Privacy Policy

1. Who we are

ClarusBlue Consulting Limited is the controller of the personal information described in this policy. We are a management consultancy. We work with founders, leaders and investors to help them build valuable, scalable businesses.

Please contact us at the address and email above if you have any queries regarding this privacy statement, or if you would like to contact us about any data protection issue. We operate in the United Kingdom and Switzerland. One of our partners is based in Switzerland, but there is no separate Swiss entity: ClarusBlue Consulting Limited is the controller for all of the processing described here.

2. What this policy covers

This policy explains what personal information we collect through clarusblue.com and in the course of our work, why we collect it, who we share it with, how long we keep it, and what rights you have over it.

Sections 5 and 6 explain our use of artificial intelligence and of automated profiling.

3. What we collect, and when

What we collect, in summary

The sections that follow explain when each of these is collected and why.

3.1 When you use the AI Reality Check

The AI Reality Check is a free questionnaire that produces a personalised report on where artificial intelligence is likely to pay back in your business.

You answer a series of questions about how your business operates. To receive your report you then give us your first and last name, your work email address, your company name and the country you are based in, along with your sector and the size of your organisation. Your job title and telephone number are optional. You may also write a free-text description of your business in your own words, and, at the end, tell us what you would do with more time each week if your team had it.

The form asks you not to include personal information about patients, clients, customers or staff in either of those answers. We do not need it in order to produce your report. If such information is provided, it is stored and processed in the same way as everything else you give us.

We use this to generate and send your report, to understand who is using the tool, and, where you have agreed to it, to follow up with you.

3.2 When you enquire about the workshop or the diagnostic

You give us your name, work email, company, the town or city you are based in, your organisation size, your sector, which productivity suite your team uses, when you would like the work to run, and a short description of what you want to achieve. Your job title and telephone number are optional. For the workshop we also ask how many people would attend and whether you would prefer to meet on site or remotely.

We use this to respond to you, to prepare a quote, and to plan the work if you go ahead.

3.3 When you contact us

You give us your name, work email, company, what you would like help with and a short description of your situation. Your job title, organisation size and how you heard about us are optional.

3.4 When you subscribe to our insights

Your email address, and your consent for us to email you our Insights: articles about scaling businesses, and occasional updates about our work. We do not use it for anything else.

3.5 When you apply for a role

You give us your name and contact details, and you may attach a CV, which may include your employment history, your education and your home address.

A CV often contains information we have not asked for and do not need, including date of birth and information from which health, ethnicity or religion could be inferred. We do not use such information in assessing an application.

Information provided in a CV is used to consider you for the role or for work with us generally. When you send us a copy of your CV it is emailed to us and then stored in our Microsoft SharePoint environment, with access limited to the people involved in recruitment. No copy is kept in the website's database or file storage. We keep a record of your name, email address and your covering note, letter or email, to be able to process your application.

Where we do not take an application further, we keep it for six months from our decision. If you ask us to keep your details on file for future opportunities, we keep them for twelve months from the date you applied.

If we are not able to take things further and you would like us to keep your details in case something suitable comes up, please let us know and we can keep your details on file.

3.6 When you become a client

In the course of an engagement we will hold contact details and professional information about you and colleagues at your organisation, along with notes, correspondence and working documents. Much of what we learn during an engagement is about the business rather than about individuals, but not all of it, and this policy covers the part that is not.

3.7 Automatically, when you visit the site

Our hosting provider records technical information about your visit, including your IP address, approximate location, browser, the pages you visit and the time you spend on them. This happens whether or not you accept cookies, because it is how the site is served and kept secure.

If you accept cookies, HubSpot records your browsing on our site and links it to you if you later fill in one of our forms. And Microsoft Clarity records your visit: which pages you saw, where you clicked and scrolled, and where you gave up. Some of that is replayed as a recording of your session, which we use to find the parts of the site that do not work as well as we thought.

Please note however that Clarity is set to mask all text, so anything you type into a form, including the description of your business in the AI Reality Check and your contact details, is hidden in the recording. We see that a field was filled in. We do not see what you put in it.

Clarity is a Microsoft product, and the permission we ask for on your behalf allows Microsoft to use what it gathers for its own purposes, including Microsoft Advertising, as well as for showing us how our site is doing. We ask for that permission because without it Clarity treats every page you visit as a new person, which makes the recordings useless to us. What Microsoft does with the data is described in the Microsoft Privacy Statement.

If you do not accept cookies, none of that happens. Nothing is recorded and nothing reaches Microsoft. Section 9 covers cookies and how to change your mind.

3.8 Information we get from somewhere other than you

Everything above is information you give us yourself.

