How we handle personal data collected through this website.
Last updated: 24 August 2026
This notice explains what personal data Winder.AI collects from visitors to winder.ai, why we collect it, who we share it with, and the choices you have. It covers this website only. If we process personal data on behalf of a client as part of a consulting engagement, that processing is governed by the contract and data processing agreement for that engagement, not by this notice.
Winder.AI is a trading name of Winder Research and Development Ltd., registered in England and Wales under company number 08762077. Our registered office is Adm Accountants Ltd, Windsor House, Cornwall Road, Harrogate, North Yorkshire, HG1 2PW.
For the personal data described here, we are the data controller.
If you have a question about this notice or about how we handle your data, contact us at phil@winder.ai or write to the registered office above, marked for the attention of Phil Winder.
We collect personal data in three situations.
Our enquiry, newsletter and content download forms are provided by HubSpot. When you submit one, we collect the details you enter, typically your name, email address, company and your message. We use this to reply to you, to send the content you asked for, and, where you have asked to hear from us, to send occasional updates about our work.
The lawful basis is legitimate interests (responding to a business enquiry you initiated) or, for marketing emails, your consent. You can withdraw consent at any time using the unsubscribe link in any email we send.
If you arrived from an advertisement or a campaign link and you accepted advertising cookies, we also attach the campaign details described below to your enquiry, so that we can tell which of our marketing actually helps people find us.
Subject to your cookie choices, we collect standard analytics data: the pages you visit, roughly where in the world you are, which browser and device you use, and how you arrived. Some of this involves cookies and similar technologies, and we only collect it where you have agreed. See the cookies section below.
One point deserves highlighting because it is more intrusive than a page count. If you accept analytics cookies, Microsoft Clarity records a playback of your session, including mouse movement, scrolling and clicks, and builds heatmaps from it. We use this to find broken and confusing pages. Clarity masks text input by default, so it should not capture what you type into a form, but you should not enter sensitive information into any website you would not want recorded. If you decline analytics cookies, no recording is made.
If you email or telephone us, we keep a record of the correspondence so we can handle your enquiry and maintain a history of our relationship with you.
When you first visit, a banner asks for your choices. Nothing in the analytics or advertising categories below runs until you agree, and if you decline, those scripts are never loaded at all. You can change your decision at any time through the cookie settings link in the banner.
Google Analytics and Google Ads are an exception worth explaining. Those tags load on every visit, but until you consent they run in a cookieless mode: they write no cookies to your device and send anonymous, aggregated signals that cannot be tied back to you.
These are required for the site to function and to remember your privacy choices. They do not need consent.
| Cookie or key | Set by | Purpose | Retention |
|---|---|---|---|
__hs_cookie_cat_pref | HubSpot | Records which cookie categories you accepted or declined, so we do not ask again. Declining all three stores the value 1:false_2:false_3:false | Up to 13 months |
__hs_opt_out, __hs_initial_opt_in | HubSpot | Recorded alongside the above in some opt-out flows | Up to 13 months |
wai_consent_deny | Winder.AI | Testing key that forces all optional tracking off | Until cleared |
Used to understand how the site is used, so we can improve it. Loaded only with your consent.
| Cookie or key | Set by | Purpose | Retention |
|---|---|---|---|
_ga, _ga_J7XESVN1L1 | Google Analytics 4 | Distinguishes visitors and sessions to produce usage statistics | Up to 2 years |
_clck, _clsk, CLID | Microsoft Clarity | Session recording and heatmaps | Up to 1 year |
| Ahrefs analytics | Ahrefs | Privacy-focused pageview counting | Session |
__hstc, __hssc, __hssrc, hubspotutk | HubSpot | Identifies a returning visitor and links their browsing to any form they later submit | Up to 6 months |
Used to measure whether our advertising works and to reach relevant audiences. Loaded only with your consent.
| Cookie or key | Set by | Purpose | Retention |
|---|---|---|---|
_gcl_au, _gcl_aw | Google Ads | Attributes a sign-up or enquiry to the advert that led to it | Up to 90 days |
wai_gclid | Winder.AI | Stores the Google click ID so an enquiry can be matched to the advert that produced it | 180 days |
wai_attribution (local storage) | Winder.AI | Stores click IDs (gclid, gbraid, wbraid, msclkid, fbclid), UTM campaign parameters, and the first and most recent page and referrer for your visit | Until you clear your browser storage |
| Factors.ai | Factors.ai | Identifies the company (not the individual) behind a visit, for business-to-business marketing measurement | Up to 1 year |
| Apollo.io | Apollo.io | Website visitor tracking for business-to-business marketing | Up to 1 year |
wai_form_submit_pending, wai_form_submit_prefill and wai_conv_fired_any
are also written to session storage. They exist only to carry a form submission
across a redirect so it is counted once, and they are erased when you close the
tab.
Our banner offers a Functionality category alongside the three above. We do not currently use any functionality or personalisation cookies, so accepting or declining this category makes no difference to what runs on the site. The control is part of the banner software and cannot be hidden. If we ever add a tag of this kind, it will be gated behind that choice and listed here.
We do not sell your personal data. We share it only with the service providers that make the site and our sales process work, each acting under contract:
Some of these providers are based in the United States, so your data may be transferred outside the UK. Where that happens, the transfer is covered by the UK extension to the EU-US Data Privacy Framework or by International Data Transfer Agreements, which are the safeguards UK law requires.
We may also disclose personal data where we are legally required to.
Analytics and advertising data is kept for the retention periods in the tables above, after which it is aggregated or deleted.
Enquiry and contact records in our CRM are kept for five years (1,825 days) from our last meaningful contact with you, after which they are deleted automatically. This is enforced by a retention setting in the system itself rather than by periodic housekeeping, so it happens whether or not anyone remembers to do it.
You can ask us to delete your record sooner at any time, and we will unless we are legally required to keep it. Where we hold records because we have to, such as invoices and other accounting records for a client engagement, those are kept separately for as long as the law requires, currently six years.
Under UK data protection law you have the right to ask us for a copy of the personal data we hold about you, to have it corrected or erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where our use relies on consent. Exercising these rights is free, and we will respond within one month.
To make a request, email phil@winder.ai.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113. We would appreciate the chance to address your concern first.
Declining in the banner is enough on its own: the analytics and advertising scripts are never loaded, so there is nothing further you need to do.
We also honour the Global Privacy Control (GPC) signal. If your browser or extension sends one, we decline every non-essential cookie for you automatically, without you having to touch the banner, and we will tell you we have done so. Because the same decision drives every tag on the site, a GPC signal stops the analytics and advertising scripts from loading at all.
Beyond that, you can block or delete cookies in your browser settings, or install the Google Analytics opt-out add-on.
The policies governing how we handle data inside the company, including our data protection and personal data breach policies, are published on our company policies page.
We review this notice at least annually and update it whenever we add or remove a tracking technology. The date at the top reflects the most recent change.