Privacy policy
Last updated 17 September 2026
01Who we are
Solidbase is a European AI strategy and transformation consultancy. This policy covers this website only — solidbaseai.com. Work we do under a signed engagement is governed by that engagement’s own terms, and where we handle personal data on a client’s behalf we act as their processor, not as the controller described here.
For everything on this website, the data controller is Cloud Officer Limited, registered at 1 Parkshot, Richmond, Surrey, TW9 2RD under company number 09948742. You can reach us about anything in this policy at hello@solidbaseai.com.
02The short version
If you read nothing else:
- We collect what you type into one of our three forms, and nothing else about you.
- We never ask for or store your IP address. Our code does not read one, anywhere.
- We set two cookies, and only after you have submitted the download form. Nothing is set just because you visited.
- Our analytics product sets no cookies and cannot identify you. There are no third-party cookies on this site at all.
- We do not sell your data, share it with advertisers, or run it through any ad network. Two suppliers touch it: the company that hosts the site and the company that runs the database.
- No automated decision-making, no profiling, no scoring.
The rest of this page is the detail behind those claims. If you would rather just ask, email us.
03What we collect, and when
We collect personal data at four points, all of them a form you chose to fill in. There is no other collection: no tracking pixels, no fingerprinting, no data bought from anyone else.
When you use the contact form
| What we collect | Notes |
|---|---|
| Name | Required. |
| Required, so we can reply. | |
| Company | Optional. |
| Role | Optional. |
| Message | Required. Please do not put anything sensitive in it — see the note below. |
| Browser string | Your browser’s user-agent, stored with the message. We keep it to tell real enquiries from automated ones. |
When you ask about a service
At the foot of each service page there is a form asking for the full description of that engagement.
| What we collect | Notes |
|---|---|
| Name | Required. |
| Required, so we can send you the description. | |
| Company | Required. |
| Role | Required. |
| Phone | Optional. The form works without it. |
| Which service | We record which engagement you asked about. It is the point of the form. |
| Browser string | Stored with your request, for the same anti-automation reason. |
These reach the same place as the contact form, and we treat them the same way: a person reads them and a person replies. Nothing about the follow-up is automated, and asking for the description does not sign you up to anything.
When you subscribe to the quarterly email
| What we collect | Notes |
|---|---|
| Required. It is the only thing the form asks for. | |
| Which page | We record whether you subscribed from the AI Resource Library or the AI Template Library, so we know which one people find worth following. |
| Browser string | Stored once, for the same anti-automation reason. |
When you download a template
| What we collect | Notes |
|---|---|
| Name | Required. |
| Required. | |
| Company | Required. |
| Role | Required. |
| Phone | Optional. The form works without it. |
| Browser string | Stored with your record. |
| Download records | Each time a template is downloaded we record which one, in which format, when, and — if you have the cookie described below — which person it was. This means repeat downloads are individually timestamped against you, not just counted. |
We are direct about why that form asks for more than the others: it is a lead-capture step. The templates are free and MIT licensed, and the form is not a lock on them — it is how we know who is using them so we can follow up. The form says so at the point of asking.
When you simply read the site
We use Vercel Web Analytics, which sets no cookies and writes nothing to your browser’s storage. It identifies a visit by a hash derived from the request, which is discarded after 24 hours, so it cannot follow you across sites or across days. Per Vercel’s documentation, each page view may record:
- the page address and the referring page
- filtered query parameters — on our library pages these are the filters you picked, such as the section or audience
- approximate location, to city level, derived from the request
- your operating system, browser and device type
We do not receive an identifier that lets us pick you out of that data, and we have not configured any custom events. The search box on the resource library never leaves your browser — what you type there is not transmitted to us or to anyone else.
Fonts are served from our own domain, compiled in when the site is built. Your browser makes no request to Google, or to any other third party, when a page loads.
04Why we collect it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Enquiries, including service enquiries | Legitimate interests — replying to someone who has contacted us about our services. Where the exchange is heading towards an engagement, the basis is also steps taken at your request before entering a contract. |
| The quarterly email | Consent, given by submitting the form. You can withdraw it at any time and we will stop, with no argument and no retention offer. |
| Template downloads | Legitimate interests — offering business documents to people at organisations that might want our help, and following up on it. We have weighed this against your interests: it is business-to-business, the form tells you we will be in touch before you fill it in, and you can opt out in one message. If that balance does not sit right with you, object and we will remove you. |
| Download records | Legitimate interests — knowing which documents are actually used, so we know which to keep current and what to write next. |
| Analytics | Legitimate interests — understanding in aggregate which pages are read, using a product chosen because it cannot identify individuals. |
| Anti-automation | Legitimate interests — keeping bots out of our forms and our database. |
Where we rely on legitimate interests you have the right to object, and where we rely on consent you can withdraw it. Both are one email: hello@solidbaseai.com.
