Privacy Policy

Lean Growth Labs is a trading name of MIXE Group Ltd, a company registered in England and Wales. Our registered office is 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. You can contact us about privacy matters at privacy@leangrowthlabs.ai.

This policy covers our main website (www.leangrowthlabs.ai), our offer and checkout pages (go.leangrowthlabs.ai) and our client area (clients.leangrowthlabs.ai).

We take your privacy seriously. This policy explains what personal data we collect, how we use it, and your rights under UK GDPR.

We collect personal data in the following circumstances:

When you contact us — first name, last name, email address, phone number, and business name or website. You provide this when you submit the contact form on our site.

When you subscribe to our newsletter — your email address.

When you join a product waitlist — your email address.

When you buy from us — including the AI Opportunity Assessment on go.leangrowthlabs.ai. Stripe handles the payment and collects your name, email address, phone number, billing address and business name. We never see or store your card details. You tick a box to accept the terms before you pay. With your order we keep a record of the transaction (amount, date, product) and a note of how you found us: the campaign tags in the link you clicked (UTM parameters), your cookie choice and — only if you accepted marketing cookies — any Facebook click ID and the Meta cookie values (_fbp and _fbc). Stripe emails you the receipt and invoice.

When you book a call with us — such as a free 15-minute Clarity call, or the Discovery and Review calls that are part of the Assessment. We use Cal.com to take the booking. It collects your name and email address, and your phone number and company if you choose to give them, plus the same note of how you found us. The booking is added to our Google Calendar and the call takes place on Google Meet.

When you buy or book — we add you to, or update your record in, Mautic, our own email and contact system, with a note of where you are in the process (for example, that you've bought the Assessment, booked your Discovery call, or had a Clarity call and aren't ready yet). We use this to send the emails you'd expect: your booking link, and reminders 3 and 21 days after purchase if you haven't booked your Discovery call. If you've had a free Clarity call, we may send you a short series of follow-up emails; you can unsubscribe at any time using the link in every email.

When you attend a call or meeting with us — we may use an AI note-taker (Wispr Flow or Otter) to take notes and a transcript. We'll tell you at the start of the call, and you can ask us not to record it. We then use an AI model to draft meeting notes and action points from the transcript (see Third parties and International transfers below). The notes are kept in our internal workspace (Notion). Transcripts are kept for up to 12 months and only the LGL team can see them.

When we deliver your work — your Assessment report, and other work we produce for you, is published as a password-protected page in our client area (clients.leangrowthlabs.ai), which runs on our own servers. Only people with the password can see it.

When you visit our websites — we use Umami, which we host ourselves, to see how our pages are used. On go.leangrowthlabs.ai this includes page views, which buttons you click, which sections you view, how far you scroll, which FAQs you open and which checkout and booking steps you reach. We also record, from our own systems, when a payment or booking is completed. Umami does not use cookies, and we don't send it your name, email or anything else that identifies you. To know which campaign brought you to us, we keep the campaign tags from the first link you clicked in your browser's session storage, which is cleared when you close the tab.

With your consent only, we also use the Meta (Facebook) Pixel and the LinkedIn Insight Tag to measure how well our adverts work. These set cookies and may process your IP address and browser details. If you accept, and you then buy or book, we also tell Meta directly from our own systems that a purchase or booking happened (Meta's Conversions API). We send your email address, phone number and first and last name in scrambled (hashed) form, so Meta can match them to an account without us sending them in readable form, along with the Meta cookie values and the order value. If you decline, none of this is sent to Meta. See our Cookie Policy for full details.

We use your data to:

- Contact you in response to an enquiry you have made
- Place an initial follow-up call via our AI voice agent (Retell AI) — see note below
- Send you the newsletter you have signed up for
- Notify you when a product you have joined the waitlist for becomes available
- Process and record transactions for products and services
- Take payment for, and deliver, the products and services you buy — including arranging your calls and publishing your report
- Send the emails that go with a purchase or booking: booking links, reminders and receipts
- Send follow-up emails after a free Clarity call, which you can unsubscribe from at any time
- Tell our team when a new order comes in, so we can get started
- Understand which campaigns and pages lead to bookings and sales
- Tell Meta about purchases and bookings so we can measure our adverts — only if you've accepted marketing cookies
- Turn call transcripts into notes and action points
- Measure and improve the performance of our marketing (Facebook Pixel, LinkedIn Insight Tag) — with your consent
- Understand how visitors use the website (Umami analytics)
- Improve our services and communications

AI voice calls: When you submit the contact form and request to be called, the initial call is placed by an AI voice agent (Retell AI), not a human. This is disclosed on the contact form. If you do not wish to receive an automated call, please indicate this in your message and we will contact you by email instead.

We do not sell your data to third parties. We do not use your data for automated decision-making that produces legal or similarly significant effects beyond the initial AI call routing described above.

We process your data on the following lawful bases under UK GDPR:

- Contract — when you buy from us, or book a call that's part of something you've bought, we use your details to take payment, arrange the calls, deliver the work and send the emails that go with it (booking links, reminders, receipts). We also rely on this when you book a free call, because you've asked us to arrange it.
- Consent — newsletter subscriptions, waitlist sign-ups, marketing cookies (Meta Pixel, LinkedIn Insight Tag), and sending purchase and booking events to Meta through its Conversions API
- Legitimate interests — responding to an enquiry you started; routing that enquiry through our AI voice agent (Retell AI) as a disclosed follow-up; following up by email after a free Clarity call (you can unsubscribe at any time); telling our team about new orders; recording which campaign brought you to us; our own analytics (Umami); and AI note-taking on calls, which we tell you about. We've checked that these interests don't override your rights and freedoms.
- Legal obligation — keeping transaction records for tax and accounting

You can withdraw consent at any time. See Your Rights below.

