Privacy policy
How Mainspring collects, uses and protects personal information, and the choices you have about it.
1. Who we are
This policy explains how Mainspring Group, trading as Mainspring (“Mainspring”, “we”, “us”), collects and uses personal information. We are a company registered in England and Wales under company number 17254559, and we are the controller of the personal information described here.
Contact us about your data
Email: hello@mainspring-ai.com
Post: York House, York Road, Maidenhead, SL6 1SF, United Kingdom
This policy covers our website, enquiries you send us, our webinars and events, and our dealings with clients, prospective clients and suppliers. When we deliver a project and handle a client’s data on their instructions, we act as their processor under our contract with them, and the client’s own privacy notice applies to that data.
2. What we collect
Information you give us
- Enquiries. When you use our contact form or email us: your name, job title, company, email address, your message and anything else you choose to include. Contact form submissions are stored in HubSpot, our customer relationship management (CRM) system.
- Conversations. Notes of calls and meetings, such as an opportunity review, and the correspondence around them.
- Webinars. When you register for a webinar through Crowdcast, our webinar platform: your name, email address and any other details the registration form asks for, any questions or chat messages you post during the session, and attendance information Crowdcast provides, such as whether and for how long you joined.
- Clients and suppliers. Business contact details for people we work with, and records of our dealings with them, including contracts and invoices.
Information collected when you visit the website
- Server logs. Like most websites, ours is hosted by a provider that records standard technical information: your IP address, browser type, the pages requested and the date and time.
- Fonts. Our pages use Google Fonts. To display them, your browser connects to Google’s servers, which receive your IP address.
- Analytics and tracking, if you agree. With your consent, Google Analytics and HubSpot use cookies to record how you use the site: the pages you visit, how you arrived, how long you stay, your device and browser, and your approximate location based on your IP address. If you later fill in our contact form, HubSpot can link your previous and future visits to your enquiry, so we understand what you are interested in. See Cookies for details.
We don’t ask for special category information, such as health data, and we ask that you don’t send it to us.
3. How we use it
UK data protection law requires us to have a lawful basis for each use of your information. These are ours:
| What we use it for | Lawful basis |
|---|---|
| Replying to your enquiry and arranging an opportunity review | Legitimate interests in responding to people who contact us, and taking steps at your request before entering a contract |
| Running webinars: registering you, sending joining details and reminders, sharing the resources we offered, and following up about the session | Legitimate interests in running events people have signed up for |
| Delivering our services and managing client and supplier relationships | Performance of a contract, and legitimate interests in running our business |
| Recording enquiries and our contact with you in our CRM (HubSpot) | Legitimate interests in keeping an accurate record of our business relationships |
| Understanding how the website is used, and linking visits to an enquiry, using Google Analytics and HubSpot cookies | Consent, which you can withdraw at any time |
| Keeping the website secure and working properly | Legitimate interests in operating a secure website |
| Keeping financial records and meeting other legal obligations | Legal obligation |
We don’t add people who send an enquiry to a mailing list, and we don’t sell personal information. If we send you anything beyond a reply or a webinar follow-up, every message will include a simple way to opt out.
4. Who we share it with
We share personal information only where we need to, and only with:
- Service providers who process it on our behalf, under contracts that require them to protect it. These include HubSpot (CRM, forms and website analytics), Google (Google Analytics and website fonts), Crowdcast (webinar registration and hosting), Microsoft (email and documents) and our website hosting provider.
- Professional advisers, such as accountants, lawyers and insurers, where they need it to advise us.
- Authorities and regulators, where the law requires it.
- A buyer or successor, if all or part of our business is sold or restructured, under equivalent protections.
5. International transfers
Some of our service providers process information outside the UK, for example in the European Economic Area or the United States. Where they do, we make sure the transfer is protected: either the destination is covered by UK adequacy regulations (including the UK–US data bridge for certified US organisations), or the transfer is covered by the ICO’s International Data Transfer Agreement or Addendum.
6. How long we keep it
We keep personal information only for as long as we need it:
| Information | How long we keep it |
|---|---|
| Enquiries that don’t lead to work | Up to 2 years from our last contact |
| Webinar registrations | Up to 12 months after the event |
| Client and supplier records | For the relationship, then 6 years to meet legal, tax and accounting requirements |
| Google Analytics data | 14 months, after which Google deletes it automatically |
| Website activity recorded by HubSpot | Kept with the related contact record, and deleted with it |
| Website server logs | For the short period set by our hosting provider, and no longer than 12 months |
After that, we delete it or anonymise it.
7. Keeping it secure
We use appropriate technical and organisational measures to protect personal information, including access controls, multi-factor authentication on business accounts and encrypted connections. Only people who need the information to do their job can see it. No system is completely secure, so if you think your information has been put at risk, please tell us straight away.
8. Your rights
You have the right to:
- ask for a copy of the personal information we hold about you;
- ask us to correct information that is wrong or incomplete;
- ask us to delete your information;
- ask us to restrict how we use it;
- object to us using it, including for any marketing, where we rely on legitimate interests;
- ask us to transfer information you gave us to another organisation, where that applies;
- withdraw consent at any time, where we rely on consent.
To use any of these rights, email hello@mainspring-ai.com. There is normally no charge. We will respond within one month, or tell you within that month if a complex request needs up to two months more. We may need to confirm your identity first.
9. Cookies
Cookies are small files stored in your browser. We use two kinds:
- Strictly necessary cookies make the site work and remember your cookie choices. They don’t need your consent.
- Analytics cookies from Google Analytics and HubSpot help us understand how the site is used. We only set them if you agree through our cookie banner.
We don’t use advertising cookies, and we don’t use these cookies to show you adverts on other websites.
| Cookie | Provider and purpose | Expires |
|---|---|---|
| Strictly necessary | ||
| __hs_cookie_cat_pref | HubSpot. Records which types of cookie you have accepted | 6 months |
| __hs_opt_out | HubSpot. Remembers that you declined cookies, so we don’t ask again | 6 months |
| __hs_do_not_track | HubSpot. Stops the tracking code sending information to HubSpot | 6 months |
| __cf_bm | HubSpot (via Cloudflare). Protects against bots | 30 minutes |
| Analytics (only with your consent) | ||
| _ga | Google Analytics. Distinguishes one visitor from another | 2 years |
| _ga_<ID> | Google Analytics. Keeps track of your session | 2 years |
| __hstc | HubSpot. Main visitor tracking cookie: first, last and current visit times and session count | 6 months |
| hubspotutk | HubSpot. Recognises a returning visitor, and links visits to a form submission | 6 months |
| __hssc | HubSpot. Tracks the current session | 30 minutes |
| __hssrc | HubSpot. Detects when you restart your browser | End of session |
Changing your mind. You can accept or decline analytics cookies when you first visit, and change your choice at any time using the cookie settings on our site. You can also block or delete cookies in your browser settings, or install Google’s Google Analytics opt-out browser add-on. Declining analytics cookies won’t stop the site working.
10. AI and automated decisions
We don’t make decisions about you based solely on automated processing that have legal or similarly significant effects. We don’t use the personal information you send us through this website to train AI models.
11. Complaints
If you’re unhappy with how we’ve handled your information, please contact us first at hello@mainspring-ai.com. We will acknowledge your complaint within 30 days and respond in full without undue delay.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
12. Changes to this policy
We may update this policy from time to time. The date at the top of the page shows when it last changed. Our website and services are aimed at businesses and are not intended for children.