Privacy notice
Last updated 30 July 2026
This is written the way we would want to read it: short, accurate and in plain English. It describes the technology actually running on this website, not the technology we might add later. If anything is unclear, email us and a person will answer.
Legal review required before launch. BridgeLayer Advisory is not yet incorporated. Until it is, the founders named below act as joint controllers in their personal capacity. On incorporation, the company becomes the controller and its company number, registered office and ICO registration number are added here. Registering with the ICO is a launch blocker before the first paid engagement.
Who we are
This website is operated by the founders of BridgeLayer Advisory, Tushant Rathod and Anish Agrawal, currently acting in their personal capacity during a pre-incorporation period. They are the controllers of the personal data described in this notice. For anything in this notice, contact contact@bridgelayeradvisory.com.
What we collect and why
- Enquiry form. Your name, work email, company if you provide it, and your message. We use these to respond to you. Lawful basis: our legitimate interests in responding to an enquiry you chose to send us.
- Founding Client application. Your name, work email, company, website if you provide it, approximate staff count, current priority, your reason for the review, preferred start window and an optional scanner reference. We also record that you confirmed you are authorised to discuss the engagement and that you had read this notice, together with the time you submitted, so that we can evidence both. We use all of this to assess fit and respond to you. Lawful basis: taking steps at your request before entering into a contract.
- Launch updates. Only if you tick the box, which is never ticked for you. Lawful basis: your consent, which you can withdraw at any time by replying to any update or emailing us.
- Risk scanner. Nine multiple-choice answers. The scanner is designed without free-text questions so visitors are not invited to enter personal or confidential business information. Answers are sent to our own server function and to Anthropic's API to generate your result. If you request a written copy by email, we collect that email address and your result band so we can send it and follow up.
- Booking a call. If you book through Calendly, Calendly collects the details you enter under its own privacy notice.
Analytics and technology
We do not use advertising trackers or visitor-identification technology. We do not build behavioural profiles, we do not run advertising pixels, and we do not use session recording or fingerprinting. A full description of the technology on this site, including the two small preference values we store on your device, is on our cookies and technology page.
We use privacy-conscious aggregate analytics, provided by Plausible, to understand page visits and how far people get through the scanner. It sets no cookies and does not follow you across other websites. We also count a small number of named events, such as a scan being started and completed and which risk band the result fell into. These are counts only. Nothing you typed into a form, and no name, email address, company name or scanner answer, is ever sent to analytics.
Who processes data for us
- Vercel hosts the website and the scanner function.
- Formspree delivers form submissions to our inbox.
- Anthropic processes scanner answers to generate the result text.
- Calendly handles scheduling, only if you choose to book a call.
- Plausible provides cookieless aggregate analytics.
Requires production confirmation. Anthropic states that it does not use commercial API inputs and outputs to train its models by default. The exact retention period depends on the account and API configuration in use. Confirm the production configuration and state it here before launch.
Some providers store data outside the UK. Where they do, transfers rely on recognised safeguards such as UK adequacy regulations or the UK international data transfer addendum to the EU standard contractual clauses. We can tell you which applies to which provider on request. We do not load fonts, images or scripts from third-party servers other than the analytics script named above, so visiting this page does not send your IP address to advertising or font providers.
How long we keep things
Enquiries are kept for up to twelve months after our last exchange and then deleted, unless we go on to work together, in which case engagement records are kept for as long as our professional and tax obligations require. Founding Client applications are kept for up to twelve months. Launch-update contacts are removed at launch unless you have consented to continue hearing from us. Scanner answers are not retained beyond generating your result.
Your rights
You can ask for a copy of your data, ask us to correct or delete it, object to or restrict our use of it, ask us to transfer it, and withdraw consent at any time. Email contact@bridgelayeradvisory.com and we will act promptly. If you are unhappy with how we handle your data you can complain to the Information Commissioner's Office at ico.org.uk.
Changes
If this notice changes we will update this page and the date at the top.