05Cookies
Two, both set only at the moment you submit the template download form. Neither is set by visiting, reading, or subscribing.
| Cookie | What it does |
|---|---|
| sb_lead | The identifier of your record in our template-lead table. Marked http-only, so no script on the page can read it. Sent same-site, and over HTTPS only. Expires after 90 days. |
| sb_lead_name | Your first name, and nothing else. Readable by the page, purely so it can greet you instead of asking for your details again. We trust it for nothing. Expires after 90 days. |
They exist to save you retyping details you have already given us in order to receive a file you asked for. That is the whole job, and we keep them confined to it: they are not read for analytics, they carry no advertising identifier, and they go nowhere near a third party.
You can clear them at any time in your browser settings. The download panel also has an “Enter different details” control, which clears the readable one and shows the form again.
06Who else touches your data
Two suppliers, both acting on our instructions under a data processing agreement. Nobody else. We do not sell personal data, we do not share it with advertisers or data brokers, and we do not run any advertising or remarketing technology on this site.
| Supplier | What they do |
|---|---|
| Supabase | Our database and file storage. Everything you submit through a form is stored here. See their privacy policy(opens in a new tab). |
| Vercel | Hosting and web analytics. Their platform logs will record request metadata, including IP addresses, as any web host’s do — that is at the infrastructure layer and is not something our application reads or stores. See their privacy policy(opens in a new tab). |
We will also disclose personal data where the law requires it, and to our professional advisers where necessary — for example if a dispute arose. If Solidbase were ever acquired, personal data would transfer with the business, and we would tell you before anything changed about how it is handled.
07Where your data is held
Our database and the template files are hosted in the European Union. The site itself is served from European infrastructure.
Both our suppliers are companies headquartered outside the European Economic Area, so their support and engineering staff may in principle access data from outside it. Where that happens it is covered by the safeguards in our agreements with them, which is the standard route for this — Standard Contractual Clauses, or an adequacy decision where one applies.
08How we protect it
- Your browser never talks to our database. Every read and write goes through our own server, using a key that is never sent to the browser and never exposed in client-side code.
- Every table has row-level security enabled with no access policies at all, so no anonymous or logged-in role can read or write any of it. Only our server-side key gets through.
- Template files live in a private storage bucket and are streamed through our own domain. No shareable direct link to the underlying file is ever handed out.
- The site is served over HTTPS only, with HSTS.
No arrangement is perfect. If we ever suffer a breach affecting your personal data, we will notify the supervisory authority within 72 hours where the rules require it, and we will tell you directly where the risk to you is high.
09How long we keep it
| Data | How long we keep it |
|---|---|
| Enquiries, including service enquiries | 24 months from our last exchange with you. |
| Subscribers | Until you opt out. We then keep a minimal record that you opted out, so we do not add you again by accident. |
| Template leads | 24 months from your most recent download. |
| Download records | 24 months. |
| Analytics | Aggregated, and never tied to you. Retention is our analytics provider’s. |
We will keep something longer where we have to — for example if it is relevant to a legal claim — and we will delete it sooner if you ask and we have no overriding reason to keep it.
10Your rights
Under the GDPR you have the right to:
- get a copy of the personal data we hold about you
- have it corrected if it is wrong
- have it deleted
- restrict what we do with it while a question about it is resolved
- object to processing we base on legitimate interests, including the template follow-up
- receive it in a portable, machine-readable form
- withdraw consent, where consent is what we relied on
To use any of them, email hello@solidbaseai.com. We will respond within one month. There is no form to fill in and no charge, and we will not ask you why.
11Complaints
If you think we have handled your personal data badly, please tell us first — hello@solidbaseai.com — and we will try to put it right.
You also have the right to complain to a data protection authority without coming to us at all. Ours is the Information Commissioner's Office. You may instead complain to the authority in the EU or EEA country where you live or work; the European Data Protection Board(opens in a new tab) lists them all.
12No automated decision-making
We make no decisions about you by automated means, and we do not profile you. Nothing on this website scores you, ranks you, segments you by inferred characteristics, or decides anything that affects you without a person involved.
We think a firm that advises on AI governance should be specific about this rather than silent, and should be able to say plainly where it does not use the technology it sells advice about. On this website, we do not.
13Changes to this policy
When we change what we collect or what we do with it, we update this page and change the date at the top. If a change is significant and we hold your email address, we will tell you rather than rely on you noticing.
14How to contact us
Email hello@solidbaseai.com for anything in this policy — a question, a request about your data, or a complaint. Our terms of service are here.
