Privacy policy

Last updated: August 2026

1. Who we are

UltraLabs Ltd. is the data controller for the personal data described here. We are registered in England and Wales, company number 15347842, at the address in section 9.

2. What this site collects

Nothing optional loads before you allow it. On a first visit CookieYes, our consent management platform, asks you once, and refusing is offered as plainly as accepting. The cookie notice lists every item of storage, its purpose and its lifetime; you can change your choice at any time through Cookie settings in the footer, which reopens the same CookieYes panel.

• Your consent choice: CookieYes records what you decided, an identifier it generates for that record, the domain you decided it on, and your IP address, which it uses to work out which rules apply where you are. That record is what lets us prove we asked before anything optional loaded.
• Analytics, only with your consent: where a deployment of this site is configured for it, we load Google Analytics 4 after you allow the Analytics category, and never before. It runs with Google Consent Mode: advertising storage, ad user data and ad personalisation stay denied at all times. We run no advertising or remarketing tags, and we send only bounded, non-identifying events such as which enquiry route was selected and whether a brief was accepted. No name, email address, message text or query string is ever sent.
• Enquiry details: the name, email address, company, website address, project type, budget range, any estimator context and the message you type into the enquiry form. Only what you enter is sent.
• Server logs: our hosting provider records ordinary request data, including IP address, user agent and the page requested, for security and to keep the service running.
• Client reviews: the review wall is embedded from Testimonial.to and loads with the page. Your browser requests it from their service as the wall comes into view, and anything their frame stores is subject to their own privacy notice. The Functional category in the cookie panel currently governs nothing here, because the wall is ordinary page content rather than optional extra content.

The migration estimator runs entirely in your browser. Nothing you select is sent anywhere unless you choose to carry it into the enquiry form, where it appears as an ordinary editable field you can change or clear.

3. Lawful basis

• Legitimate interests for reading and replying to an enquiry, and for keeping the site secure and available. Answering a business enquiry is what you contacted us to have happen, and it does not override your interests or rights.
• Contract where an enquiry becomes a project and we need your details to deliver and invoice it.
• Legal obligation for records we are required to keep, such as accounting records.

We do not add enquirers to a marketing list. Sending a brief is not consent to marketing, and no box on this site is pre-ticked to imply otherwise. If we ever run a mailing list, joining it would be a separate, explicit action.

4. Who processes it

• CookieYes presents the cookie notice and records your consent choice.
• Web3Forms receives the enquiry form submission and delivers it to us by email.
• Vercel hosts and serves this site, and processes request data in its server logs.
• Our email provider holds the enquiry once it reaches our inbox, as it would any email.
• Google processes analytics data, but only where you have allowed the Analytics category.
• Testimonial.to serves the review wall embedded on this site, under its own privacy notice.

We do not sell or trade personal data, and we do not share it with anyone else except where the law requires it.

5. International transfers

Some of these providers operate infrastructure outside the United Kingdom. Where personal data is processed outside the UK, the transfer relies on the safeguards set out in that provider's terms, such as standard contractual clauses or an adequacy decision. If you would like to know where a specific piece of data sits, ask and we will tell you what we know.

6. How long we keep it

Enquiries are kept while we are in contact and for as long as the conversation could reasonably continue. If the enquiry does not become a project, we do not keep it indefinitely. Where an enquiry becomes a project, the related records are kept for the length of the relationship and for as long afterwards as our legal and accounting obligations require. You can ask us to delete an enquiry at any point and we will, unless we are required to keep it.

7. Security

The site is served over HTTPS with a restrictive content security policy. Enquiries are transmitted over an encrypted connection. Access to enquiry data is limited to the people who need it to reply to you. No system is perfectly secure, and we will not claim otherwise.

8. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Have inaccurate personal data corrected
• Request erasure of your personal data
• Object to processing carried out on the basis of legitimate interests
• Request that processing is restricted
• Receive your data in a portable form

To exercise any of these, write to us at the address below. We will respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk, though we would rather you raised it with us first so we can put it right.

9. Contact us

If you have any questions about this policy, please contact us at:

You can also send a question through the contact page.