Privacy & cookies

Who is responsible

Mitchell Finance & Technology Ltd is responsible for this information. We are registered in England and Wales, company number 17554461. Our registered office is listed on the Company details page.

For questions or requests about your information, contact Stephen Mitchell at stephen@mitchellfinance.co.uk or write to the registered office.

What we collect

If you submit our enquiry form, email or telephone us, we receive the contact details and information you choose to share. This may include your name, role, company, email address, telephone number, business requirements and correspondence. We keep relevant notes about calls, proposals and agreed follow-ups.

We normally receive this information directly from you. An introducer may also provide your business contact details and the reason for a referral.

Hosting and security providers also process technical information needed to deliver and protect the website, such as IP addresses, request times, browser details and security logs. Please avoid sending passwords, identity documents or sensitive employee or financial records with an initial enquiry.

Website AI assistant

The optional chat helps explain our services. Your questions and the recent conversation are sent to OpenAI’s API to generate answers. If you select “Prepare an enquiry”, your messages are used to draft a summary for you to check and edit. AI output can be inaccurate. It does not book appointments, agree prices or make decisions about accepting work.

Chat text is held in the page while it is open. Our application does not save a separate conversation transcript. We request that API responses are not stored as retrievable response history. OpenAI may still retain content in abuse-monitoring logs, normally for up to 30 days unless longer retention is required by law. API data is not used to train OpenAI models by default. These API arrangements are separate from the personal ChatGPT/Codex account described below. See OpenAI API data controls and OpenAI’s API data processing terms.

Only when you submit the reviewed enquiry are the summary, name, email and optional company sent to Formspree for delivery to our inbox. The contact fields on that form are not sent to the AI model. You can bypass the assistant and use the enquiry form, email or telephone instead. Please do not enter passwords or confidential financial, employee or customer records in chat.

To prevent abuse and control usage, our hosting processes your IP address and stores a daily-changing keyed hash, request time and monthly usage marker in a cloud database. We do not store the raw IP address in this application database. Usage records are removed after 35 days during subsequent chat activity; provider security logs may have their own retention. Our legitimate interests are responding to business enquiries and providing a secure, reliable service. OpenAI API processing may take place outside the UK under the safeguards in its applicable data-processing terms.

Why we use it

We use enquiry details to understand your requirements, reply, arrange conversations, prepare proposals and manage appropriate follow-ups. Our legitimate interests are running the business, responding to relevant enquiries and keeping an accurate record of discussions. Website security supports our interest in providing a reliable service.

Where you ask us to take steps towards a contract with you personally, we may instead rely on those pre-contract steps. If a legal obligation requires a record to be kept or disclosed, we rely on that obligation for the relevant processing.

Providing enquiry details is voluntary, although we may be unable to respond or prepare a proposal without enough information.

Where information is handled

• Website enquiry form: Formspree, Inc. receives the contact details and message you submit, processes them for delivery and spam prevention, and emails them to our business inbox. Its free plan retains a submission archive for 30 days. We also retain the delivered email and relevant enquiry notes under the review policy below. Formspree processes technical information such as IP addresses and browser details to operate and protect its service.
• Email and calls: Microsoft 365 Email Essentials, obtained through GoDaddy, is used for business email. Microsoft Teams may be used for calls.
• Enquiry records: relevant details and dated notes are kept in a spreadsheet on the business computer, with local working copies and backups.
• AI assistance: OpenAI’s ChatGPT/Codex may be used to summarise relevant correspondence, prepare draft replies and call notes, and help maintain records. Information included in that work is processed by OpenAI. Stephen reviews the output and decides what to send; enquiries are not accepted, rejected or priced solely by automated processing.
• Website delivery: the website is provided through OpenAI Sites using Cloudflare infrastructure.

We use a personal ChatGPT Pro account with “Improve the model for everyone” turned off. This is a model-training opt-out, not a promise of zero storage or a business-workspace data-processing agreement. OpenAI still processes information to provide the service and for security and legal purposes, as explained in its privacy policy. We do not sell enquiry details.

