Legal

Privacy Policy

Last updated: 18 August 2026 · Version 4.2

01Who we are

Root Delta Ltd ("Root Delta", "we", "us") is a software studio based in Cambridge, United Kingdom.

Root Delta is the controller for personal data it uses for its own purposes, including website and email enquiries, business contacts, project administration, invoicing and legal compliance.

Where Root Delta processes personal data solely on a client’s documented instructions to deliver contracted services, the client is normally the controller and Root Delta is its processor. The client is responsible for providing privacy information about that processing. This notice still applies to information Root Delta uses for its own administrative, security or legal purposes.

Root Delta Ltd · Company No. 17304199 · Registered in England & Wales.
Registered office: St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS.
ICO registration: ZC183600.
Contact: hello@rootdelta.net · 01223 625603

02What we collect

We collect only what we need to respond to you and to run our business:

• Contact enquiries: your name, email address, phone number and description of the work you need help with, which are required when you use our website form. A service link may add a hidden service label. The form also contains technical fields used for routing and spam detection. If you contact us another way, we collect the information you choose to provide and what we need to respond. Our optional AI chatbot (see section 09) can ask for the same three details — name, email, phone — if you choose to leave them so we can follow up; you decide whether to share them, and the conversation content itself is also visible to us and to Elfsight.
• Business contact data: your name, role, organisation, professional contact details and relevant business context. We may receive this from you, your organisation, a referrer or a publicly available professional source, such as an organisation’s website or professional profile.
• Project & client data: information you share with us in the course of a project, which may include business documents, workflow descriptions and related materials. Please do not submit passwords, access credentials or other sensitive information through the contact form, the AI chatbot or ordinary email. Access to systems should be granted through client-owned account invitations or another agreed secure method.
• Technical data: the standard operational and security logs our network and hosting providers create at their end when they serve you a page, which is normal for any website. Those logs include your IP address and the page you asked for. From them our network provider produces an aggregated traffic summary we can see: request and visitor counts, which pages were asked for, roughly which country requests came from, and what its security layer blocked. We run no analytics script on this site, so nothing is placed on your device to measure or profile your visit from these logs, and we do not attempt to identify individual visitors from that summary. The one exception is the optional Google Ads conversion tag described in section 09, which is placed only if you actively accept it.

If we obtained your details from another source and contact you, we will identify that source and provide or link to this notice no later than our first communication, unless a legal exception applies.

All visible website-form fields are required so we can understand your enquiry, respond and arrange the requested call. The phone number is not used for unrelated marketing. If a contract or law later requires other information, we will explain this when we ask for it.

We do not knowingly collect special category data, and we do not buy or sell personal data.

03How & why we use it

04Lawful basis

Under UK GDPR we rely on:

• Legitimate interests: to respond to and manage enquiries, maintain professional relationships, keep appropriate business records, protect the website and our systems from spam and abuse, prepare quotes and proposals efficiently, and send proportionate business communications relevant to your role or organisation. The interests we are pursuing are running and growing a small software business, answering the people who contact us properly and promptly, and keeping our records and systems reliable, useful and secure. Before relying on this basis we weigh those interests against your rights and use only what the purpose needs; we do not rely on it where the effect on you would outweigh it, and the chosen channel must also be permitted under PECR. You can object to any processing we base on legitimate interests, and you can object to direct marketing at any time. If you object to marketing we stop and retain only the minimum suppression record needed to respect your choice.
• Contract: where you are personally party to a contract with us, or ask us to take necessary steps before entering one, to deliver that work. Where you act for a company or other organisation that is the contracting party, we normally rely on legitimate interests for proportionate project administration and communication with you.
• Legal obligation: to meet tax, accounting and other statutory duties.
• Consent: where PECR requires consent for electronic marketing, or where we ask for consent to another specific optional use — including the AI chatbot's own in-chat checkbox, which is the specific basis for any name, email or phone number you choose to leave there, on top of the separate cookie-category consent that must already be given before the chatbot is present on the page at all. You may withdraw consent at any time without affecting earlier lawful processing.

