Privacy notice

What this notice covers

This notice covers this website — the enquiry form, the Maya chat assistant and the hosting behind them.

It does not cover the AI receptionist service as delivered to a client on their own phone line. That service is governed by the written agreement with the client, who is the controller for calls to their own number, and the recording and consent wording for it is agreed with each client before their line goes live.

Who is responsible

ALF Digital is a sole trader business based in London, operating across the United Kingdom. ALF Digital is the controller for the personal information described here.

Contact for any privacy question or request: james@alf-digital.com. No postal address is published; email is the contact route for data protection matters.

What this website collects, and why

If you use the enquiry form

• Business name
• Email address
• Phone number
• What you need (a short free-text field)
• Your message

Why: to reply to your enquiry, discuss whether there is work worth doing, and keep a record of the conversation. Lawful basis: legitimate interests — you contacted a business expecting a reply, and responding to that enquiry is what the form is for. Where the conversation becomes a quote or an engagement, we also rely on taking steps at your request before entering a contract.

The form also contains one hidden field that is never shown to you. If it arrives filled in, the submission is treated as automated and is discarded without being sent anywhere. It collects nothing about you.

If you use the Maya chat assistant

• The message you type
• The most recent six messages of that conversation, so replies make sense in context

Why: to answer your question about the service. Lawful basis: legitimate interests — answering questions from someone looking at what we do.

Maya is not connected to the enquiry form. Nothing you type into it is added to a contact record unless you separately submit the form. Please do not put confidential information into it.

Technical information

• Your IP address is visible to Cloudflare, which hosts and serves this site, as it is to any website host.
• This site's own API endpoints use your IP address to rate-limit requests — five form submissions and twenty chat messages per minute.
• The analytics endpoint described below is rate-limited at thirty events per minute. It does not store your IP address to do it. Instead the address is combined with a secret key held on the server and converted into a one-way value; only that value is stored, for sixty seconds, after which it is deleted automatically. Without the secret key it cannot be turned back into your address. We treat that value as information about you for the minute it exists rather than calling it anonymous, because a one-way value derived from an IP address alone would not be — there are few enough possible addresses to work through them all.

Why: to keep the site available and stop automated abuse of endpoints that cost money to run. Lawful basis: legitimate interests — protecting the service and controlling its cost.

Analytics

This site uses Cloudflare Web Analytics. It is cookieless: it sets no cookies, writes nothing to your browser's storage, and does not fingerprint your device or browser. It does not track you across other websites, and there is no advertising network involved. It collects no personal data, which is why there is no cookie banner to click — the law requiring consent applies to storing or reading things on your device, and this stores and reads nothing.

Google Analytics was removed on 6 August 2026 and is not coming back. While it ran it set two cookies and called Google on every page load.

A correction. Until 19 August 2026 this notice said there was no analytics on this website. That was wrong. Cloudflare Web Analytics had been running for several months before this — switched on in our hosting dashboard rather than added to our code, which is how it was missed when this page was written. It is cookieless and collects no personal data. The notice was inaccurate, and this says so rather than quietly rewriting it.

Until 19 August 2026 the beacon was set to exclude visitors in the EU. From that date it measures all visitors.

Alongside the page views Cloudflare counts, this site records one custom event of its own, so we can tell whether people actually ring the demo line. When you tap or click a phone number on this site, the site sends itself a message containing exactly two pieces of information and nothing else:

• the word call_click, meaning a phone number was clicked; and
• the path of the page you were on — for example / or /services/managed-ai-receptionist. It is a page path only, never a full web address, so it cannot carry anything after a ? or a #.

That is the whole message. It contains no IP address, no cookie, no identifier of any kind, no name, no device or browser information, no referring page, and nothing you have typed. It is written to this site's own server log and to no database. Because it contains no identifier, two of these recorded events cannot be connected to each other or to you, and there is nothing in the record itself to look up, export or delete on request.

The only other thing that endpoint holds about the caller is the rate-limiting value described under “technical information” above: a one-way value derived from your IP address and a secret key, kept for sixty seconds and then deleted. It is never written into the event record, so the two are not connected, and it exists only to stop the endpoint being flooded. It is mentioned here because a notice that described the event as holding nothing at all, while the endpoint quietly kept something, would be exactly the kind of statement this page exists not to make.

Why: to know whether the homepage persuades anyone to ring the line. Lawful basis: legitimate interests — understanding whether the site works, using the least data that can answer the question.

The site still sets no cookies. That remains a checkable statement: open the site with developer tools and look. See the cookie notice.

Who your information is sent to

These are the only companies that receive anything you submit to this website. Each is named because it genuinely receives data, not as a precaution.

• Cloudflare — hosts this website and runs the code behind the form and the chat assistant. Every request to this site passes through Cloudflare. Cloudflare also provides the cookieless Web Analytics described above, so it receives the page-view counts it generates. The call_click event does not go to Cloudflare Web Analytics; it goes to this site's own endpoint, which runs on Cloudflare's network like the rest of the site.
• Telegram — when you submit the enquiry form, its contents are sent to ALF Digital as a Telegram message so the enquiry is seen quickly.
• ALF Digital's own CRM — the enquiry is also forwarded to ALF Digital's customer record system, which is hosted on Railway.
• Anthropic — messages you send to the Maya chat assistant, together with the recent conversation context described above, are sent to Anthropic's API to generate a reply.

Nothing is sold and nothing is sent to an advertising network. The one analytics provider is Cloudflare, named above, and what it receives is the cookieless, non-personal page-view data described in the analytics section — not anything you submit through the form or the chat assistant.

Information sent outside the UK

Some of the providers above process data outside the United Kingdom, including in the United States. That is a plain statement of where the data goes, and it applies whenever you use the form or the chat assistant.

How long information is kept

• Enquiries — 24 months from our last contact with you, in both the Telegram history and the CRM. If we are still in conversation, or you become a client, the clock runs from the last time we were in touch.
• Rate-limit records — 60 seconds. The enquiry form and the chat assistant keep a short-lived counter against your IP address; the analytics endpoint keeps one against the one-way value described above instead. Both expire automatically after one minute and are not used for anything else.
• Maya conversations are not stored by ALF Digital. They are sent to Anthropic to generate a reply and are subject to Anthropic's own retention.

You can ask for your enquiry to be deleted sooner, and it will be.

Your rights

Under UK data protection law you can ask for a copy of the personal information held about you, ask for it to be corrected or deleted, object to or restrict how it is used, and ask for it in a portable form. Because we rely on legitimate interests for most of the above, you can object to that use at any time. Email james@alf-digital.com and say what you want done; we will respond within one month.

You can also complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk.

Changes to this notice

If the systems described here change — a new processor, a new purpose, analytics being switched on — this notice is updated in the same change that makes it true, and the review date at the top moves with it.