Our customer relationship system, HubSpot, maintains its own business information dataset. When you give us your email address, HubSpot may add professional details about you and your organisation that you did not give us: typically a job title, a company name, an industry, an approximate size, and technical identifiers such as an IP address. HubSpot compiles that dataset independently of us, from its own sources.

We use it for one purpose, which is to have some idea who we are speaking to before we reply. If someone gives us only an email address and a sentence, knowing whether they run a forty-person logistics business or a two-hundred-person practice changes how useful our first response can be.

We rely on legitimate interests for this, so you can object to it. If you do, we will remove the added information and stop it being added again. See section 12.

The same arrangement runs in the other direction, and section 7 explains what that means.

4. Our lawful bases

We must have a lawful basis for everything we do with your personal information. The following outlines how we use it.

Where we contact you, we may do so by email, by telephone, or through professional networks such as LinkedIn, using the contact details you have given us. We do not contact people using business contact details obtained from anywhere other than the person themselves.

Where consent is the basis, we ask for it at the point of collection: on the AI Reality Check form, when you subscribe to Insights, and when we ask whether to keep a job application on file. Where we rely on legitimate interests we do not ask, and you may object at any time.

You may contact us at any time for further information about how we collect and use your information, and you may ask us to stop processing it. Section 12 explains your rights.

5. How we use artificial intelligence

We advise businesses on adopting artificial intelligence. There are two places we use it on your information.

5.1 Writing your AI Reality Check report

When you complete the AI Reality Check, your answers and your free-text business description are sent to Anthropic PBC and processed by Claude, a large language model, which writes the narrative of your report. We do this because a report written about your business is worth more to you than a generic one.

Anthropic processes this for us and on our instructions, as our processor, under Anthropic's commercial terms. Those terms prohibit Anthropic from using customer content to train its models, and incorporate a data processing addendum with standard contractual clauses. Your answers are not used to train any model, ours or anyone else's.

The finished report is stored against your submission so that we can send you the same document you originally received, and it is delivered to you through a private link. Anyone who has that link can open the report, so please treat it as you would any other private link.

5.2 Preparing quotes and responses

If you ask us for a quote or a proposal, a member of our team may use our own Claude workspace to help prepare it. That means the information you have given us, including your name, your company and what you have told us about your situation, may be entered into that workspace.

That workspace is a Claude Team account, which sits under the same commercial terms described above, so the same position on training applies. This is a person using a tool rather than an automated process, and nothing about you is decided by it.

5.3 What we do not do

We do not sell your personal information, and we never will. We do not use artificial intelligence to make any decision about you that has a legal effect or a similarly significant one. Nothing automated decides whether you can work with us, on what terms, or at what price. A person makes those decisions.

6. Profiling

The AI Reality Check generates more than the report you see. From your answers we produce three scores, an internal profile, a readiness band, and an indication of which of our services is most likely to be relevant to you. All of this is generated automatically.

These shape which version of the report you receive, which of our services we point you towards, and, if you have consented to hear from us, which of our follow-up emails you receive.

Two of those scores appear in your report. The third does not. It is an internal view of how well suited a business like yours is to the way we work, which helps us judge where we are likely to be useful and where we are not. It is a commercial judgement about fit rather than an assessment of you or of how well you run your business, and no decision about you is made from it automatically.

This is profiling. It is not automated decision-making producing legal or similarly significant effects: nothing here determines whether you can buy from us, on what terms, or at what price, and every commercial decision is made by a person. You can ask us what we hold about you, including the profile and the scores assigned, and you can object to the profiling. Section 12 explains how.

7. Who we share your information with

We do not sell your information and we do not share it for anyone else's marketing. We do use suppliers who process it on our behalf, under contract, on our instructions.

We may also disclose personal information where the law requires it, or to establish or defend a legal claim.

The database, the storage and the application functions behind this site are provided by Lovable, which engages Supabase and Amazon Web Services to deliver them. Our agreement is with Lovable, and Lovable is accountable to us for all three.

Lovable also collects technical information about visitors, including IP address, approximate location, browser, pages visited and session identifiers, and uses it as a controller in its own right for its own analytics, security and product development. This happens independently of us and we are not able to switch it off. Lovable's own privacy information and its data protection officer can be reached through lovable.dev.

HubSpot acts as a controller in its own right for the professional information described in section 3.8: job title, company name, industry, organisation size and online identifiers. It uses that data to maintain and develop the business information dataset it provides to its customers generally, which includes us. In practice this means information about your professional role can travel in both directions: HubSpot adds detail to what we hold about you, and professional data flowing through our systems contributes to the dataset it maintains. This is separate from everything else HubSpot does for us, where it acts purely as our processor. Their privacy information and data protection officer can be reached through hubspot.com.

