Privacy Notice

Last updated: 27 August 2026

This notice explains what personal data Stratus AI Ltd collects when you use this website or work with us, why we collect it, who else sees it, and the rights you have. It is written to meet Articles 13 and 14 of the UK GDPR.

Who we are

Stratus AI Ltd is the data controller for the personal data described in this notice.

• Registered company number: 16427333, registered in England and Wales
• Registered office: 14 Princess Court, Canning Road, Croydon, CR0 6QB
• Email: hello@stratusailtd.com
• Telephone: 07834 764375

Stratus AI Ltd is a one-person consultancy. There is no separate Data Protection Officer, and we are not required to appoint one. Any question about data reaches Stuart Forbes directly at the address above.

What we collect, and why

If you book a call

The booking form on our contact page is provided by Calendly. When you book, Calendly collects your name, email address, the time you chose and anything you type into the booking form, and passes it to us so we can hold the meeting.

Our lawful basis is legitimate interests — responding to someone who has asked us to contact them. You can withdraw at any time by cancelling the booking or emailing us.

If you use the voice assistant

Our contact page offers an AI voice assistant, provided by VAPI. It only runs if you start it, and your browser will ask your permission before your microphone is used. If you allow it, your speech is sent to VAPI and its suppliers to be transcribed and answered, which means audio of your voice and a transcript of what you said leave your device.

Our lawful basis is consent, which you give by starting the assistant and allowing microphone access, and which you can withdraw by closing it or refusing the browser prompt.

If you email or call us

We keep your message and contact details so we can reply and keep a record of what was discussed. Lawful basis: legitimate interests, or performance of a contract if you become a client.

If you become a client

We hold the contact and billing details needed to deliver the work and meet our accounting obligations. Lawful basis: performance of a contract, and legal obligation for anything HMRC or Companies House requires us to keep.

When you simply visit the site

We use Google Analytics 4 to understand how the site is used — pages viewed, roughly where in the world visitors are, and what device they use. We do not use it to identify individuals and we do not run advertising or retargeting from this site.

Data we hold about people we have not met

Part of what we do for clients is research and outreach, which means we sometimes hold business contact details for people we have never spoken to — typically a name, job title, employer and work email address, gathered from public sources and business data providers.

Lawful basis: legitimate interests, being business-to-business contact about services relevant to that person's professional role. If you have heard from us and would rather not, say so and we will remove you and record the fact so you are not contacted again. One email to the address above is enough, and you do not have to give a reason.

Where we do this work on behalf of a client, that client is usually the data controller and we act as their processor. Tell us either way and we will make sure the request reaches the right party.

Who else sees it

We do not sell personal data, and we do not share it for anyone else's marketing. It is handled by the suppliers who run the tools we use:

• Calendly — booking and scheduling
• VAPI — the voice assistant, if you choose to use it
• Google Analytics — website analytics
• Google Workspace and Microsoft 365 — email and files
• Netlify — website hosting
• Our accountant — for client billing records

Some of these suppliers are based outside the UK, mainly in the United States. Where data is transferred outside the UK, it relies on the UK Addendum to the EU Standard Contractual Clauses or the UK Extension to the EU-US Data Privacy Framework, which are the safeguards those providers offer.

We will also disclose information where the law requires it.

How long we keep it

• Enquiries that do not become work: up to 12 months, then deleted
• Client records: for the length of the engagement and 6 years afterwards, which is the period UK tax law requires
• Outreach contact data: reviewed at least annually, and removed on request
• Analytics: as set in Google Analytics, currently 14 months

Cookies

This site sets Google Analytics cookies to count visits and see which pages are used. Calendly and the VAPI voice assistant set their own cookies when those features load.

Being straight with you: this site does not currently show a cookie banner, so analytics cookies are set when you arrive. If you would rather not be measured, you can block cookies in your browser settings, use your browser's private mode, or install Google's opt-out add-on. We are adding a proper consent banner and will update this notice when it is live.

Your rights

Under UK GDPR you have the right to:

• Ask what personal data we hold about you, and get a copy
• Have inaccurate data corrected
• Have data erased, in the circumstances the law allows
• Restrict or object to how we use it, including objecting to anything based on legitimate interests
• Ask for data you gave us in a portable format
• Withdraw consent at any time, where consent is the basis

Email hello@stratusailtd.com and we will respond within one month. There is no charge, and you do not need to use any particular form of words.

How to complain

If you are unhappy with how we have handled your data, please tell us first so we can put it right. You also have the right to complain to the UK's data protection regulator:

• Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Helpline: 0303 123 1113
• ico.org.uk/make-a-complaint

Changes to this notice

If we change how we use personal data we will update this page and change the date at the top. This notice was first published on 27 August 2026.