1. Who we are
Cirql Works Ltd is a company registered in England and Wales under company number 16173373. We are registered for VAT under GB483372767. Our registered office is in Manchester, United Kingdom. We act as the data controller for the personal data described in this policy under the UK GDPR and the Data Protection Act 2018. This policy covers the CirqlWorks group websites and the products we operate under it: PatchBuddy.ai, eCirql, CirqlCRM, PatchScript and JSON Buddy.
2. What information we collect
We collect the following categories of personal data:
- Identity data: name, job title and the organisation you represent.
- Contact data: email address, phone number and postal address.
- Technical data: IP address, browser type, time zone, operating system and the device you use to access our sites and products.
- Usage data: pages you visit, time spent, and links you follow.
- Marketing and communications data: your preferences for receiving marketing from us.
- Project data: information you provide when discussing an engagement, including details of the integrations, platforms and systems you operate.
- Product data: for paid products (CirqlCRM, PatchBuddy.ai), the data you and your users create inside the product, contacts, deals, projects, tasks, messages, attachments. You retain ownership of this data; we process it on your behalf as a data processor.
We do not knowingly collect special category data (health, political beliefs, religion, biometrics) unless you provide it explicitly in the course of a project.
3. How we collect your data
- Direct interactions: when you fill in a form on our sites, email us, sign up to a product, or speak to us on a call.
- Automated technologies: when you browse the sites, we collect technical and usage data via cookies and similar technologies. See our cookie policy.
- Third parties: we use Resend to deliver transactional email, Cloudflare for hosting and security, Stripe for payment processing, and Anthropic as our AI infrastructure provider.
4. How we use your information
We process personal data on the lawful bases of legitimate interest, performance of a contract, consent (where collected), and compliance with legal obligations. We use your data to:
- Respond to enquiries and provide the services or products you've asked us to perform.
- Operate the products you subscribe to (CirqlCRM, PatchBuddy.ai) on your behalf.
- Manage active client engagements and operate the integrations we've shipped under retainer through eCirql.
- Send you marketing communications about our products and services where you have opted in, or where you are an existing customer and the marketing is relevant.
- Improve our websites, our products and the way we communicate.
- Comply with legal, accounting and regulatory obligations.
5. Sharing your data
We share personal data only with trusted third parties:
- Resend: our transactional email provider. Form submissions and product notifications are delivered through Resend.
- Cloudflare: our hosting, content delivery and security provider.
- Anthropic: the model provider behind the AI features in PatchBuddy.ai, PatchScript and CirqlCRM. Inputs to AI features are sent to Anthropic's API for processing only.
- Stripe: our payment processor for paid products. Payment card details are handled by Stripe; we do not store them.
- Professional advisers: accountants, auditors and lawyers, only where they need the data to perform their work for us.
- Government bodies and regulators: only where required by law.
We do not sell your personal data. Ever.
6. International data transfers
Some of our third-party providers (notably Resend, Anthropic and Stripe) operate outside the UK. Where personal data is transferred outside the UK, we rely on appropriate safeguards: UK adequacy regulations where they apply, the International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK addendum.
7. How long we keep your data
We retain personal data only for as long as we need it for the purposes described in this policy. As a general guide:
- Enquiry data (where no engagement or signup follows): up to 24 months.
- Active customer data: for the duration of your subscription or engagement, plus 7 years for accounting and audit purposes.
- Product data after cancellation: retained for 30 days to allow restoration, then deleted, unless legal hold applies.
- Marketing data: until you opt out, then a short residual period to confirm the opt-out is recorded.
- Technical and usage data: minimal at the moment. Our sites do not run analytics or marketing cookies.
8. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you.
- Have inaccurate personal data corrected.
- Have your personal data erased where we no longer have a lawful basis to hold it.
- Object to or restrict our processing of your personal data.
- Withdraw consent at any time where consent is the lawful basis we rely on.
- Request that personal data we hold about you is transferred to you or to another provider.
- Lodge a complaint with the Information Commissioner's Office (ico.org.uk).
To exercise any of these rights, contact us via the privacy form. We will respond within one month.
9. Cookies
We use cookies and similar technologies on our sites. The full list of cookies and how to manage your preferences are set out in our cookie policy. You can change your cookie choices at any time using the .
10. Updates to this policy
We may update this policy from time to time. The current version is dated above. Material changes will be highlighted on this page and, where appropriate, notified to existing customers by email.
11. Contact us
For any question about this policy, your personal data, or how we process it, contact us:
- Privacy contact form
- Post: Cirql Works Ltd, Manchester, United Kingdom
See also: cookie policy, AI policy, terms of agreement.