International processing and provider terms

Our cloud providers may process information outside the UK, including in the United States. We do not promise that all information stays in the UK. Formspree states that it processes information in the United States and other countries where it operates. Its privacy policy explains its processing and international-transfer arrangements.

Microsoft’s published data protection terms provide for standard contractual clauses and the UK international data transfer addendum for relevant overseas transfers. GoDaddy’s terms also provide for recognised transfer mechanisms where required. You can read the Microsoft data protection terms and GoDaddy data processing terms.

Our website is hosted through an individual Pro account. OpenAI’s Sites data processing agreement governs covered hosted information and includes standard contractual clauses with the UK addendum. That agreement does not cover chat prompts or files used to create or edit the website.

Information submitted to our personal ChatGPT/Codex account is handled under OpenAI’s Europe privacy policy. OpenAI acts as a controller for the processing described there. The policy explains international processing and the use of adequacy decisions or contractual safeguards, including the UK addendum. Contact Stephen for information about the applicable safeguards or how to obtain a copy.

How long we keep enquiries

We review inactive enquiries every six months. We delete personal details when there is no ongoing discussion, agreed future opportunity or other documented reason to retain them.

When deciding whether a record is still needed, we consider the latest contact, agreed follow-up, any continuing relationship, and relevant legal or dispute requirements. Active client records are considered separately from unsuccessful enquiries. Our review covers copies in email, the tracker, working files and retained AI-assisted records. Service-provider backups and security or legal records may follow separate retention periods described in their terms; deleting an active record may not immediately remove every backup copy.

Your choices and rights

You can ask for access to your information or correction of inaccurate details. Depending on the circumstances, you may also ask for deletion, restriction or a portable copy, or object to processing based on legitimate interests. You can object to direct marketing at any time. If consent is used for a particular activity, you can withdraw it.

Email Stephen using the address above. We may need to confirm your identity before acting on a request. You can also complain to the Information Commissioner’s Office.

Website traffic measurement

We use Plausible Analytics to understand which pages are useful and whether visits lead to enquiries. It records page views, referral websites, browser and device types, approximate country, region and city, engagement, and named actions such as a confirmed enquiry or a click on an email or telephone link. A click does not confirm that an email or call took place. We do not send enquiry fields or chat text to analytics. Our setup removes page query strings and fragments and reduces referring URLs to their website origin.

Plausible processes IP addresses and browser information to derive approximate location and a daily visitor identifier; it says it does not store raw IP addresses or raw user-agent strings. It stores event and session records and presents aggregated reports. It does not use analytics cookies or recognise visitors across different days, websites or devices. Plausible states that visitor analytics data is processed and stored in the EU. See its data policy and data processing terms.

We use these statistics to improve our website and understand demand for our services. Reports are private to our account. You can exclude visits from this browser. Apply that choice separately on each browser or device; clearing browser storage removes it. We review the need to retain analytics records as part of our six-monthly information review.

Cookies and website technology

Our analytics does not set cookies or persistent visitor identifiers. If you choose to exclude your visits, we store a preference called plausible_ignore in this browser until you change it or clear browser storage. This preference is not a tracking identifier. We have not added advertising pixels, embedded maps or an online booking widget. The fonts and other page assets are served with the website. The enquiry form sends your details to Formspree when you submit it. The optional chatbot sends your conversation to OpenAI when you ask a question or request a summary. Formspree may require a spam-verification step before accepting a submission. Direct email links remain available and open your email application.

The hosting layer can use security technologies independently of the page code, including Cloudflare’s __cf_bm bot-protection cookie. These technologies help distinguish legitimate visitors from automated traffic and protect the service.

For information about those providers, see Cloudflare’s cookie information and OpenAI’s privacy notice.

Changes to this notice

We will update this page if the way we handle enquiries or operate the website changes. The date at the top shows the latest revision.