The small print

Privacy statement

Last updated 18 September 2026

Who we are

Your Business Today Ltd, a company registered in England and Wales under number 17329446 with its registered office at 8 Eastleigh Close, Sutton, England, SM2 6QY, is the data controller for the personal information handled by yourbusiness.today and by our consultancy. For anything in this statement, write to consulting@yourbusiness.today.

The promise, stated once here and meant everywhere: what we learn about your business is used to do your work and nothing else. It is never sold, never pooled with another client’s, never used to train anything for anybody else, and it leaves with you when you go.

What we hold

We hold these kinds of information:

• Account details — the email address we invited, a display name, and the password you set.
• Client register records — the businesses we work with or hope to, the people named as contacts, their role and contact details, and the history of our dealings with them.
• Enquiries — the name, email address, company, website and message sent through the contact page, which becomes a lead in that register.
• Portal content — the projects, goals and tasks we run for your business, the requests your people raise, the messages on each thread, and the files attached to them.
• What you give us during an engagement — the documents, exports and working material you hand over so that we can understand how the business runs.
• Activity records — notifications, the API tokens and authorisations you grant, and a log of what changed and who changed it. We take no card payments on this site, so we hold no card details at all.
• Technical records — server logs carrying an IP address and browser details, kept briefly for security.

Why we use it, and the lawful basis

We use it to do the work you have engaged us for and to run the portal around it: signing you in, carrying your requests, keeping the record of a project, and sending the service emails a piece of work needs. The lawful basis for that is performing our contract with you or with your business.

We rely on our legitimate interests to keep the service secure, to reply to enquiries and maintain the client register, and to correspond as any business relationship requires. We rely on legal obligation to keep the records that tax and accounting law demands. Where we need consent for anything else we will ask at the time, and you can withdraw it.

We do not advertise to you, we do not profile you, and we do not sell your information to anybody.

AI processing

Parts of the portal are generated by AI. When that happens, the material needed to produce the output — your message or request and the relevant part of the project record — is sent to Anthropic’s Claude API, which processes it to produce the reply and does not use it to train models for anybody else.

Who processes it for us

A small number of providers process data on our behalf:

• Supabase — the database, the sign-in, and the storage where attachments and documents live.
• Vercel — hosting of the application.
• Anthropic — the AI processing described above.
• Resend — sending the service’s emails, such as invitations and enquiry notifications.

International transfers

Some of those providers process data outside the United Kingdom, principally in the United States. Where they do, the transfer is covered by the United Kingdom’s adequacy regulations or by the International Data Transfer Agreement or Addendum approved by the Information Commissioner, together with the provider’s own commitment to the same standard of protection.

Who else can see it

Inside your business, the contacts you have named see the projects and requests we run for you. Inside ours, our staff see the client register, and a member of staff sees a project only if they own it or have been put on its team. Nobody outside those two groups sees your work, and we disclose information beyond them only where the law requires it.

If your business named you as a contact

You may be reading this because somebody else brought you here: your business named you as a contact so that you could use the portal. This part is for you.

We hold your name, email address, phone number and role as your business gave them to us, along with the requests you raise, the messages you write and the files you attach. The other contacts at your business and the staff working on your projects can see them. Where the portal generates something from a thread, that thread goes to Anthropic as described above.

You have the same rights as anybody else named in this statement. If you would rather not be a contact, tell your business and they can remove you — or write to consulting@yourbusiness.today and we will.

How long we keep it

We keep an account while it is in use, and close it when the person it belongs to leaves or the engagement ends. The record of a project — its requests, threads and attachments — is kept for the life of the engagement and for six years afterwards, because that is how long a question about the work can reasonably arrive.

Enquiries and client register records are kept while we are working with, or still hoping to work with, the business concerned, and are reviewed at least every two years. The records that tax and accounting law requires are kept for six years and no longer. Server logs are kept for no more than thirty days.

Your rights

Under United Kingdom data protection law you can ask us for a copy of your information, ask us to correct it, delete it or restrict how we use it, object to our use of it, and receive it in a portable form. Write to us and we will answer within a month.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so that we can put it right.

Cookies

We use only the session cookies that keep you signed in and the portal working. They are strictly necessary, which is why no banner asks you to accept them, and there are no advertising or third-party tracking cookies on this site.

Changes to this statement

If the way we handle information changes, this statement changes with it and the date at the top tells you when. Anything material will be flagged on the site or by email.