Legal
Privacy policy
Haystak is a trading name of Cobalt Labs Limited, registered in England and Wales under company number 17347364.
Last updated: 11 August 2026.
This policy explains what personal data we collect when you use this website or get in touch with us, why we collect it, and what your rights are.
Who we are
Cobalt Labs Limited, trading as Haystak, is a bespoke B2B software development company based in Bristol, registered in England and Wales under company number 17347364.
We are the controller of the personal data described in this policy, and we are registered with the Information Commissioner's Office (ICO).
If you have questions about this policy or your data, email hello@haystak.co .
The data we collect
We collect very little, and only what we need.
When you contact us or book a call
Your name, email address, company name, and anything you choose to tell us about your business. We get this directly from you, by email or through our booking form.
When you become a client
Contact details, billing details, and information about your business needed to deliver the software we build for you. Client work is governed by our engagement agreement, which contains detailed confidentiality and data protection commitments.
When you visit this website
Standard technical data such as your IP address, browser type, device type and pages visited.
We do not collect special category data, such as health or political information.
Children and young people
This website and our services are for businesses and the adults who run them. They are not intended for children or young people. Please do not contact us or submit any personal data through this site if you are under 18.
If you are a parent or guardian and believe your child has sent us data, email hello@haystak.co and we will remove it.
Why we collect it, and our lawful basis
| What we do | Why | Lawful basis |
|---|---|---|
| Respond to your enquiry and arrange calls | You have asked us to | Legitimate interests / steps prior to a contract |
| Design, build and support software for clients | To perform our contract with you | Contract |
| Send invoices and keep accounting records | Legal and tax obligations | Legal obligation |
| Keep in touch about our services where you would reasonably expect us to | Running and growing our business | Legitimate interests |
| Keep the website secure and understand how it is used | Running a safe, working website | Legitimate interests |
We do not sell your data. We do not use it for automated decision-making or profiling, and we do not use it to train AI models. If we ever want to send you marketing you have not asked for, we will get your consent first, and every message will include a way to opt out.
Who we share it with
Only the service providers we need to run the business, and only what they need to do their job:
- Website hosting and infrastructure. Our website is built and hosted on Lovable, with assets served via Cloudflare.
- Email and productivity tools. To communicate with you and manage our work.
- Accounting and payment providers. To invoice and keep proper records.
- Professional advisers. Accountants, lawyers and insurers where necessary.
Each provider is bound by contract to protect your data. We never give your data to third parties for their own marketing. If we are required to disclose data by law, a court or a regulator, we will.
Where your data lives
We store data in the UK and the European Economic Area where possible. Some providers process data outside the UK, for example in the United States. Where that happens, the transfer is protected by recognised safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision.
How long we keep it
- Enquiries that do not go anywhere. Up to 12 months, then deleted.
- Client records. For the length of our engagement, then up to six years to meet legal, tax and insurance obligations.
- Accounting records. Six years, as required by law.
When we no longer need data, we delete it securely.
Your rights
You have the right to:
- Access the personal data we hold about you
- Correct anything that is inaccurate
- Delete your data, where we no longer have grounds to keep it
- Restrict or object to how we use it
- Receive a copy of your data in a portable format
- Withdraw consent at any time, where we rely on consent
To exercise any of these, email hello@haystak.co. We will respond within one month. There is no fee unless a request is clearly unfounded or excessive.
If you are not happy with how we have handled your data, you can complain to the ICO at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.
Changes to this policy
If we change this policy, we will update this page and the date at the top. Significant changes affecting how we use your data will be flagged clearly.
Where you live
We are a UK company and this policy is written around UK law. The rights above apply to everyone, but a few jurisdictions give people extra ones.
UK
Your data is governed by the UK GDPR and the Data Protection Act 2018. Our supervisory authority is the Information Commissioner's Office.
European Economic Area
If you are in the EEA, the EU GDPR applies. You have the same rights set out above, and you can complain to the supervisory authority in the country where you live, work or believe the issue happened.
California
If you are a California resident, the CCPA and CPRA give you the right to know what personal information we hold, request deletion or correction, and opt out of the sale or sharing of your data. We do not sell or share personal information, and we do not use it for cross-context behavioural advertising.
Everywhere else
If your local law gives you stronger rights than those described above, those rights still apply. Get in touch and we will honour them.
Contact
Cobalt Labs Limited, trading as Haystak. Registered in England and Wales, company number 17347364. Email hello@haystak.co.