Privacy Policy

Last updated: February 2026

1. Who We Are

XolveLabs Ltd is a deep-tech company incorporated in England and Wales. Our registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We operate the website xolvelabs.com (the "Site"). For any privacy-related matters, contact us at info@xolvelabs.com.

2. What This Policy Covers

This policy explains what personal data we collect when you visit our Site, how we use it, how long we keep it, and your rights in relation to it. It applies to all visitors globally. Where applicable, it addresses requirements under UK GDPR, the EU General Data Protection Regulation, the California Consumer Privacy Act (CCPA), Canada's PIPEDA, and equivalent frameworks in other jurisdictions.

3. Data We Collect

Information you provide directly:

• Name, email address, organisation name, and message when you submit a contact form
• Your self-selected category (e.g. Investor, Researcher, Industry Partner)

Information collected automatically (with your consent):

• IP address and approximate location (city, country)
• Organisation name derived from your IP address via a third-party service
• Referring website or source that brought you to our Site
• Device type, operating system, browser, and screen resolution
• Pages visited, time spent on each section, and scroll depth
• Interactions with buttons, navigation, and forms (including incomplete submissions)
• Number of visits and time between visits

We do not collect biometric data, health data, or any data from children under 16.

4. How We Use Your Data

• To respond to enquiries submitted through our contact forms
• To understand how visitors engage with our Site and improve it
• To identify the types of organisations and individuals interested in XolveLabs
• To personalise certain elements of your Site experience based on visit context
• To maintain records for legitimate business purposes

We do not use your data for advertising. We do not sell your data to any third party. We do not use your data to build profiles for external marketing purposes.

5. Legal Basis for Processing (UK & EU Visitors)

• Consent — for passive tracking (visit data, behavioural analytics, cookies). You may withdraw consent at any time via our cookie settings.
• Legitimate interests — for understanding how our Site is used, improving it, and maintaining basic security logs.
• Contract performance — for processing enquiries you submit through our forms.

6. Cookies and Tracking

We use cookies and similar technologies including browser local storage. A full description of what we set and why is available in our Cookie Policy. You may accept or decline non-essential tracking when you first visit the Site. Declining will disable behavioural analytics but will not affect your ability to use the Site or submit enquiries.

7. Third-Party Services

We use the following third-party services to operate our Site:

• Supabase — database infrastructure for storing form submissions and visit analytics. Data is stored on servers within the EU. Supabase is SOC 2 compliant.
• IPinfo — IP address enrichment service used to derive approximate location and organisation name from visitor IP addresses. No personally identifying data beyond IP is shared.
• Anthropic Claude API — used to generate contextual text shown to certain visitors. No personal data is sent to this service.
• Google Fonts — used to load typography. Google may log font requests. See Google's privacy policy for details.

We do not use Google Analytics, Meta Pixel, or any advertising network tracking.

8. Data Retention

• Form submissions are retained for up to 24 months from the date of submission
• Visit analytics data is retained for up to 12 months
• You may request deletion at any time by contacting us

9. Your Rights

Depending on your location, you may have the following rights:

• Access — request a copy of the personal data we hold about you
• Correction — request that inaccurate data be corrected
• Deletion — request that your data be erased
• Restriction — request that we limit how we use your data
• Portability — request your data in a machine-readable format
• Objection — object to processing based on legitimate interests
• Withdraw consent — withdraw consent for tracking at any time

California residents have additional rights under the CCPA including the right to know what personal information is collected, the right to opt out of sale (we do not sell data), and the right to non-discrimination for exercising privacy rights.

To exercise any of these rights, contact us at info@xolvelabs.com. We will respond within 30 days.

10. Data Security

We implement appropriate technical and organisational measures to protect your data. Our database infrastructure uses encryption at rest and in transit. Access to data is restricted to authorised personnel only. No method of transmission or storage is 100% secure; we cannot guarantee absolute security but we take our obligations seriously.

11. International Data Transfers

We are a UK-based company. If you are visiting from outside the UK or EU, your data may be transferred to and processed in the UK. We ensure appropriate safeguards are in place for any international transfers in accordance with applicable law.

12. Changes to This Policy

We may update this policy from time to time. Changes will be posted on this page with an updated date. Continued use of the Site after changes constitutes acceptance of the updated policy.

13. Contact