Privacy Notice
Version 2.6, effective 8 September 2026. This notice explains what personal data adhouse collects, why, on what legal basis, how long it is kept, who can see it, and the rights you have. It is written to meet Articles 13 and 14 of the UK GDPR in plain English.
1. Who is responsible
adhouse is the trading name of James Harrop, a sole trader established in England and Wales. Address for service: 100 Munster Road, London SW6 5RD. Email: hello@adhouse.ai.
For website visitors, enquiries, prospects and clients' own contact details, James Harrop is the data controller. For personal data held inside a client's advertising, analytics and website accounts, the client is the controller and James Harrop acts as processor on the client's documented instructions (section 6 and the Data Processing Terms in the Terms of Business).
2. The data this notice covers
| Who | What is collected | How |
|---|---|---|
| Website visitors | Pages viewed, device and browser type, approximate location derived from IP, referring page and interactions with site controls. After optional-cookie acceptance, Apollo may identify the visiting company; this does not identify a named visitor. | Google Analytics loads with analytics storage denied by default and may send cookieless measurement signals. Optional tools load after acceptance as described in section 10. The site also records button interactions in its own database, and the hosting provider keeps server logs. |
| People who use the enquiry form | Website address, name, mobile number or email address, what help you are interested in and, if supplied, a short message, advertising platform and monthly spend band; landing page, referrer or campaign source, selected entry button, time on page, device and browser, a daily one-way hash of your IP address, and the time you acknowledged this notice. | Typed by you into the form at adhouse.ai. |
| Prospects contacted first by adhouse | Business name, trading address, named owner or director, work telephone number and email address, publicly visible advertising activity, Companies House records, the result of a telephone preference check, and, if adhouse writes to you, a record of whether the email was opened and which link in it was clicked, and whether the private summary page it links to was opened. | Collected from the business's own website and the code that website serves publicly, the Meta Ad Library, Companies House and LinkedIn. See section 4. |
| People who ask for the monthly note | Email address, the time you asked and the time you confirmed, a one-way hash of your IP address. | Typed by you into the box in the website footer, then confirmed by clicking the link in the email we send (double opt-in). |
| Clients | Contact details of the people we deal with, correspondence, call notes and meeting summaries, contracts, invoices and payment records, the work produced. | Provided by you, or created in the course of the work. |
| Data inside client accounts | Whatever the client's advertising, analytics and website platforms hold, which may include the client's own customers' personal data. | Seen only inside the client's own accounts, under the client's user permissions. See section 6. |
3. Why it is used, and the legal basis
| Purpose | Legal basis (UK GDPR Article 6) |
|---|---|
| Replying to an enquiry you sent and arranging a call. | Legitimate interests (6(1)(f)): responding to a request you made. The tick box on the form records that you have seen this notice; it is not the legal basis. |
| Contacting a business that advertises, to tell it about a service for advertisers. | Legitimate interests (6(1)(f)), limited to business contact details and limited companies or LLPs for email. Sole traders and partnerships are contacted by telephone only, after a check against the Telephone Preference Service, in line with the Privacy and Electronic Communications Regulations. |
| Delivering the Review, Implementation or Management service, invoicing, and keeping in touch during the work. | Performance of a contract (6(1)(b)). |
| Keeping accounting records. | Legal obligation (6(1)(c)): HMRC record-keeping rules. |
| Sending the monthly note. | Consent (6(1)(a)), given by confirming the email we send and withdrawn by the unsubscribe link in every note. |
| Optional cookie-based measurement of website visits and page use. | Consent (6(1)(a)), given and withdrawn through the cookie notice. |
| Preventing abuse of the enquiry form and defending legal claims. | Legitimate interests (6(1)(f)). |
No decisions about you are made by automated means alone, and no profiling with legal or similarly significant effects takes place.
4. Prospects contacted first
adhouse finds potential clients by looking at businesses that are visibly advertising on Google or Meta. The information used is already public: the business's own website, the Meta Ad Library, Companies House, and occasionally LinkedIn. adhouse does not buy lists and does not use data brokers.
