Privacy

Lockley tells sales teams which companies to call, and why. To do that we read public information about companies and, sometimes, about the people who run them. This page says what we hold, where it came from, why we are allowed to, how long we keep it, and how to make us stop. The controller is Maurice James LLC-FZ, trading as Lockley, a company registered in the United Arab Emirates (no. 2645368), of Meydan Grandstand, 6th Floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates. Questions and requests go to privacy@lockley.ai.

1If you use Lockley

When you run a scan we keep the website address you typed, what our reading of it produced, and the findings shown to you, for thirty days. If you pay, we keep:

• your email address and name, to sign you in (by emailed link — we never hold a password) and to send you your morning list;
• your company's website and what you tell us about who you sell to, because that is what the research runs from;
• what you do in the workspace — the companies you call, save, or pass on — because that is how the list gets better;
• your subscription and invoices. Card details go to Stripe and never reach us.

We use this to provide the service you pay for (performance of a contract). We keep it for the life of your workspace; when you close it, everything in it is deleted within thirty days. Billing records are kept for twenty-five months, as the law on disputes and accounts requires.

We email you about your own account and your own list. We do not sell your data and we do not run advertising.

2If Lockley has described your company to someone

Lockley holds a short description of most UK companies with a website, and of a growing number elsewhere. Every fact in it comes from a public source:

• the company's own website, read by our crawler, which announces itself, obeys robots.txt and the other opt-out signals, and is described at lockley.ai/bot;
• Companies House — the register, filings, officers and charges;
• public procurement notices (Contracts Finder and Find a Tender);
• the public DNS and web records that show which services a company uses.

The description is about the company — what it sells, to whom, how, and what has changed recently. Where a company's own website names the people who run it, or the register lists its officers, we may hold their name, role and a work email address or phone number that the company itself publishes. For some companies we also hold a work email address for a senior person from a licensed business-contact data provider, which we show to a customer only when they ask for it, and we record each time we do. We do not hold home addresses, personal email addresses or anything about anyone's private life.

Our lawful basis is legitimate interests: ours and our customers' in business-to-business selling, balanced against yours. We only hold what you or your company have already made public, we hold it about you in your role at work, we show it to a small number of paying customers rather than publishing it, and you can object at any time.

Public web pages we have read are kept for 180 days, then only the description survives. Contact details are kept for ninety days, then deleted and only looked up again if needed.

3If we have written to you

Where Lockley writes to a company on its own behalf, the message says who sent it and carries a link that stops any further message with one click, as the Privacy and Electronic Communications Regulations require. We write to corporate addresses about the recipient's work. We never buy lists and we never write from a customer's account.

4Your rights

You can ask what we hold about you, have it corrected, have it deleted, or object to our holding it at all. Write to privacy@lockley.ai and we will answer within a month, usually much sooner. If you object, we will stop, and we will note the objection so the same information is not picked up again. You can also complain to the Information Commissioner's Office at ico.org.uk.

5Cookies

Signed-in customers get one cookie, which is the sign-in itself. Nothing else is set until you say so. If you accept, we also set analytics cookies (PostHog and Google Analytics) and may record how the scan page is used, so we can see where visitors come from and where the page loses them. Declining changes nothing about the service.

6Who else touches the data

We run on other companies' infrastructure. Each of these processes data only on our instructions, under a written agreement, and most of it stays in London:

• Supabase (on AWS) — Database, authentication and sign-in emails. London (eu-west-2).
• Vercel — Hosts the website and the workspace. London edge; global network.
• Fly.io — Runs the research and the scan. London (lhr).
• Cloudflare R2 — Stores copies of public web pages we have read. EU.
• Stripe — Payments and subscriptions; we never see card numbers. EU / US.
• Postmark — Sends our emails to you. US.
• OpenAI — Reads public company pages and writes the summaries you see. US; no training on our data.
• Voyage — Turns company summaries into numbers so we can compare them. US.
• Upstash — Short-lived scan state (ten minutes). EU.
• PostHog — Product analytics and, with your consent, session replay. EU (Frankfurt).
• Google Analytics — With your consent only: counting visits and where they came from. EU and US (Google).
• Inngest — Schedules the nightly work. US (metadata only).
• Google Workspace — Our own email. EU / US.

We are established outside the UK and the EU. Because we offer the service to UK businesses and describe UK companies, the UK GDPR applies to what we do, and we hold ourselves to it. Where data leaves the UK it does so under the UK's International Data Transfer Agreement or an adequacy decision.

7Security

Data is encrypted in transit and at rest. Each customer's workspace is separated from every other at the database level. Contact details are encrypted with their own key. Access by our own staff is logged.

8Changes

When this page changes materially we tell customers by email first. The date at the top is the date of the last change.