Privacy Policy

Privacy Policy

Last updated 24 September 2026

1. About this policy

This Privacy Policy explains how HIDDEN FORM LIMITED (“Hidden Form”, “we”, “us” or “our”), trading as Tomorrow and Built for Tomorrow, collects and uses personal information in connection with the website at builtfortomorrow.io (the Site) and related business-development activities.

HIDDEN FORM LIMITED is a company registered in England and Wales under company number 16820648. Our registered office is:

FFT Reedham House
31 King Street West
Manchester
Greater Manchester
M3 2PJ
United Kingdom

For the purposes of UK data protection law, HIDDEN FORM LIMITED is the controller of the personal information described in this policy.

If you have questions about this policy, wish to exercise a data protection right, or want to make a data protection complaint, contact us at privacy@builtfortomorrow.io.

The Site is intended for business users and is not directed at children.

2. Information we collect

We may collect the following categories of personal information.

Information you give us

This may include:

  • your name, business email address, telephone number, company and job title;

  • information you provide when you contact us by email or otherwise;

  • information you provide when you book or attend a meeting, including meeting details, guest details and optional notes;

  • feedback, questions and other information you voluntarily share with us; and

  • documents or other materials you choose to provide.

Please do not send us special-category, highly sensitive, confidential or third-party personal information unless it is genuinely necessary and appropriate to do so.

Information we collect from professional and public sources

In the course of researching prospective business relationships, we may collect professional information from sources such as:

  • company websites;

  • professional networking services;

  • public business directories;

  • publicly available industry sources; and

  • introductions or referrals.

This may include your name, job title, employer, professional contact details and information about your professional role.

Website and technical information

When you use the Site, our website and hosting providers may process limited technical information needed to deliver, protect and understand use of the Site, such as IP address, browser or device information, referral information and basic usage data.

We use Framer to host the Site and may use Framer’s built-in analytics to understand aggregate website usage.

If you accept analytics cookies, we also use Google Analytics to understand how visitors use the Site — for example, which pages are viewed, how people arrive at the Site, whether they open our booking form or book a meeting, and approximate location, device and browser information.

If you accept marketing cookies, we use Google Ads to measure which of our ads lead to visits and bookings, and to show our ads to people who have previously visited the Site.

Analytics and marketing cookies are only set if you accept them. See section 8.

Meeting and business-development records

We may create and retain records of our interactions with prospective customers, partners and other business contacts, including meeting notes, correspondence, follow-up actions and our assessment of whether there may be a relevant business relationship.

3. How we use personal information and our lawful bases

We use personal information only where we have a lawful basis to do so.

Responding to enquiries and arranging meetings — Contact details, correspondence and booking information. Lawful basis: our legitimate interests in responding to people who contact us and developing prospective business relationships.

Managing prospective business relationships — Professional contact information, CRM records, correspondence and meeting notes. Lawful basis: our legitimate interests in keeping accurate records of relevant business contacts and following up on genuine business opportunities.

Researching relevant organisations and professional contacts — Publicly available professional information. Lawful basis: our legitimate interests in identifying and understanding organisations and people who may reasonably be relevant to our business.

Preparing, organising and summarising our own research and meeting notes — Notes, correspondence and professional information. Lawful basis: our legitimate interests in operating efficiently and maintaining useful business records.

Operating, securing and improving the Site — Technical and usage information. Lawful basis: our legitimate interests in operating a secure and effective website and understanding how it is used.

Measuring how the Site is used with Google Analytics — Pages viewed, referral source, whether the booking form was opened or a meeting booked, approximate location, device and browser information, and cookie identifiers. Lawful basis: your consent, which you can withdraw at any time (see section 8).

Measuring our advertising and showing our ads to previous visitors (Google Ads) — Ad click identifiers, pages viewed, whether a meeting was booked, and cookie identifiers. Lawful basis: your consent, which you can withdraw at any time (see section 8).

Sending relevant business-to-business communications — Professional contact details and communication history. Lawful basis: our legitimate interests where permitted by law, or consent where consent is required.

Meeting legal and regulatory obligations — Relevant records. Lawful basis: compliance with a legal obligation.

Where we rely on legitimate interests, we consider whether the processing is necessary for the purpose and balance our interests against the rights and interests of the person concerned.

We do not use personal information for solely automated decision-making that produces legal or similarly significant effects.

4. AI-assisted processing

We may use AI tools, including services provided by OpenAI and Anthropic, to help us organise, summarise or analyse our own research, correspondence and meeting notes.

We do not use these tools to make solely automated decisions about individuals that produce legal or similarly significant effects.

We aim to minimise the personal information included in these tools and use them only where reasonably relevant to our business activities.

5. Service providers and other recipients

We use a small number of service providers to operate the Site and manage our business. These may include:

  • Framer — website hosting and website analytics;

  • Calendly — meeting scheduling;

  • Google Analytics — website analytics, only where you accept analytics cookies;

  • Google Ads — advertising, ad measurement and remarketing, only where you accept marketing cookies;

  • Google Workspace — email, calendar and business productivity;

  • Attio — customer relationship management;

  • OpenAI — AI-assisted processing of our own notes, research and business information; and

  • Anthropic — AI-assisted processing of our own notes, research and business information.