Contact form submissions, email subscriptions, and the contact records we create when you buy or book, are stored in Mautic, which we host ourselves on servers in the United Kingdom. Your booking details are also held by Cal.com and in our Google Calendar, and your payment details by Stripe.

We retain data for the following periods:

- Contact enquiries and free-call bookings (no purchase) — up to 2 years from your last contact with us
- Newsletter subscribers — until you unsubscribe, after which your record is deleted within 30 days
- Waitlist sign-ups — until the product launches or you request removal
- Client data (purchased services, including bookings and reports) — for the duration of the engagement plus 7 years, to meet accounting and legal obligations
- Meeting transcripts — up to 12 months from the date of the meeting
- Transaction records — 7 years for VAT and accounting compliance
- Your cookie choice — 180 days, after which we'll ask again

Inactive contacts who have not engaged and have no active relationship with us are reviewed and deleted periodically.

We share your data with third parties only where necessary to operate our services:

- Mautic — self-hosted contact management. We own and operate this infrastructure; data does not leave our servers.
- n8n — our own automation tool, which we host ourselves. It passes form submissions, purchases and bookings between our systems, emails our team an internal "new sale" alert, and sends purchase and booking events to Meta when you've consented.
- Retell AI — AI voice agent service used to place follow-up calls when you request contact. Your phone number is passed to Retell solely to place this call. Retell is a US-based service; see International Transfers below.
- Wispr Flow and Otter — AI note-takers used on calls and meetings. We'll tell you at the start of any recorded call. Both are US-based.
- OpenRouter and the AI model providers it uses — we send call transcripts through OpenRouter (US-based) to an AI model that drafts notes and action points. The model we use is GLM, made by Z.AI, and is usually run by Z.AI or another provider in China; OpenRouter may pass it to providers in the US or elsewhere if those aren't available. See International transfers below.
- Notion — our internal workspace, where meeting notes and some project records are kept. Notion is US-based.
- Cal.com — our scheduling tool, used to book calls. Cal.com is US-based.
- Google (Calendar, Meet and Workspace) — booked calls are added to our Google Calendar and held on Google Meet; our business email runs on Google Workspace.
- Mailgun — sends the emails from our Mautic system. We use Mailgun's EU region, so your email address stays in the EU.
- Umami — our own website analytics, which we host ourselves, used on www and go.leangrowthlabs.ai. It uses no cookies and we don't send it personal details.
- Meta (Facebook Pixel and Conversions API) — advert measurement, with your consent only. Meta operates as an independent data controller for data collected through its Pixel. See Meta's privacy policy for details.
- LinkedIn (Insight Tag) — marketing measurement, with your consent. LinkedIn operates as an independent data controller for data collected through its tag. See LinkedIn's privacy policy for details.
- Stripe — payment processing. Stripe collects your payment and billing details, handles all card data directly and sends your receipt and invoice. It operates under its own privacy policy. We receive a record of the transaction but never your card details.

We do not sell your data to any third party for their own marketing purposes.

Most of your data is processed on our own servers in the United Kingdom, or by providers in the UK or European Economic Area. Some services we use are based in, or send data to, other countries:

- Retell AI — your phone number is sent to the US only to place the follow-up call you asked for.
- Cal.com — your booking details are held in the US.
- Stripe — payment and billing details may be processed in the US as well as the UK and EU.
- Google — calendar entries and video calls may be processed in the US.
- Wispr Flow, Otter and Notion — call recordings, transcripts and meeting notes are held in the US.
- Meta and LinkedIn — data from their Pixel and Insight Tag, and the purchase and booking events we send to Meta when you've consented, may be processed in the US.
- AI note drafting — call transcripts pass through OpenRouter in the US and are usually processed by an AI model provider in China. China isn't covered by UK adequacy regulations, which means UK law doesn't treat it as protecting personal data to the same standard as the UK. If you'd rather your call wasn't processed this way, tell us at the start of the call, or email privacy@leangrowthlabs.ai, and we won't record it.

For transfers to the US and other countries, we rely on the UK–US Data Bridge (for US companies certified under it) or on the UK's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. Each provider's privacy policy explains this in more detail.

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include:

- Encryption in transit (HTTPS/TLS) for all data transfers
- Self-hosted infrastructure with access restricted to authorised team members
- Regular review of third-party processor security practices
- Prompt investigation of any suspected data incident

If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay.

Our website and services are directed at business owners and professionals. We do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with their data, please contact us at privacy@leangrowthlabs.ai and we will delete it promptly.

Under UK GDPR, you have the right to:

- Access the personal data we hold about you
- Rectify any inaccurate data
- Erase your data (the right to be forgotten)
- Restrict processing in certain circumstances
- Object to processing based on legitimate interests
- Data portability — receive your data in a structured, machine-readable format
- Withdraw consent at any time, where consent is our lawful basis
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email us at privacy@leangrowthlabs.ai. We will respond within 30 days.

We use one essential cookie to remember your cookie choice. With your consent only, we also use marketing cookies (Meta Pixel, LinkedIn Insight Tag). Our analytics (Umami) uses no cookies. See our Cookie Policy for the full list and how to change your choice.

We may update this policy from time to time. The date at the top of this page shows when it was last revised. Significant changes will be communicated to active contacts by email.