Privacy notice
This notice explains what personal data Akil Ltd (“we”) collects through akil.build, why, on what lawful basis, and what your rights are. We are the data controller. Company number [[COMPANY_NUMBER]]; registered office [[REGISTERED_ADDRESS]]. Contact: [email protected].
1. What we collect, and why
| When | Data | Purpose | Lawful basis | Kept for |
|---|---|---|---|---|
| You subscribe to the Brief | Email address; optional name; the page you subscribed from; confirmation and send timestamps | To send the weekly brief you asked for and to prove you asked for it (double opt-in) | Consent — withdraw any time via the unsubscribe link | Until you unsubscribe, then a suppression record (email only) so we do not mail you again |
| You send a contact or demo request | Name, email, company, role, message, page of origin | To reply and to discuss the service you asked about | Legitimate interests (responding to an enquiry you made); contract where it leads to one | 24 months after our last exchange, unless an engagement follows |
| You request a paper | Name, email, company, position, whether you opted in to follow-up | To give you the paper and, if you opted in, to tell you about related work | Legitimate interests for delivery; consent for follow-up | 24 months |
| You visit the site | Aggregated, cookieless analytics (Cloudflare Web Analytics): page, referrer, country, device class. No cookies, no cross-site tracking, no identifier stored on your device | To understand which pages are read | Legitimate interests | Aggregated only |
| You submit any form | A Cloudflare Turnstile bot-protection token and your IP address, processed by Cloudflare | To keep automated abuse out of our inbox | Legitimate interests | Not retained by us beyond the request |
2. Who processes data for us
We use a small number of processors, each under a data-processing agreement:
- Cloudflare — DNS, content delivery, bot protection, cookieless analytics.
- Railway — hosting of the website, its API and the database holding subscriptions and requests (EU region).
- Amazon Web Services — email sending (SES) and file storage (S3), London region (eu-west-2).
- Discord — an internal notification when a form is submitted (name, email and message are shown to our team in a private channel).
We do not sell personal data and we do not share it with advertisers. Where a processor is outside the UK, transfers rely on the UK International Data Transfer Agreement or an adequacy decision.
3. Email we send
Subscription emails come from [email protected]. Every brief carries an unsubscribe link and a one-click unsubscribe header. We do not use open-tracking pixels. Transactional messages (a confirmation link, a reply to your enquiry) are sent only because you asked for something.
4. Your rights
Under UK GDPR you can ask for access to your data, correction, erasure, restriction, portability, and you can object to processing based on legitimate interests. Where processing relies on consent you can withdraw it at any time without affecting what happened before. Write to [email protected]; we answer within one month. You can also complain to the Information Commissioner’s Office (ico.org.uk).
5. Security
Data is encrypted in transit and at rest, access is limited to the people who need it, forms are rate-limited and bot-protected, and administrative access requires authentication. No system is perfectly secure; if a breach affecting you occurs we will tell you and the ICO as the law requires.
6. Children
The site is intended for professionals and is not directed at children under 16.
7. Changes
We will update this notice when our processing changes. The review date at the top is the version you are reading. Material changes to how we use subscriber data will be announced in the Brief itself.