Privacy notice

Last updated 8 September 2026

Who is responsible

Lailya.ai is the trading name under which this website is operated. The operator is a sole trader in the United Kingdom rather than a company, so there is no company registration number.

For anything to do with your data, write to hello@lailya.ai.

What happens when you visit

One thing happens without any action on your part, and it involves your IP address, which is personal data even though we never use it to identify anyone.

Our host receives the request. Vercel serves this site and records technical information about requests, including IP addresses, for delivery, security and troubleshooting.

The typefaces are served from this site itself rather than from a font service, so loading them sends nothing to any third party.

What happens if you contact us

The enquiry form is unusual and worth describing precisely. It does not post anything to a server of ours. It assembles a message and opens it in your own email application, which you then send yourself. Nothing leaves your device unless you press send, and your enquiry reaches us the same way any other email does.

If you send it, or write to us directly, we hold your name, your email address, the team size you selected and whatever you wrote.

Providing any of this is voluntary. If you do not send the email, or do not give us an address to reply to, we cannot respond to your enquiry.

Why, and on what legal basis

We use enquiry details to respond to your enquiry and manage the resulting conversation. We do not add them to a general marketing mailing list.

Who else is involved

These providers process data in connection with running this website and its email. Some act as our processors, under our instructions. Others may also process limited data as independent controllers under their own terms, particularly for their own security, abuse prevention and service operation.

• Vercel hosts the site and processes request logs.
• ImprovMX forwards email addressed to our domain.
• Google stores the messages that arrive in the receiving inbox.

Your data is never sold, and it is not shared with advertisers or data brokers.

How long it is kept

Enquiries and the emails around them are kept while the conversation is live, and for up to twenty-four months after the last substantive contact, so that a thread you started can be picked up. After that they are deleted.

Request logs are retained by our host according to its own retention periods, which we do not set. We do not keep a separate copy of them.

You may ask us to delete your information sooner. We will do so where the right to erasure applies, subject to anything we must keep for a legal obligation or for a legal claim.

Cookies and similar technologies

We do not set cookies, and we do not use non-essential storage or access technologies for analytics, advertising or tracking. We use no technology that requires consent under regulation 6 of the Privacy and Electronic Communications Regulations, which is why there is no consent banner. If that ever changes, this notice changes with it, and you will be asked first where the law requires it.

Your rights

Under UK data protection law you can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, or object to processing we carry out on the basis of legitimate interests.

If you object to processing based on legitimate interests, we will consider your objection and stop unless we have compelling legitimate grounds to continue, or need the information in connection with a legal claim.

We normally respond within one month. Where reasonably necessary, that period may begin once we have received the information we need to verify your identity. For a request for access to your personal data, the law may also allow the period to be paused while we obtain clarification that is reasonably required. Longer is permitted in some cases, and we will tell you if that applies.

Complaints

To make a data protection complaint, email hello@lailya.ai with "Data protection complaint" in the subject line. We will acknowledge it within 30 days, look into it without undue delay, keep you informed, and tell you the outcome.

You may also complain directly to the Information Commissioner's Office, at ico.org.uk or on 0303 123 1113. You do not have to raise it with us first.

Data outside the UK

Some of these providers are based outside the United Kingdom, so data reaches them there. What applies to each:

• Vercel is based in the United States. Its data processing terms rely on the European Commission's standard contractual clauses together with the UK International Data Transfer Addendum. Its list of sub-processors is published at security.vercel.com and the terms themselves at vercel.com/legal/dpa.
• Google is based in the United States. The inbox that receives enquiries is with Google, which handles those messages under its own terms.
• ImprovMX stores data for its European customers in data centres in France, operated by OVH, and states that it holds data only for as long as its service is used or until deletion is requested.

Where a transfer is restricted, we rely on the mechanism set out in the relevant provider's terms, which for Vercel is the standard contractual clauses and the UK Addendum. Ask us and we will point you to the current documents.

Changes

If this notice changes, the date at the top changes with it.

This notice describes what actually happens rather than covering every eventuality in the abstract. If anything here is unclear, or does not match your experience of the site, please tell us.