Looking at a business's advertising also means reading what its website serves publicly to any visitor: the pages its adverts link to, and the tracking and tag-manager code those pages load. Only ordinary public requests are used. adhouse never signs in to anyone's advertising, analytics or website accounts, and never asks anyone else to do so on its behalf.
Before any business is telephoned, its number is screened against the Telephone Preference Service and Corporate Telephone Preference Service registers. That screening is carried out by the provider named in section 9, which receives the telephone number and the business name for that purpose only.
adhouse records visits and clicks on the personalised pages linked from its emails to understand whether the material was used. Automated security checks can also open links, so these signals are not proof of readership. Replies are used to handle your enquiry, update the contact record and prevent unwanted follow-ups. James is responsible for answering them.
Where adhouse has written up what it found, that summary may be put on a private web page and the link sent to one named person. Those pages are not listed on any search engine, they stop working on a set date, and some are password protected. They set no cookie and store nothing on your device. The server does record that the page was opened, keeping a one-way hashed version of the IP address, the browser's user-agent string, the referring address if there is one, roughly how long the page was open, how far down it was read, and which sections were opened. That record exists so adhouse knows whether the work it sent was of any use, and it is covered by legitimate interests. Ask, and it is deleted.
If adhouse contacts you this way, this notice is your Article 14 information. Reply "stop", or email hello@adhouse.ai, and your details are deleted within seven days. If we never speak, your details are deleted six months after they were collected.
5. How long data is kept
| Data | Kept for |
|---|---|
| Enquiry form submissions that do not lead to work | 6 months from submission, then deleted. |
| Prospect details where no conversation takes place | 6 months from collection, then deleted. |
| Telephone preference screening results | Kept with the business's record as proof the check was made, and re-checked at least every 28 days. |
| Record that a private summary page was opened (hashed IP, user-agent, referrer, seconds) | Deleted with the rest of that business's details, or sooner on request. |
| Monthly note subscribers | Until you unsubscribe; unconfirmed sign-ups are deleted after 30 days. |
| Record that you objected or asked to be deleted | Your name or email only, kept so you are not contacted again. |
| Client correspondence, notes and the work produced | 12 months after the engagement ends, then deleted, unless you ask for it sooner. |
| Contracts, invoices and payment records | 6 years after the end of the tax year they relate to (HMRC requirement). |
| Performance figures exported from client accounts | Deleted within 30 days of the engagement ending. |
| Analytics cookies | Google Analytics up to 2 years; Clarity up to 1 year; or until you withdraw consent. |
6. Data inside clients' accounts
To do the work, a client adds James Harrop as a named user to its Google Ads, Meta Business Manager, Google Analytics, Tag Manager and, where needed, website accounts, at the lowest permission level that allows the work. adhouse never asks for passwords, never creates accounts in its own name to hold a client's data, and never moves a client's assets into accounts it controls.
The data adhouse takes out of those accounts is limited to performance figures: spend, impressions, clicks, enquiries, sales counts and values, and the campaign, advert and page each relates to. adhouse does not export, copy or store the client's customers' names, email addresses, telephone numbers, addresses or order details. Where such data is visible inside a platform in the course of the work, adhouse views it only as necessary, acts only on the client's instructions, and retains none of it.
When adhouse adds tracking to a client's website or forms, it is designed so that the client's systems continue to hold the customer's details and only an anonymous identifier or source tag reaches the advertising platform, in line with that platform's own terms.
The contractual terms governing this processing, including confidentiality, sub-processing, assistance with data-subject requests, breach notification and deletion on termination, are in the Data Processing Terms within the Terms of Business.
7. AI tools
adhouse uses AI tools to analyse performance figures and to draft adverts, landing pages, reports and replies. Those tools receive performance figures, adhouse's own writing and, when a reply is being drafted, the details you sent in your enquiry. They do not receive clients' customers' personal data. The tools are used on business terms under which the provider does not train its models on the content submitted, and adhouse keeps training features switched off where the provider offers that control.
8. Security
Personal data held by adhouse is stored in encrypted databases hosted in the United Kingdom or the European Union, on devices protected by full-disk encryption and strong authentication, with access limited to James Harrop. Exported performance figures are kept in encrypted storage and deleted on the schedule in section 5. Access to client platforms is by named user with two-factor authentication where the platform supports it. adhouse maintains a written record of which client accounts it has access to and removes itself when an engagement ends.