05Sharing & processors

We disclose personal data only where needed for the purposes described in this notice. The main recipients are:

• Cloudflare (Cloudflare, Inc., United States): domain-name service, content delivery and security for rootdelta.net. It processes request information, customer logs and contact-form content passing through its network under its data-processing terms. For limited information Cloudflare processes for its own security or legal purposes, its own privacy notice applies. It may set limited challenge or security cookies, as explained in our Cookie Policy.
• Netlify (Netlify, Inc., United States): website hosting and contact-form handling. It stores submissions and makes them available to us as our processor. We do not use Netlify Analytics.
• Akismet (Automattic Inc., United States): Netlify uses Akismet as part of its form service to check submissions for spam. Akismet receives the submission content and related technical details through Netlify’s processing chain.
• Google Workspace (provided by Google): our email, calendar and document storage. Your enquiry and any correspondence with us sit in this mailbox.
• OpenAI: we use OpenAI’s business services, under our own OpenAI business account, to help us handle website enquiries. This may involve sending information included in your enquiry to OpenAI. OpenAI’s terms for this account state that our content is not used to train OpenAI’s models unless we choose to opt in, which we have not done. We do not use this processing to make solely automated decisions about you with legal or similarly significant effects.
• Anthropic: we use Anthropic’s business services to support our internal operations. Where business contact information appears in material processed there, it is covered by Anthropic’s data-processing terms. Content is not used to train Anthropic’s models by default, and we have not opted in.
• Intuit (QuickBooks Online, UK edition): if you become a client or supplier, we may use QuickBooks for business contact details, invoice details, payment status, billing address, tax details and related correspondence. Website enquiries are not sent to QuickBooks. If we enter your information there, Intuit says it also acts as an independent controller for limited uses of that Business Connection Data, including product development and improvement, analytics, fraud prevention and security. Intuit’s Global Privacy Statement (opens in a new tab) explains that processing, and its QuickBooks UK terms (opens in a new tab) explain the role split.
• Project-delivery providers and specialists: on a live project, providers or specialists described in the signed project terms may process the minimum information needed to deliver the work. Where Root Delta acts as a processor, they are used only with the client’s authorisation and under written confidentiality and data-protection terms. Root Delta remains responsible for its own obligations.
• Elfsight, SL (Escaldes-Engordany, Andorra): powers two features on this site — a Google Reviews widget on our homepage, shown to every visitor, and an AI chatbot available on every page, only loaded if you actively accept the "AI chatbot" cookie category. The Reviews widget shares your IP address and request details with Elfsight simply by loading, the same way loading any third-party resource does, but we have confirmed (18 August 2026, after asking Elfsight to disable the one cookie it used to set) that it sets no cookie of any kind, so it is not part of the cookie banner — see our Cookie Policy for the detail. If you use the chatbot, Elfsight receives the conversation content. Elfsight has stated publicly (its support community, 27 May 2026) that the chatbot runs on OpenAI's ChatGPT (a "ChatGPT 5-mini" model at the time of writing). OpenAI's own stated policy is that it does not use business or API-tier data to train its models by default, and it publishes a list of the infrastructure sub-processors (including Microsoft, Amazon Web Services, Google Cloud Platform and Cloudflare) it uses for those products; we have not independently confirmed which OpenAI product or account Elfsight itself holds, or the specific data-processing agreement or safeguard Elfsight has with OpenAI for this feature, which is a separate arrangement from our own direct OpenAI account described below. If you choose to leave your name, email or phone number in a chat, that is used the same way as our contact form (see section 02). See our Cookie Policy for what each feature involves and what it sets, and Elfsight’s own Privacy Policy (opens in a new tab) and Terms of Service (opens in a new tab).
• Google: if you actively accept the "Advertising" cookie category, we use Google Ads conversion tracking to measure which enquiries followed a click on one of our ads. The tag and any related cookies are requested only after that acceptance; see our Cookie Policy for detail, and Google’s own Privacy Policy (opens in a new tab) and Ads Data Processing Terms (opens in a new tab).

We may also disclose personal data where genuinely needed to our accountant, insurer, broker, insurer-appointed legal, forensic or claims specialists, or another professional adviser, and to a regulator, court or law-enforcement body where we are legally required to. We do not sell personal data. Elfsight receives your IP address and request details whenever the always-on Reviews widget loads, and receives conversation content only if you use the chatbot; we do not share data with Google unless you have actively given the relevant cookie consent described above and in our Cookie Policy.

06International transfers

Some providers may process personal data outside the United Kingdom. Where this is a restricted transfer, we rely on UK approval regulations, which cover transfers to the EEA and other approved countries, or on approved contractual safeguards, and we assess the protection provided as UK law requires.

Cloudflare’s and Netlify’s current data-processing terms contain UK transfer mechanisms. Akismet is used through Netlify’s processing chain. Google and Intuit operate internationally. OpenAI and Anthropic also operate internationally. OpenAI’s Data Processing Addendum, which applies to our account under its own terms, incorporates the UK Addendum to the Standard Contractual Clauses for personal data originating in the UK; Anthropic’s Data Processing Addendum does the same and applies automatically under its commercial terms. For a project-delivery provider, the applicable recipient and transfer safeguard are recorded in the signed project terms before personal data is processed.

