Privacy Policy

Lean Growth Labs is a trading name of MIXE Group Ltd, a company registered in England and Wales. Our registered office is in the United Kingdom. You can contact us about privacy matters at privacy@leangrowthlabs.ai.

We take your privacy seriously. This policy explains what personal data we collect, how we use it, and your rights under UK GDPR.

We collect personal data in the following circumstances:

When you contact us — first name, last name, email address, phone number, and business name or website. You provide this when you submit the contact form on our site.

When you subscribe to our newsletter — your email address.

When you join a product waitlist — your email address.

When you purchase a product or service — payment is processed by Stripe. We do not store card data; Stripe handles all payment card information directly. We retain a record of the transaction (amount, date, product) for accounting purposes.

When you attend a call or meeting with us — we use Granola, an AI meeting recorder, to capture notes and transcripts. You will be told at the start of any recorded session. Transcripts are retained for up to 12 months and are accessible only to LGL team members.

When you visit our website — we use Umami (self-hosted analytics) to understand how the site is used. Umami does not use cookies and does not collect personally identifiable information. We also use Facebook Pixel and LinkedIn Insight Tag for marketing measurement; these set cookies with your consent and may process your IP address and browser data. See our Cookie Policy for full details.

We use your data to:

- Contact you in response to an enquiry you have made
- Place an initial follow-up call via our AI voice agent (Retell AI) — see note below
- Send you the newsletter you have signed up for
- Notify you when a product you have joined the waitlist for becomes available
- Process and record transactions for products and services
- Measure and improve the performance of our marketing (Facebook Pixel, LinkedIn Insight Tag) — with your consent
- Understand how visitors use the website (Umami analytics)
- Improve our services and communications

AI voice calls: When you submit the contact form and request to be called, the initial call is placed by an AI voice agent (Retell AI), not a human. This is disclosed on the contact form. If you do not wish to receive an automated call, please indicate this in your message and we will contact you by email instead.

We do not sell your data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects beyond the initial AI call routing described above.

We process your data on the following lawful bases under UK GDPR:

- Consent — newsletter subscriptions, waitlist sign-ups, and the placing of non-essential cookies (Facebook Pixel, LinkedIn Insight Tag)
- Legitimate interests — responding to an enquiry you initiated; routing that enquiry via AI voice agent (Retell AI) as a proportionate and disclosed follow-up mechanism; self-hosted analytics (Umami) where no personal data is collected. We have assessed that these interests are not overridden by your rights and freedoms.
- Contract performance — processing data necessary to deliver a purchased product or service

You can withdraw consent at any time. See Your Rights below.

Contact form submissions and email subscriptions are stored in Mautic, our self-hosted contact management platform. Data is held on servers located within the United Kingdom.

We retain data for the following periods:

- Contact enquiries (no purchase) — up to 2 years from your last interaction with us
- Newsletter subscribers — until you unsubscribe, after which your record is deleted within 30 days
- Waitlist sign-ups — until the product launches or you request removal
- Client data (purchased services) — for the duration of the engagement plus 7 years, to meet accounting and legal obligations
- Meeting transcripts (Granola) — up to 12 months from the date of the meeting
- Transaction records — 7 years for VAT and accounting compliance

Inactive contacts who have not engaged and have no active relationship with us are reviewed and deleted periodically.

We share your data with third parties only where necessary to operate our services:

- Mautic — self-hosted contact management. We own and operate this infrastructure; data does not leave our servers.
- n8n — self-hosted workflow automation used to process contact form submissions and trigger follow-up actions. We own and operate this infrastructure.
- Retell AI — AI voice agent service used to place follow-up calls when you request contact. Your phone number is passed to Retell solely to place this call. Retell is a US-based service; see International Transfers below.
- Granola — AI meeting recorder used when we hold calls or meetings with you. You will be informed at the start of any recorded meeting.
- Umami — self-hosted website analytics. No personal data or cookies are used. Data stays on our own infrastructure.
- Meta (Facebook Pixel) — marketing measurement, with your consent. Meta may process data about your visit to measure ad performance. Meta operates as an independent data controller for data collected through its pixel. See Meta's privacy policy for details.
- LinkedIn (Insight Tag) — marketing measurement, with your consent. LinkedIn operates as an independent data controller for data collected through its tag. See LinkedIn's privacy policy for details.
- Stripe — payment processing for product and service purchases. Stripe handles all card data directly and operates under its own privacy policy. We receive a transaction record but do not store card details.

We do not sell your data to any third party for their own marketing purposes.

Most of your data is processed on infrastructure located within the United Kingdom or European Economic Area.

Retell AI is a US-based service. Your phone number is transferred to the United States solely to place the follow-up call you requested. This transfer is covered by Standard Contractual Clauses (SCCs) between us and Retell AI, which provide appropriate safeguards under UK GDPR.

Meta and LinkedIn may transfer data collected through their respective pixels to servers outside the UK/EEA, including the United States. Both companies rely on SCCs or the UK–US Data Bridge as their transfer mechanism. Their respective privacy policies describe this in detail.

Where we use other services based outside the UK/EEA, we ensure appropriate transfer safeguards are in place before any data is shared.

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include:

- Encryption in transit (HTTPS/TLS) for all data transfers
- Self-hosted infrastructure with access restricted to authorised team members
- Regular review of third-party processor security practices
- Prompt investigation of any suspected data incident

If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.

Our website and services are directed at business owners and professionals. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with their data, please contact us at privacy@leangrowthlabs.ai and we will delete it promptly.

Under UK GDPR, you have the right to:

- Access the personal data we hold about you
- Rectify any inaccurate data
- Erase your data (the right to be forgotten)
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time, where consent is our lawful basis
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email us at privacy@leangrowthlabs.ai. We will respond within 30 days.

We use strictly necessary cookies for the website to function, and — with your consent — analytics and marketing cookies (Facebook Pixel, LinkedIn Insight Tag). See our Cookie Policy for the full list and how to manage your preferences.

We may update this policy from time to time. The date at the bottom of this page reflects when it was last revised. Significant changes will be communicated to active contacts by email.