Privacy Policy

1. Who we are

No‑Friction Lab ("we", "us", "our") provides UX and CRO audit services and DIY toolkits. We are the data controller for personal data collected through www.nofrictionlab.co.uk and related services.

• → Legal owner (sole trader): Alice Couldwell
• → Trading name: No‑Friction Lab
• → Email: hello@nofrictionlab.co.uk
• → Address: Available on request

We comply with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

2. Personal data we collect

We may collect and process the following types of personal data:

1. Contact details: name, email address, job title, company name.
2. Website and product details: your website URL, product information, and any access you provide for audit purposes.
3. Booking and billing data: audit type, pricing, payment confirmation details (via Stripe or similar).
4. Marketing data: your preferences, email engagement (opens, clicks), and responses to emails.
5. Technical data: IP address, browser type, device information, and pages visited (through analytics and cookies).

We typically collect this data when you:

1. Fill in a form on the website.
2. Join a waitlist or request early access.
3. Purchase an audit or other service.
4. Communicate with us by email or through other channels.

3. How we use your personal data and legal bases

We use your data for the following purposes, under these legal bases:

4. How we share your data

We do not sell your personal data. We may share it with trusted third‑party service providers who help us run our business, such as:

1. Website and platform provider (e.g. Netlify) – to host and power our website and forms.
2. Database and workspace tools (e.g. Airtable, Notion) – to manage waitlists, projects, and internal records.
3. Email service provider (e.g. MailerLite) – to send emails, newsletters, and automations.
4. Payment processors (e.g. Stripe or similar) – to process payments securely.
5. Analytics tools – to monitor and improve website performance.

These providers act as processors on our behalf and are only allowed to use your data in accordance with our instructions and applicable law. We may also share data where required to comply with a legal obligation or to protect our rights.

Some providers may transfer data outside the UK/EEA; where they do, we aim to ensure appropriate safeguards (such as standard contractual clauses) are in place.

5. Data retention

We keep personal data only for as long as necessary for the purposes set out in this policy or as required by law.

In general:

1. Enquiry and waitlist data: kept while you remain a potential client and for a reasonable period afterwards.
2. Client and audit records: kept for the duration of our relationship and for a period afterwards for legal and accounting purposes.
3. Marketing data: kept until you unsubscribe or ask us to delete it (subject to minimal records kept to respect opt‑out).

We will securely delete or anonymise data when it is no longer needed.

6. Your rights

Under the UK GDPR, you have rights over your personal data, including:

1. Right of access – to request a copy of the personal data we hold about you.
2. Right to rectification – to have inaccurate or incomplete data corrected.
3. Right to erasure – to ask us to delete your data in certain circumstances.
4. Right to restrict processing – to limit how we use your data in certain situations.
5. Right to data portability – to receive your data in a structured, commonly used format in some cases.
6. Right to object – to object to certain processing, including direct marketing.
7. Right to withdraw consent – where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at hello@nofrictionlab.co.uk. We may need to verify your identity before responding.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you are unhappy with how we handle your data, but we would appreciate the chance to address your concerns first.

7. Cookies and similar technologies

We use cookies and similar technologies to:

1. Make the Site work properly and keep it secure.
2. Understand how visitors use the Site to improve content and design.
3. Sometimes support marketing and measurement.

Where required by law, we will ask for your consent before setting non‑essential cookies. You can manage your cookie preferences through your browser settings or our cookie banner (if applicable).

You can find more details in our separate Cookie Policy.

8. Third‑party websites

The Site may contain links to other websites. We are not responsible for the privacy practices or content of third‑party websites. If you follow a link to any other site, please check their privacy policy.

9. Children

Our services and Site are not aimed at children under 18, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will change the "Last updated" date at the top. We encourage you to review this page periodically for any changes.

Your continued use of the Site after any changes indicates your acceptance of the updated policy.