These providers may process personal information on our behalf or, in some circumstances, for their own purposes under their own privacy terms.

We may also disclose personal information:

  • to professional advisers where reasonably necessary;

  • where required by law, regulation, court order or a competent authority;

  • to protect our legal rights or the rights of others; or

  • in connection with a genuine corporate restructuring, financing, sale or transfer of all or part of the business, subject to appropriate safeguards.

We do not sell personal information.

6. International transfers

Some of our service providers operate internationally and may process personal information outside the United Kingdom.

Where a transfer is subject to the UK rules on restricted international transfers, we use an applicable lawful transfer mechanism. Depending on the circumstances, this may include UK adequacy regulations or appropriate contractual safeguards such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission’s Standard Contractual Clauses.

You can contact us at privacy@builtfortomorrow.io if you would like more information about the safeguards relevant to a particular transfer.

7. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected.

As a general rule:

  • enquiry, meeting and prospective-business records are reviewed and normally deleted or anonymised within 24 months of the last meaningful interaction if there is no continuing business reason to keep them;

  • related meeting notes and AI-assisted summaries normally follow the same retention period as the underlying business record;

  • where a business relationship becomes active, relevant records may be kept for the duration of that relationship and for an appropriate period afterwards;

  • records needed for legal, regulatory, tax, accounting or dispute purposes may be retained for longer where required or reasonably necessary;

  • Google Analytics data is kept for no longer than 14 months and is then deleted automatically;

  • remarketing audiences keep a visitor for no longer than 540 days after their last visit; and

  • where you opt out of marketing, we may keep limited information on a suppression list for as long as reasonably necessary to respect that choice.

Some service providers may retain technical, security or backup information according to their own documented retention schedules.

8. Cookies, analytics, advertising and booking

When you first visit the Site, we ask whether you accept analytics and marketing cookies. Neither is used unless you accept it, and you can accept one without the other.

Strictly necessary

The Site uses Framer’s built-in website functionality and analytics, and stores your cookie choice so that we do not ask you again on every visit. This storage is strictly necessary and does not require consent.

Analytics cookies (Google Analytics)

If you accept analytics cookies, Google Analytics sets:

  • _ga — distinguishes one visitor from another; expires after 2 years; and

  • _ga_<ID> — keeps track of your session; expires after 2 years.

We also record in Google Analytics when the booking form is opened and when a meeting is booked. We record that the event happened and the page it happened on — not your name, email address or booking details.

Marketing cookies (Google Ads)

We advertise on Google search. If you accept marketing cookies, we use Google Ads to:

  • measure which ads lead to visits and booked meetings; and

  • show our ads, on Google and on sites that partner with Google, to people who have previously visited the Site (remarketing).

For this, the Site sets _gcl_au (links an ad click to a later booking; expires after 90 days), and Google may set or read its own advertising cookies on Google domains. We share audiences of past visitors with Google Ads through Google Analytics; these do not identify you to us.

You can control the ads Google shows you at myadcenter.google.com. Information about how Google uses data from sites that use its services is available at policies.google.com/technologies/partner-sites.

Changing your choice

You can change or withdraw your choice at any time by clearing this site’s data in your browser, after which we will ask you again. Withdrawing consent does not affect use before you withdrew it.

Booking a meeting (Calendly)

Meetings are booked through Calendly, embedded on the Site. Calendly may use its own cookies and shows its own cookie notice where required. If you arrived at the Site from one of our campaigns, we pass the campaign tags in the page address (such as the source and campaign name) to Calendly with your booking, so we know which campaign led to it.

9. Security

We take reasonable technical and organisational measures designed to protect the personal information we hold against accidental loss, unauthorised access, misuse, alteration or disclosure.

No online service or method of storage is completely secure, and we cannot guarantee absolute security.

10. Your data protection rights

Depending on the circumstances, UK data protection law may give you the right to:

  • ask for access to the personal information we hold about you;

  • ask us to correct inaccurate or incomplete information;

  • ask us to delete personal information in certain circumstances;

  • ask us to restrict how we use personal information in certain circumstances;

  • object to certain uses of your personal information;

  • receive certain information in a portable format where the right to data portability applies; and

  • withdraw consent at any time where we rely on consent.

These rights are not absolute and do not all apply in every circumstance.

To exercise a right, contact privacy@builtfortomorrow.io. We may need to verify your identity before acting on a request.

11. Your right to object

You have the right to object at any time to our use of your personal information for direct marketing. If you object to direct marketing, we will stop using your information for that purpose.

You may also object where we rely on legitimate interests. In those circumstances, we will stop the relevant processing unless we have compelling legitimate grounds to continue or the processing is needed for the establishment, exercise or defence of legal claims.

You can object by emailing privacy@builtfortomorrow.io.

12. Complaints

If you have a concern about how we use your personal information, please contact us first at privacy@builtfortomorrow.io and tell us that you are making a data protection complaint.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

Information about how to complain is available at ico.org.uk/make-a-complaint.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes to the Site, our business activities, the services we use or applicable law.

The date at the top of this page shows when it was last updated.