Google states that it uses Standard Contractual Clauses for transfers to countries without a UK or EU adequacy finding, and a specific UK-extended framework for transfers to the United States; that safeguard applies to the optional Google Ads processing described above. Elfsight, SL is based in Andorra, which is itself covered by UK adequacy regulations (Data Protection Act 2018, Schedule 21, carrying forward the European Commission's 2010 adequacy finding for Andorra), so this transfer is approved in the same way as a transfer to the EEA, with no separate safeguard required. The AI chatbot itself, as described in section 05, uses OpenAI (a United States company) to generate replies, on Elfsight's own account with OpenAI rather than ours, and we have not independently confirmed what transfer safeguard, if any, Elfsight has arranged with OpenAI for that. For this specific transfer we instead rely on your own explicit, informed consent as the safeguard, under Article 49(1)(a) UK GDPR: the cookie banner's "AI chatbot" category tells you, before you switch it on, that using the chatbot may send your message to the United States and that we have not confirmed a safeguard for that; accepting that category is your explicit consent to the transfer on that basis.

You may ask us for information about the safeguard applying to a particular provider and how to obtain a copy. For OpenAI and Anthropic, the safeguard is the UK Addendum described above.

07Retention

We keep enquiry emails, form submissions and chatbot conversations for as long as needed to deal with your request and for a reasonable follow-up period, with a target review no later than 12 months after our last contact with you. At that review we delete or anonymise records that are no longer needed, subject to any legal or contractual retention duty. The review covers the Netlify dashboard, email, our Elfsight account and any exported copies. Elfsight also retains chatbot conversation content on its own systems for a period we have not independently confirmed; see its Privacy Policy linked in section 05.

Cloudflare and Netlify retain technical and security information for periods set by their service terms, security schedules and the relevant service configuration. Those periods vary by log type and service, and are not within our control. Root Delta does not create a separate archive of the providers’ raw logs. For OpenAI, OpenAI states that it retains abuse-monitoring logs for up to 30 days by default, unless a longer period is required by law or necessary to protect the service from harm. We have not separately confirmed whether a different period applies to every OpenAI product we may use for this processing, and will update this notice if that changes. For Anthropic, inputs and outputs are retained for up to 30 days by default, longer only where a session is flagged by the provider’s safety systems or where law requires it.

Financial and statutory records are generally retained for six years where required for accounting, tax or legal purposes. Project contact and administration records are retained only for the relevant contractual, legal and dispute period. Where Root Delta processes personal data for a client, return and deletion follow the instructions in the applicable project contract.

08Your rights

Depending on the circumstances and the lawful basis for the processing, you may have rights to access, correct, delete or restrict the use of your personal data, to object to processing, and to receive or transfer certain data in a portable format. Where we rely on consent, you have the right to withdraw that consent at any time, without affecting processing already carried out. You also have the right to complain to the Information Commissioner’s Office (see Complaints).

To exercise any of these, email hello@rootdelta.net and we will respond within one month. We may need to verify your identity first, and for complex or numerous requests we may extend this by up to two further months, telling you if we do.

Root Delta does not use solely automated decision-making that produces legal or similarly significant effects.

09Cookies

A cookie banner on every page lets you choose which optional cookies to allow. Necessary cookies (Cloudflare’s security cookie and the banner’s own record of your choice) need no consent under PECR’s "strictly necessary" exception. Two optional categories — an AI chatbot and Google Ads measurement — are off until you actively switch them on, and nothing is requested from either provider before you do. The homepage also always shows a Google Reviews widget; it sets no cookie, so it sits outside the banner rather than as a third optional category. See our Cookie Policy for the full detail, including how to change your choice at any time.

10Security

We use HTTPS, multi-factor authentication on company accounts, BitLocker on company devices, least-privilege access and security updates. No online service is completely secure.

11Contact

Questions or concerns? Email hello@rootdelta.net or call 01223 625603. You can also write to us at Root Delta Ltd, St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS. If you are unhappy with how we have handled your data, see Complaints below.

12Complaints

If you think Root Delta has not handled your personal data lawfully, you have a legal right to complain to us, under section 164A of the Data Protection Act 2018. Email hello@rootdelta.net, call 01223 625603 or write to our registered office. Tell us what happened and what you would like us to do; you do not need to use a special form, and you can complain in whichever of those ways suits you. We will acknowledge your complaint within 30 days of receiving it, then, without undue delay, make appropriate enquiries, keep you informed of progress and tell you the outcome.

You can also complain to the Information Commissioner’s Office at ico.org.uk (opens in a new tab). You do not have to complain to us first, and complaining to us does not affect that right.