Privacy policy

1. Who we are

Rabbit Rabbit is the trading name of Rabbit Rabbit Ltd, a company registered in England and Wales under company number 04524080, with its registered office at 46 Hullbridge Road, South Woodham Ferrers, Chelmsford, Essex CM3 5NG. The company is run by David Hayden. We are the data controller for the personal data described in this policy.

For any privacy question, or to use any of the rights in section 8, email david@rabbitrabbit.com or message us on WhatsApp on 07733 260092.

2. Which policy applies to you

3. What we collect

• Contact details you give us: your name, business name, email address and phone number.
• What you tell us about your business: for example your website, the area you cover and the services you offer when you ask for a free check, or your answers to one of our question pages.
• Correspondence: emails, WhatsApp messages and notes of calls.
• What you type into a demo that needs our server: a website address to check, or a question for an AI demo. See section 4.
• Technical data: your IP address, browser and device type and the pages you request, which our hosting provider records in its logs to run and protect the site. Some demos also keep a scrambled, one-way version of your IP address to apply their usage limits.

We don’t ask for special category data, such as health information, and ask you not to send it to us.

4. The demos and free tools

Most of the demos on this site use made-up businesses and sample data, and run entirely in your browser. Nothing you do in them is sent to us. A few need our server:

• Website checks, such as the speed check and the website report card. The address you enter is used to read that public homepage, and the speed check sends it to Google’s PageSpeed Insights service to time it. We don’t keep the address afterwards unless you choose to send us your results.
• AI demos and tools, such as the staff handbook demo. What you type is sent to an AI provider, through OpenRouter, to write the answer. We don’t store what you type, but please don’t enter personal or confidential information about anyone.
• Usage limits. To keep the free demos fair, some count how often they’re used from each connection. They store a scrambled, one-way version of your IP address and the time, never the address itself, and delete it after 30 days.
• Sending us your results. If you choose to send your results to us, or ask for them by email, we receive your details and the results so we can reply, and we treat them like any other enquiry.

Some question pages save your answers in your own browser so you can pick up where you left off. That stays on your device until you clear it.

5. Why we use it, and our lawful basis

Where we rely on legitimate interests, we have considered whether those interests are overridden by your rights, and concluded that they are not. You can object at any time, see section 8.

6. Marketing

We may contact you about our services by email, phone or WhatsApp where you have been in touch with us or are a client, and we always give you a way to opt out. You can tell us to stop at any time by replying or emailing david@rabbitrabbit.com. We don’t sell your data, and we don’t share it with anyone for their own marketing.

7. Who we share it with, and how long we keep it

• Service providers acting on our behalf: website hosting (Vercel), our database (Supabase), email, AI providers for the AI demos (OpenRouter and the AI models it connects to), Google for the speed check, and our accounting providers. They may only use your data to provide their service to us.
• Google Fonts: this site’s lettering is loaded from Google’s font service, so your browser connects to Google’s servers, which receive your IP address to send the fonts.
• WhatsApp: if you message us on WhatsApp, that conversation is also handled by WhatsApp under its own terms and privacy policy.
• Professional advisers: accountants, insurers and lawyers, where needed.
• Regulators and public authorities, where we are required or permitted to disclose.
• A buyer or successor, if our business or part of it is sold or reorganised.

Some of these providers are based in, or process data in, the United States or elsewhere outside the UK. Where they do, we rely on UK adequacy regulations, including the UK-US data bridge, or on the International Data Transfer Agreement or Addendum.

Enquiries that don’t go any further are kept for 24 months from your last contact and then deleted. Demo usage records are deleted after 30 days. Client records are kept for as long as we work together and then as our agreement with you says, and accounting records for 6 years from the end of the relevant financial year.

8. Your rights

You have the right to ask us for a copy of the personal data we hold about you, to have inaccurate data corrected, to have data erased where there is no good reason for us to keep it, to restrict or object to our processing (including objecting to direct marketing at any time), to receive certain data in a portable form, and to withdraw any consent you have given. We don’t make decisions about you by automated means alone.

To use any of these rights, email david@rabbitrabbit.com. We will respond within one month, and there is normally no charge.

If you’re unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner’s Office at ico.org.uk, on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

9. Keeping your data secure

We use access controls, encryption in transit, strong passwords and reputable service providers, and we limit access to those who need it. No transmission over the internet is completely secure, so we can’t guarantee the security of data sent to us over the internet. If a personal data breach happens that is likely to put your rights at risk, we will report it to the ICO within 72 hours and tell you where the law requires it.

10. Cookies

This website doesn’t use advertising or analytics cookies, and doesn’t track you across other websites, so there’s no cookie banner. The only cookie is a strictly necessary one set when the site owner logs in to the private admin area. Some pages save your progress in your own browser, as described in section 4, and you can clear it at any time in your browser settings.

11. Other websites

This site links to other websites, such as WhatsApp. We aren’t responsible for the content or privacy practices of any site we don’t control, and we encourage you to read their own privacy notices.

12. Changes to this policy

We may update this policy from time to time. The current version is always the one on this page, with its effective date shown at the top. Where a change is significant, we will tell clients directly. Our terms and conditions cover how you may use this website.