Privacy policy

1. Who we are

Some scoping statements about what the service does and does not do legally appear on our Terms of Use page (§6 Disclaimers) and on our Data Processing Agreement (§3 Nature and purpose); please read those alongside this policy.

Record of Intent is a trading name of Reignites Ltd, a private company limited by shares, incorporated in England and Wales (company number 17113009) and registered at 25-29 Sandy Way, Yeadon, Leeds, West Yorkshire, LS19 7EW. We are registered with the Information Commissioner's Office (ICO) under registration number ZC130362, with "Record of Intent" recorded as a trading name.

Reignites Ltd is the data controller for all personal data described on this page.

Our privacy contact for Record of Intent is Alex Hunter, Director of Reignites Ltd.

2. How to contact us about privacy

We use two privacy contact addresses so it is clear which side of the business you are writing to:

• For matters relating to Reignites Ltd (our parent company) or to Reignite, our consultancy: [email protected].
• For matters relating to Record of Intent (this product): [email protected].

Both addresses reach the same person. Use either if you are unsure.

3. What data we collect

We collect the smallest amount of data we can while still operating the service. Today the categories are:

• Waitlist signup data. When you join the waitlist we collect your email address, a confirmation flag set when you click the link in the confirmation email, and the timestamp of each step.
• Cookieless analytics. We use Umami Cloud, a privacy-first analytics service that does not set cookies and does not identify individual users. Umami records page URL, referrer, broad device type, country (via IP, then the IP is discarded), and aggregate counts.
• Strictly necessary cookies. Cloudflare, our hosting provider, sets a small number of cookies needed to keep the site online and to protect against abuse. Examples include __cf_bm (bot management) and edge load-balancing cookies. We disclose the full list in §10.

When you submit our contact form (see §3.1) or express interest in a future pricing tier (see §3.2), we collect additional data described below.

3.1 Contact form (when shipped)

If you use our contact form at /contact, we collect your name, email address, the subject you chose from a dropdown, and the message you wrote. We also receive a Cloudflare Turnstile token confirming you are not a bot. For this anti-bot check, Cloudflare processes a small set of client signals (your IP address, TLS fingerprint, User-Agent header, and our site key). Cloudflare acts as our processor for this bot-detection purpose, and as a controller of the same signals when improving Turnstile itself. See Cloudflare's Turnstile Privacy Addendum for details. The submission is delivered to our team inbox via Resend, our transactional email provider; we reply from there. We do not add contact-form addresses to any marketing audience.

3.2 Pricing tier interest (when shipped)

If you express interest in a future pricing tier by clicking the "express interest" button on a pricing card, we collect your email address and a record of which tier you expressed interest in. By default, this is a transactional record only: we will email you once when that tier launches, then nothing further. If you also tick the "send me marketing emails" checkbox at signup, we will send you occasional marketing emails about that tier, and you can unsubscribe at any time from any of those emails.

3.3 Click and scroll analytics (when shipped)

When our site-wide click and scroll-depth tracking is enabled, we send anonymous event payloads to Umami Cloud capturing what was clicked (e.g. the link text and the page URL) and how far down the page each visitor scrolled. The tracking is cookieless and does not identify individuals. Form values are never sent (we strip them at the client before the event leaves the page).

4. Why we collect it (lawful basis)

Under UK GDPR Article 6 our lawful bases are:

• Consent (Article 6(1)(a)): for the waitlist (double-opt-in via the confirmation link); for pricing-tier interest (single-opt-in via tier-button click, plus a separate explicit opt-in for marketing email if you tick the checkbox); for the contact-form submission itself.
• Legitimate interests (Article 6(1)(f)): for cookieless analytics, click and scroll analytics, anti-spam (Turnstile), rate limiting, and abuse detection; for replying to your contact-form message. Our legitimate-interest balancing test concludes that anonymous analytics and security measures are proportionate, expected by users of a modern web service, and necessary to keep the service running and protected.

You can withdraw consent at any time by clicking the unsubscribe link in our emails or by writing to either privacy contact in §2. Withdrawal does not affect the lawfulness of processing before withdrawal.

5. Where your data is stored (sub-processors)

We use a small number of carefully chosen sub-processors. Each operates under a Data Processing Agreement with Reignites Ltd.

• Resend (transactional email and audience storage; waitlist, pricing-tier interest, contact-form delivery).
• Umami Cloud (cookieless analytics; pageviews and click and scroll events).
• Cloudflare (hosting, content delivery network, Workers, KV, Turnstile, Email Routing).
• Sentry (error monitoring; declared for future activation, currently inactive).
• Supabase (database, currently inactive; revives when the paid product launches).

We do not use any other sub-processor for personal data submitted to roi.

6. International data transfers

Some of our sub-processors process data outside the United Kingdom:

• Resend is primarily based in the United States. Transfers to Resend are covered by Resend's Data Processing Agreement and the UK addendum to the EU Standard Contractual Clauses.
• Cloudflare operates a global edge network; data is typically processed at the edge closest to the visitor. Cloudflare's Data Processing Agreement covers international transfers.
• Umami Cloud processes data within the EU (Croatia); UK-EU adequacy applies and no additional safeguards are required.
• Sentry can be configured for EU or US processing; if activated in the US, the UK addendum to the Standard Contractual Clauses applies.
• Supabase is planned for EU hosting at activation; UK-EU adequacy applies.

7. How long we keep your data

When the retention period ends, we delete the data or anonymise it so it can no longer identify you.

8. Your rights

Under UK GDPR you have the following rights:

• Right of access: ask us for a copy of the personal data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): ask us to delete your data.
• Right to restriction of processing: ask us to limit how we use your data.
• Right to data portability: ask us to provide your data in a structured, commonly used format.
• Right to object: object to processing based on legitimate interests, including direct marketing.
• Rights related to automated decision-making: we do not perform automated decision-making that produces legal or similarly significant effects.

9. How to exercise your rights

Email the relevant privacy contact in §2. We will respond within 30 days. We may extend this by up to two further months for complex requests, in which case we will tell you within the first month why we need more time.

Exercising your rights is free unless your request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act.

10. Cookies

We set only the cookies needed to keep the site online and protect it from abuse. None of our cookies track you across sites, and none are used for marketing.

We do not use analytics cookies (Umami is cookieless). We do not use marketing cookies, retargeting pixels, or third-party tracking scripts. No cookie consent banner is required because every cookie we set is strictly necessary under PECR Regulation 6(4).

11. Complaints to the ICO

If you are unhappy with how we have handled your personal data, you can complain to the Information Commissioner's Office at ico.org.uk/concerns or by post to:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We would appreciate the chance to put things right first; please contact us via §2 before complaining to the ICO if you can.

12. Changes to this policy

We may update this policy as the service evolves. Material changes will be highlighted on the site for at least 30 days before they take effect. The current version is shown at the top of this page; previous versions are kept for reference and are available on request from either privacy contact in §2.

13. Governing law

This policy and any disputes arising under it are governed by the laws of England and Wales and subject to the exclusive jurisdiction of the English courts.