Privacy Policy

1. Introduction

Lean Growth Labs ("we", "our", or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your information when you use our customer acquisition services and interact with our website, particularly through our contact and callback request forms.

We are the data controller responsible for your personal data. We are committed to complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all other applicable data protection legislation.

2. Information We Collect

When you submit a callback request or contact form on our website (including our Customer Acquisition service page), we collect the following personal information:

• Personal Identifiers: First name, last name
• Contact Information: Email address, phone number (in international format)
• Business Information: Business name, website URL (optional)
• Communication Preferences: Your consent to be contacted
• Technical Data: IP address, browser type, device information, and cookies (for website functionality)

3. How We Use Your Information

We process your personal data for the following specific purposes:

3.1 AI Voice Agent Contact (Retell AI)

When you submit your details through our acquisition page form, we use your information as follows:

• Immediate AI Voice Call: Your phone number is processed through our N8N automation workflow and passed to Retell AI to initiate an automated suitability assessment.
• Conversation Analysis: Retell AI processes your verbal responses in real-time to understand your business needs.
• Qualification Process: Your responses are analyzed to qualify you as a potential customer.
• N8N Automation: Your form data is processed through our self-hosted N8N platform to orchestrate the workflow.

3.2 Sales Consultation and Conversion

Following the initial AI assessment, your information is used for:

• Cal.com Booking: Your details are used to manage Google Meet video call appointments.
• Google Meet Scheduling: Cal.com sends video call invitations directly to your email.
• Sales Process & Proposal: We use your business information to conduct consultations and create custom proposals.
• Conversion Activities: We use your information to follow up and facilitate your decision-making.

3.3 Additional Processing Purposes

• Customer Relationship Management: Storing your details in our CRM system to manage ongoing communications and track engagement
• Service Delivery: If you become a customer, using your information to deliver our customer acquisition services
• Legal Compliance: Meeting our legal obligations and protecting our legitimate business interests
• Analytics: Understanding how visitors interact with our website to improve our services (using anonymized data where possible)

4. Legal Basis for Processing

We process your personal data under the following legal bases:

• Consent: You have explicitly consented to be contacted via phone and email when submitting the form. You can withdraw consent at any time
• Legitimate Interests: We have a legitimate business interest in responding to your enquiry, qualifying potential customers, and pursuing business opportunities
• Contract Performance: Processing is necessary to enter into or perform a contract with you for our services

5. Data Sharing and Third Parties

We may share your personal data with the following categories of recipients:

• Retell AI: Processes phone numbers and conversation data for initial suitability calls.
• N8N (Self-Hosted): Orchestrates workflows. Data remains within our controlled infrastructure.
• Cal.com: Manages appointment bookings.
• Google Workspace: Used for video consultations and email.
• CRM Providers: Stores contact details for ongoing communication.
• Analytics Providers: Processes anonymized usage data (e.g., Google Analytics).
• Meta (Facebook): Processes data for advertising and measuring ad performance (Facebook Pixel).
• Cloud Infrastructure: Hosts our secure systems.

All third-party service providers are carefully selected and required to maintain appropriate security measures and comply with data protection laws. We do not sell your personal data to third parties.

6. Data Retention

We retain your personal data for the following periods:

• Enquiries (Non-customers): We retain your data for up to 2 years from your last interaction, after which it is securely deleted unless you request earlier deletion
• Customer Data: If you become a customer, we retain your data for the duration of the service contract plus 7 years for legal and accounting purposes
• Retell AI Call Records: Voice conversation data (recordings and transcripts) from Retell AI assessment calls is retained for quality assurance and training purposes for up to 12 months, then securely deleted. Retell AI may also retain this data according to their own retention policies
• N8N Workflow Logs: Automation logs in our self-hosted N8N system containing your form submission data are retained for up to 90 days for troubleshooting and optimization purposes
• Cal.com Scheduling Data: Appointment booking information is retained in Cal.com for the duration of your engagement plus 12 months for scheduling history and analytics
• Marketing Communications: If you consent to marketing, we retain your data until you withdraw consent or become inactive for 3 years

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete data
• Right to Erasure: Request deletion of your personal data (subject to legal obligations)
• Right to Restrict Processing: Request limitation on how we use your data
• Right to Data Portability: Receive your data in a structured, machine-readable format
• Right to Object: Object to processing based on legitimate interests or for marketing purposes
• Right to Withdraw Consent: Withdraw your consent for AI calls or marketing communications at any time
• Right to Lodge a Complaint: Complain to the Information Commissioner's Office (ICO) if you believe your data protection rights have been violated

To exercise any of these rights, please contact us using the details in Section 11.

8. Data Security

We implement appropriate technical and organizational security measures to protect your personal data, including:

• Encryption of data in transit (HTTPS/TLS) and at rest
• Secure cloud infrastructure with access controls
• Regular security assessments and updates
• Staff training on data protection and security
• Restricted access to personal data on a need-to-know basis
• Secure deletion procedures for data that is no longer needed

9. International Data Transfers

Your data may be transferred to and processed in countries outside the UK/EEA, particularly when using third-party services like Retell AI, Google Workspace, and Cal.com. Where such transfers occur, we ensure appropriate safeguards are in place, such as:

• Standard Contractual Clauses approved by the UK authorities
• Adequacy decisions recognizing equivalent data protection standards
• Appropriate technical and organizational security measures

10. Cookies and Tracking

Our website uses cookies and similar tracking technologies to:

• Ensure the website functions properly
• Remember your preferences
• Analyze website traffic and user behavior
• Improve our services and user experience

You can control cookie settings through your browser. For more information, see our Cookie Policy.

11. Contact Information

For any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make significant changes, we will:

• Update the "Last updated" date at the top of this policy
• Notify you via email if you have provided consent for communications
• Display a prominent notice on our website

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data.

13. Children's Privacy

Our services are directed at businesses and are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.