Privacy Policy

For the personal information described in this policy, DARKSTONE LABS LIMITED acts as the controller unless a product-specific notice or customer agreement states otherwise.

Our registered office is 167-169 Great Portland Street, 5th Floor, London, W1W 5PF, United Kingdom. Privacy enquiries may be sent to info@darkstonelabs.ai.

We collect only the information needed to operate this website, respond to enquiries, manage authorised CMS access and evaluate potential commercial or investment conversations.

• Contact and identity details such as name, work email, organisation and role.
• Information supplied through Build With Us and investor forms, or sent to us by email, including project goals, support needs, timescales and messages.
• Technical information needed for security and reliable delivery, such as IP address, browser details, request timestamps and authentication events.
• Account identifiers and session data when an authorised administrator signs in through our authentication provider.
• Correspondence and records of actions taken in response to an enquiry.

Under UK GDPR, we process personal information only where a lawful basis applies.

• Legitimate interests: securing and improving the website, preventing misuse, keeping operational records and responding to relevant business enquiries.
• Steps before a contract or performance of a contract: assessing, preparing and delivering requested development, research, deployment or advisory work.
• Consent: where we specifically ask for it, including optional website analytics and enquiry submissions.
• Legal obligation: complying with applicable law, regulatory requests, accounting duties and the establishment or defence of legal claims.

We do not state that public website enquiries are used to train general-purpose AI models. We will not use confidential project details for model training without an appropriate written basis and clear notice.

Where AI-assisted tools support internal analysis, human review, access controls and purpose limitation should be applied. Product-specific processing will be described in the relevant product notice or customer agreement before launch.

DARKSTONE LABS LIMITED is the controller for this optional business-search feature. We send the business name, town/country and required website hostname to Anthropic's commercial API to research publicly indexed sources. Anthropic processes the submitted information on our behalf under its API and data-processing terms, using its search providers; processing may involve international transfers as described below. Do not submit confidential, sensitive or unrelated personal information.

A public business website is required. Before research we normalise the address, resolve its public network address and check HTTP response headers with strict time and redirect limits. We do not crawl or store the website's page content through this check, send your IP address to the business website, or verify domain ownership. The website operator may see our server's connection in its ordinary access logs.

Public business information can still be personal data, particularly for sole traders or where search results mention individuals. Where personal data is involved, our basis is legitimate interests: providing the business report you request and preventing abuse. We minimise inputs and do not return individual reviewer names or contact details. A provisional business index is calculated only when source-supported core measures meet the published eligibility rules; it is not a score of an individual or an independently audited live platform dataset. Reports include source links, methodology and accuracy limitations. PDF export is generated in your browser, not uploaded to a separate PDF service. You may object to this processing or raise a correction request using the privacy contact above.

Reports are limited search evidence, not complete Google or Trustpilot review datasets. Results stay in request/browser memory rather than a stored report. We keep aggregate usage and secret-keyed connection counters for cost and abuse controls, not raw IP addresses in those counters or research content in usage logs. Anthropic's own retention and transfer practices are governed by its commercial terms and privacy information.

Requesting a Reputation Check starts this research; there is no separate search-consent checkbox. A check or Early Access enquiry does not subscribe you to marketing. Any optional marketing would need a separate opt-in. If you later request managed support, the existing enquiry form collects only the details you choose to submit and its separate contact permission.

We may use carefully selected service providers for hosting, databases, authentication, communications, security and professional advice. They may process information only for agreed purposes and under appropriate contractual controls.

If information is transferred outside the United Kingdom, we will use a lawful transfer mechanism such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, or another permitted safeguard.

We do not sell personal information. We may disclose information where required by law, to protect rights or systems, or as part of a genuine corporate transaction subject to appropriate confidentiality.

If you choose Accept analytics in the website cookie settings, we load Google Analytics 4 on public pages to understand how those pages and selected outbound links are used. We configure manual page views and send only the public pathname, page title, allowlisted outbound destination category, and a success-only form category. We do not send names, email addresses, messages, form fields, or URL query strings and fragments to Analytics.

Google Analytics may process cookie identifiers, device and browser information, approximate technical information and interactions with the website. The service is provided by Google Ireland Limited and may involve other Google group entities. Google may process information outside the United Kingdom; any transfer is subject to the mechanisms and terms Google makes available, which may include adequacy decisions or standard contractual safeguards. We do not promise that information remains in the UK or European Economic Area.

Withdrawing analytics consent stops further Analytics events from this website and asks the browser to delete Google Analytics cookies that this page can access. Withdrawal does not erase information already received by Google; Google’s own privacy information explains its retention and deletion processes.

• Analytics consent is optional and is not required to browse the public website or submit an enquiry.
• A consent preference cookie remembers your choice for up to 180 days. You can change it through Cookie settings in the footer or on the Cookie Policy page.

We retain enquiry records only for as long as reasonably needed to respond, evaluate a relationship, meet legal obligations and maintain proportionate business records. Unsuccessful early-stage enquiries are ordinarily reviewed for deletion or anonymisation after 24 months unless continued retention is justified.

We use proportionate technical and organisational measures, including controlled access, encrypted transport, managed authentication, audit records and data minimisation. No online system can be guaranteed completely secure.

Depending on the circumstances, you may ask us to exercise the following rights. We may need to verify identity and may lawfully refuse or limit a request in some cases.

• Access, correction and deletion of personal information.
• Restriction of processing and objection to processing based on legitimate interests.
• Data portability where processing is automated and based on consent or contract.
• Withdrawal of consent without affecting earlier lawful processing.
• A complaint to the UK Information Commissioner’s Office at ico.org.uk, although we welcome the opportunity to address concerns first.