Privacy policy

How SolaraoLabs collects, uses and protects personal information when you use this website, send us an enquiry or work with us as a client.

Last updated: 2 November 2026

Who we are

SolaraoLabs is an independent technology company based in the United Kingdom. For the purposes of UK data protection law (the UK GDPR and the Data Protection Act 2018), SolaraoLabs is the controller of the personal information described in this policy.

Where we process personal information on behalf of a client as part of a project, we act as that client’s processor. Our data processing summary explains how.

What we collect

• Project enquiries. When you use the enquiry form we collect your name, email address, company name (optional), the type of project, its stage, your budget range, your timeframe and your message. The form also contains a hidden anti-spam field that real visitors leave empty.
• Accounts. If you are invited to our client workspace or are a member of our team, your account is created through our authentication provider, Clerk. We store your account identifier, email address and display name, the organisation you belong to and your role. Passwords and two-step verification settings are held by Clerk, not by us.
• Client invitations. When we invite you to the workspace we record your email address, name and when the invitation was sent, accepted, revoked or expired. The invitation link itself is stored only as a one-way hash.
• Project information. Quotations, project details, milestones, approvals, updates and messages exchanged in the workspace, together with who wrote them and when.
• Files. Documents and images uploaded to a project (PDF, PNG, JPEG or WebP, up to 5 MB each), with the uploader and upload time. Files may contain personal information if you include it.
• Support tickets. The summary, product, priority and description of an issue you report, and the conversation that follows.
• Client relationship records. For client organisations, our team may keep contact names, job titles, business email addresses, phone numbers, notes and follow-up tasks.
• Security and audit records. A log of significant actions in the workspace (for example who approved a quotation or uploaded a file, and when), and the technical information our hosting and authentication providers process to deliver the site securely, such as IP address and browser details.

We do not use advertising trackers on this website, and we do not sell personal information.

To see how the public website is used and how quickly its pages load, we use Vercel Web Analytics and Speed Insights, from our hosting provider. They do not use cookies or track you across websites, and they report page views, referring sites, country, browser, device type and page speed as totals only.

If you agree in the cookie banner, we also use Google Analytics (provided by Google Ireland Limited) to understand in more detail how visitors find and use the public website. It sets cookies and collects information such as the pages you visit, how you arrived, your approximate location and your device and browser; Google may process this information outside the UK under its standard data protection safeguards. Google Analytics only runs after you say yes, never in the private workspace, and you can change your choice at any time on our cookie notice.

Why we use it and our lawful bases

• Responding to enquiries and preparing quotations — steps taken at your request before entering into a contract, or our legitimate interests in responding to business enquiries.
• Delivering projects, the client workspace and support — performance of our contract with you or with the organisation you work for (our legitimate interests in serving that organisation).
• Keeping accounts and the service secure, including sign-in, two-step verification for staff, rate limiting and audit logs — our legitimate interests in protecting our systems and our clients’ information.
• Keeping business and accounting records — compliance with our legal obligations.

Who we share it with

We use trusted service providers who process personal information on our behalf and only on our instructions:

• Clerk, Inc. — account sign-in, sessions and two-step verification.
• Our website hosting provider — hosting the website and its servers.
• Our managed database provider — storing the website’s database, including enquiries, project records and uploaded files, with backups.
• Resend — sending service emails such as invitations and notifications.

Information you add to a client project is visible to the members of that client organisation and to the members of our team working on it. We may also disclose information where the law requires it.

International transfers

Some of our providers are based in, or use infrastructure in, countries outside the UK, including the United States. Where personal information is transferred outside the UK, we make sure it is protected by the safeguards UK law requires, such as UK adequacy regulations or the International Data Transfer Agreement / Addendum.

How long we keep it

We keep personal information only for as long as we need it for the purposes above. Website form records (enquiries, cost estimates, discovery-call bookings, launch-update sign-ups and beta-test registrations) that have not led to a customer relationship are deleted automatically 730 days after they were last updated. Business and accounting records are kept for as long as the law requires. You can ask us to delete your information at any time (see below).

When a client organisation’s request to delete its portal account is confirmed, every member loses access straight away. 30 days later the members’ names, email addresses and sign-in accounts are erased, and the organisation’s saved contacts, invitations and onboarding answers are deleted. Invoices, payment records and signed contracts are kept for as long as the law requires.

How we protect it

The website is served only over HTTPS. Workspace access is limited by organisation and role, project files can only be downloaded by authorised project members, staff accounts must use two-step verification, and significant actions are recorded in an audit log.

Your rights

Under UK data protection law you have the right to ask for a copy of your personal information, to have it corrected or erased, to restrict or object to how we use it, and to receive it in a portable format. These rights are not absolute and some exceptions apply.

When we act on a request to erase your information, your portal account is anonymised and closed, your sign-in account is deleted, and your enquiries, call bookings, newsletter and launch-update sign-ups and beta-test registrations are deleted. Where an enquiry became a customer relationship we keep the business record but remove your name and email address from it. Invoices and signed contracts are kept for as long as the law requires.

To exercise any of these rights or ask a question about this policy, email support@solaraolabs.co.uk. We may need to confirm your identity before acting on a request.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to resolve your concern first.

Cookies

We only use cookies that are strictly necessary for signing in and keeping the site secure. See our cookie notice.

Changes to this policy

We will update this page when the way we handle personal information changes, and revise the “last updated” date above.