access at myaccount.google.com/permissions. For the tools on our website, use Cookie settings at the foot of any page. For the advert measurement you allow on the Client Acquisition Map's report form, email us (section 10).

We do not make decisions about you by automated means that have legal or similarly significant effects. Our forms refuse entries that look like spam by simple rules; if yours is refused by mistake, phone or email us.

To exercise any right, email lee@crescatdigital.com. There is no fee, unless a request is clearly unfounded, repetitive or excessive. We may ask for information to confirm your identity. We respond within one month; if a request is complex we will tell you and keep you updated.

17. Complaints

If you are unhappy with how we have handled your personal data, please tell us first. Email lee@crescatdigital.com, or write to us at the address in section 1. Say what happened and what you would like us to do. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.

You can also complain at any time to the Information Commission, formerly the Information Commissioner's Office (ICO). It is the UK regulator for data protection. Its website is ico.org.uk and its helpline is 0303 123 1113. You can complain to it online at ico.org.uk/make-a-complaint.

18. Changes to this notice

We update this notice when we change what we collect, why, or who handles it. The date at the top shows when we last changed it. If a change affects how we use details you have already given us, we will tell you by email before it takes effect.

19. Glossary

Legitimate interests means our interest in running our business well and giving you a good, secure service. We weigh any impact on you and your rights before relying on it, and do not use it where the impact on you would outweigh our interest.
Performance of a contract means processing needed to deliver a contract with you, or to take steps you ask for before entering one.
Legal obligation means processing needed to comply with a law or regulation we are subject to.
Consent means a clear yes from you, such as ticking a box that is never ticked for you. You can withdraw it at any time.
Soft opt-in is the rule in the electronic marketing law (PECR) that lets a business email someone whose address it got while selling, or discussing the sale of, a service, about similar services, provided they were offered the chance to say no at the time and in every email.
Corporate and individual subscribers: PECR treats a company or limited liability partnership as a corporate subscriber, and a sole practitioner or an ordinary partnership as an individual subscriber. Stricter email rules apply to individual subscribers.
Suppression list means our list of people who have asked us not to contact them, which every email we send is checked against.
Hashed means scrambled by a one-way calculation. We can tell whether an address we are about to use matches a hashed one, but cannot turn the hash back into the address.
Processor means a provider that handles data on our behalf and on our instructions.
Google user data means the data we read from your Google accounts through Google's APIs, as described in section 3.