8. Where your information is processed

Most of your information stays in the United Kingdom or Ireland. Our database, our file storage, the system that authenticates our administrators and the backups of all three sit in Ireland. The backups are not copied to any other region, and they are deleted along with everything else if we close the account. Our email, documents and calendars sit in the United Kingdom. Both countries are recognised by the United Kingdom as offering adequate protection, so neither is a transfer requiring additional safeguards.

Where information is stored is not the same as where a request is handled. This site is served through a globally distributed network, so when you visit, your request is answered by whichever location is nearest to you, which may well be outside Ireland or the United Kingdom. What travels that way is the request itself and the technical information attached to it, such as your IP address. What you actually tell us is stored in Ireland. That network is operated by Cloudflare, whose safeguards are in the table below.

Some suppliers are based in the United States. Where information reaches them, we rely on the safeguards the law requires: either the supplier is certified under the Data Privacy Framework including its United Kingdom extension, or the transfer is made under the International Data Transfer Addendum to the European Commission's standard contractual clauses.

You can ask us for a copy of the safeguards that apply to any of these transfers. Write to us at info@clarusblue.com.

9. Cookies and similar technologies

A cookie is a small file a website stores in your browser. Some are necessary for a site to work at all. Others are not, and the law says we must ask before setting those.

When you first visit, we ask you to choose. Until you accept, we set no analytics or marketing cookies. If you choose Essential only, or close the banner without choosing, we do not set them and we delete any we set previously. You can change your mind at any time using the Cookie settings link in the footer of every page.

Each cookie below is listed by the name under which it appears in your browser, so you can identify it if you look.

Microsoft Clarity also sets cookies on Microsoft's own web addresses rather than ours. We cannot delete those from here, because they do not belong to this site. They stop being created the moment you withdraw consent, and expire on their own.

We also store two things in your browser that are not cookies, but which the same rules cover. Your cookie choice is kept in local storage so we can remember it, and your progress through the AI Reality Check is kept in session storage so that a refresh does not lose your answers. Both are necessary, neither is shared with anyone, and the second disappears when you close the tab.

We do not use Google Analytics, Google Tag Manager, advertising pixels, or any social media tracking. Our typefaces are served from our own site rather than from a font service, so visiting us does not tell anyone else that you did.

10. How long we keep it

We keep personal information for as long as we have a reason to, and no longer. In practice that means the following.

At the end of the 24 month period, rather than deleting an AI Reality Check submission outright, we remove everything that identifies you: your name, email address, company, job title, telephone number and both of your free-text answers. What remains is the sector, the size of the business, the country and the answers and scores, with nothing attached to a person. We keep that because it helps us understand which opportunities recur across businesses like yours. If you would rather we deleted the whole record, ask us and we will.

A CV is deleted from our SharePoint environment and from the mailbox it arrived in. Everything else is deleted from our database. Deletion is carried out by us rather than automatically, and we log every deletion of a database record so we can show it was done.

One practical caveat. Our database is backed up, and those backups are kept for around fourteen days before being overwritten. So a record you ask us to delete today disappears from the live database immediately and from the backups within about a fortnight. The backups are held in Ireland alongside the database and are not copied anywhere else.

11. Keeping it safe

Access to personal information is limited to the people who need it. Administrative access to our systems requires an individual account and is restricted by role. Data sent between your browser and our site is encrypted. Our hosting provider holds SOC 2 Type II and ISO 27001 certification.

No system is perfectly secure. If a breach occurs that is likely to put your rights at risk, we will tell you, and we will report it to the Information Commissioner's Office within seventy-two hours of becoming aware of it where the law requires.

12. Your rights

Under UK data protection law you have the following rights. They are free to exercise, and we will respond within one month.

• Access. Ask us for a copy of the personal information we hold about you, including any internal profile and scores we have assigned.
• Rectification. Ask us to correct anything that is wrong or incomplete.
• Erasure. Ask us to delete what we hold, where we have no legitimate and legal reason to keep it.
• Restriction. Ask us to pause our use of your information while we look into a query you have raised about it, for example while we check whether it is accurate.
• Portability. Ask for the information you gave us in a machine-readable form, or ask us to send it to someone else.
• Objection. Object to processing we base on legitimate interests, including profiling. If you object to direct marketing, we will stop sending it.
• Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. Anything we did before you withdrew it remains lawful.

To exercise any of these, email info@clarusblue.com or write to us at the address in section 1. We will ask you to confirm and verify who you are before we act.

13. Complaints, and changes to this policy

If you are unhappy with how we have handled your information, please tell us first. If you are still unhappy, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/data-protection-complaints, by telephone on 0303 123 1113, or by writing to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

We update this policy when what we do changes, and the updated version is published on this page. The date at the top tells you when we last did so. If we make a change that materially affects you, we will notify you directly.