Privacy Policy

This notice covers weareoriginate.com and the account area at account.weareoriginate.com. Last updated 7 October 2026.

The controller is Originate Group Ltd, company number 17134310, Unit 24-25, Sovereign, Weston-super-Mare. Questions and requests go to hello@weareoriginate.com.

What we collect and why

Each thing the site does, the data it needs, and the lawful basis we rely on.

  • Diagnostic requests. The website address and email you enter. We use them to score the site and send the report. Basis: steps you ask us to take before any contract (UK GDPR Article 6(1)(b)). The form carries a Cloudflare Turnstile check so the queue is not filled by bots; see Cookies below.
  • Messages to us. Whatever you send by email, WhatsApp or phone, and our reply. Basis: our legitimate interest in answering you, or the contract once you are a client.
  • Foundations checkout. Payment details go straight to Stripe inside the checkout; we never see your card number. We receive your email, the plan, the subscription status and Stripe's reference. Basis: performing the contract. Billing records are kept for six years after the subscription ends because tax law requires it.
  • Your account. Signing in sends a one-time link to your email and sets a session cookie on account.weareoriginate.com. Your site conversation, change requests and reports live there. Basis: performing the contract.
  • Site measurement. Which pages are viewed and which actions are taken, through Google Analytics. Basis: described in the next section, because it depends on your cookie choice.
  • Hosting and security. Cloudflare serves the site and keeps standard request logs (IP address, user agent, URL) for a short period to keep it running and defend it. Basis: our legitimate interest in a working, secure site.

Analytics and your cookie choice

Before you choose, and if you decline, Google Analytics receives cookie-free measurements: which pages are viewed and actions such as sending a form or tapping a phone number, each tagged with a random number that is not stored, so visits cannot be linked together. Google uses the IP address to work out a rough location and then discards it. We rely on our legitimate interest in knowing how the site is used. If you accept analytics cookies, a cookie is set so repeat visits are recognised, and that rests on your consent. Your choice is kept in your browser for 180 days. You can change it at any time from Cookie settings in the footer. Data is processed by Google in the EU and the United States under the UK International Data Transfer Addendum.

  • We run no advertising cookies and no advertising platform receives anything from this site.
  • Google Signals is switched off for our property, so Google does not join your visits to a signed-in Google account for us.
  • Measurement runs only on weareoriginate.com. Page addresses are sent without query strings, and event details never carry your email, a URL or free text.
  • Google Analytics retention, as set on our property: event-level data two months, user-level data fourteen months, reset on new activity.

Who processes data for us

Four providers, each under a contract that limits what they may do with it.

  • Google (Google Analytics): site measurement, as above.
  • Stripe: payments, subscriptions and fraud prevention at checkout.
  • Resend: delivers our email, including diagnostic reports, sign-in links and welcome emails.
  • Cloudflare: hosting, the Turnstile check on the diagnostic form, and the servers behind the account area.

Each of them processes some data in the United States. Transfers out of the UK rest on the UK International Data Transfer Addendum to the EU standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework where the provider is certified under it. We do not sell personal data and we do not share it with anyone else, unless the law requires it.

How long we keep it

  • Diagnostic requests and messages: while we run the report or deal with your enquiry, and for up to two years afterwards so we can pick the conversation back up. Ask and we delete them sooner.
  • Account and subscription records: for the life of the subscription, then billing records for six years as tax law requires.
  • Google Analytics: the retention periods set out above.
  • Your cookie choice: 180 days in your browser, then we ask again.

Your rights

Under UK GDPR you can ask us for a copy of your data, have it corrected or deleted, restrict or object to how we use it, and receive it in a portable form. Where we rely on consent you can withdraw it at any time, and where we rely on legitimate interests you can object. Email hello@weareoriginate.com and we reply within a month. If you are unhappy with our answer you can complain to the Information Commissioner's Office at ico.org.uk.

Changes

When this notice changes in a way that affects what your cookie choice means, the site asks you to choose again. Smaller changes are shown by the date at the top.