Privacy notice
Last updated: 18 May 2026
Summary
ICOSE Ltd ("ICOSE", "we") runs icose.ai. This notice explains what personal data we collect when you use the site, why we use it, who we share it with, how long we keep it, and your rights under the UK GDPR. If you only want the short version: cookies that are strictly necessary to run the site are always on; analytics and marketing cookies are off until you opt in; chats stay on your device until you choose to send us your details, at which point the conversation is emailed to our team so a person can follow up.
Who we are
ICOSE Ltd is the data controller. Registered office: Initial Business Centre, Wilson Business Park, Manchester M40 8WN, United Kingdom. Contact: privacy@icose.ai or contact@icose.ai.
What we collect
Chat with our AI guide
Your messages and the AI's replies are stored locally in your browser (in localStorage) so the conversation is still there if you refresh the page. They are not sent to us unless you ask for a call, send an enquiry, or otherwise submit the form below the chat. When you do, the whole transcript is emailed to the ICOSE team so a person can pick up where the AI left off.
Enquiry / lead capture form
When you book a call or ask us to follow up, we collect your first name, work email, company, optional role, company size, and a short description of the problem.
Technical data
We receive basic technical information your browser sends with each request — IP address, user-agent string, referring URL, and broad geographic region. This is processed by our hosting and edge providers to deliver the site and to detect abuse.
Cookies and similar technologies
See "Cookies and tracking" below. We do not set any non-essential cookies until you have given consent.
Why we use your data, and on what legal basis
- To run the site and respond to your enquiry — legitimate interests (UK GDPR Art. 6(1)(f)) and, where you submit an enquiry, taking steps at your request before entering into a contract (Art. 6(1)(b)).
- To send marketing emails about ICOSE's services to business contacts — legitimate interests, with a clear unsubscribe link in every message. We do not send marketing emails to consumers without consent.
- To measure how the site is used and to measure advertising via Google Analytics and Google Ads — consent (Art. 6(1)(a)). These are only set if you have opted in via the cookie banner.
- To comply with our legal obligations (for example, tax and accounting records) — legal obligation (Art. 6(1)(c)).
Who we share data with (sub-processors)
We share data with the providers below only as far as needed to deliver the service.
| Provider | Purpose | Location |
|---|---|---|
| Anthropic, PBC | Powers the AI guide. Messages you send to the chat are forwarded to Anthropic's API to generate replies. Anthropic does not use API inputs or outputs to train its models. | United States |
| Google LLC | Google Analytics 4 (site usage measurement) and Google Ads (advertising measurement and remarketing). Loaded only with your consent. | United States / EU |
| Twilio Inc. (SendGrid) | Sends transactional emails (your enquiry to our team, booking confirmations) and our marketing emails to business contacts. Open and click measurement applies to marketing emails where you have not opted out. | United States |
| Vercel Inc. | Hosts the website and processes incoming requests at the edge. | United States / EU |
Each provider acts as a processor under our instructions and only for the purposes set out above. We do not sell personal data.
International transfers
Some of the providers above are based in, or transfer data to, the United States. Where this is the case, the transfer is covered by the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or by the UK extension to the EU–US Data Privacy Framework where the provider is self-certified.
How long we keep data
- Chat transcripts on your device — until you clear them. They are kept in your browser and never leave your device unless you submit the lead form.
- Submitted enquiries and transcripts emailed to us — up to 24 months from last contact, then deleted unless we have an active client relationship.
- Analytics data — Google Analytics is configured with a retention window of 14 months.
- Email marketing records — until you unsubscribe, plus a short suppression-list record so we do not contact you again.
- Accounting records — at least six years from the end of the relevant financial year, as required by UK law.
Cookies and tracking
We use three categories of cookies and similar storage. You can change your choice at any time — use the "Cookie settings" link in the footer or the button below.
Strictly necessary
Always onRequired to run the site, keep your chat on your device, secure form submissions, and protect the admin area. These cannot be turned off.
Analytics
Off until you opt inGoogle Analytics 4. Helps us understand which pages and questions are useful so we can improve the site. IP addresses are truncated.
Marketing
Off until you opt inGoogle Ads conversion tracking and remarketing, and Twilio / SendGrid email engagement measurement. Used to measure whether our advertising and outreach reach the right audiences.
Your rights
Under the UK GDPR you have the right to:
- Ask for a copy of the personal data we hold about you.
- Have inaccurate data corrected.
- Ask us to delete data (subject to legal retention rules).
- Object to or restrict processing based on legitimate interests or for direct marketing.
- Receive data in a portable format.
- Withdraw any consent you have given, at any time.
To exercise any of these rights email privacy@icose.ai. We aim to respond within 30 days.
If you are unhappy with how we have handled your data you can complain to the UK Information Commissioner's Office at ico.org.uk.
Changes to this notice
If we materially change how we use personal data we will update this page and, where appropriate, let you know directly.