9. Who else handles the data (sub-processors)
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting this website and the enquiry form service | USA (UK-US Data Bridge) |
| Supabase Inc. | Database for enquiries and client records | United Kingdom (London region) |
| Resend, Inc. | Sending email: enquiry alerts, replies to enquiries, adhouse's emails to businesses it contacts first (including the open and click records above), and the newsletter for people who have opted in | Sending from the EU (Ireland) region; US company, International Data Transfer Agreement |
| AgentMail, Inc. | Mailboxes used by adhouse's automated assistants: a copy of replies to adhouse's outreach emails (to stop the sequence and log the reply), and call notes where a client has agreed to that service | USA (International Data Transfer Agreement) |
| Google LLC | Analytics for this website; Google Workspace email | USA (UK-US Data Bridge) |
| Metricool (Metricool Software SL) | Social media scheduling and reporting; a visit counter on this website, only after consent | Spain (EU) |
| Microsoft Corporation (Clarity) | Anonymised session replay and heatmaps for this website, only after consent | USA / EU (UK-US Data Bridge) |
| Stripe Payments UK Ltd | Invoicing and payment processing for clients | United Kingdom |
| Anthropic PBC | AI analysis and drafting, on business terms | USA (UK-US Data Bridge) |
| tpsmydata | Screening telephone numbers against the TPS and CTPS registers before any business is called | United Kingdom |
| Cal.com, Inc. | Booking calls: your name, email address and the time you chose | USA (International Data Transfer Agreement) |
| Inngest, Inc. | Scheduling adhouse's own automated tasks, such as sending queued emails at a steady pace; sees the email address and content of each queued email | USA (International Data Transfer Agreement) |
| Apollo.io (ZP Group) | Identifying which company, never which person, is visiting this website, only after you choose "Accept optional cookies" | USA (International Data Transfer Agreement) |
Each provider processes data only to provide its service and is bound by a written contract. Where a provider is outside the United Kingdom, the transfer relies on UK adequacy regulations (including the UK-US Data Bridge) or the ICO's International Data Transfer Agreement or Addendum. adhouse will update this list before adding a provider that handles client data.
10. Cookies and browser storage
Google Analytics loads on this website with analytics storage denied by default. In that state it may send cookieless measurement signals. Choosing "Accept optional cookies" grants analytics storage and enables Google Analytics cookies, Microsoft Clarity session analysis, Apollo company-visitor identification and the Metricool visit counter. Choosing "Decline optional cookies" keeps analytics storage denied and does not load Clarity, Apollo or Metricool.
Google Analytics cookies include _ga and _ga_*. Clarity cookies include _clck and _clsk. The site does not send the name or contact details entered in the enquiry form as analytics events. Form fields are masked for session analysis.
Your choice is saved in local storage as ah_consent. Session storage holds a temporary session identifier (ah_sid) and campaign attribution (ah_attribution) so an enquiry and its source can stay connected while you move between pages. The website also records interactions such as booking-button clicks in its own database. These records describe an interaction, not a confirmed booking or a sent message.
You can revisit your choice through "Cookies" in the homepage footer. When you withdraw acceptance, the site changes Google Analytics back to denied storage, clears matching first-party analytics storage where accessible, and reloads to stop optional tools running on the page. You can also clear this site's stored data through your browser settings.
11. Your rights
Under the UK GDPR you may ask adhouse to: confirm whether it holds personal data about you and give you a copy (access); correct it (rectification); delete it (erasure); restrict how it is used while a dispute is resolved; give you a copy in a portable format; and stop using it for a particular purpose (objection), including objecting at any time to direct marketing. Where processing relies on consent, you may withdraw it at any time without affecting what was done before.
Email hello@adhouse.ai. adhouse responds within one month. There is no charge unless a request is plainly excessive. If you are not satisfied, you have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.
12. Changes to this notice
Material changes are shown by a new version number and effective date at the top of this page. Clients are told by email before a change that affects how their account data is handled takes effect.