Privacy Notice

Lornets is a production assurance and engineering practice operating from London, United Kingdom. We work with organisations whose software has become commercially or operationally important.

Lornets is the controller for the personal information described in this notice. The registered legal entity details, and any data protection registration details that apply, will be published here once confirmed.

We collect only what we need to understand and respond to a business enquiry. Depending on what you send us, that may include:

• Identity and business contact information, such as your name, work email address and the organisation you represent.
• Company information, such as your company website.
• The reason you are contacting Lornets.
• The technical or commercial decision you are trying to make.
• Your timing.
• Optional technology information about your stack.
• Optional additional context you choose to provide.
• Information about where the enquiry originated, such as the page you started from and the referring source.
• Product or application URL, if you provide one through the contact form.
• Booking information, once meeting booking functionality is introduced.

Please do not submit passwords, credentials, source code, customer datasets, security secrets or payment card information through any public form on this website. We do not ask for these, and we do not need them in order to respond to you. Sensitive technical material is exchanged only under a written agreement that includes confidentiality terms.

We use personal information for a narrow set of purposes:

• Responding to business enquiries.
• Evaluating whether a prospective engagement is appropriate for both sides.
• Arranging and managing prospective client conversations, once booking functionality is introduced.
• Maintaining records of prospective business relationships.
• Providing requested services where an engagement proceeds.
• Protecting this website and its forms against misuse.
• Maintaining website and information security.
• Meeting legal and regulatory obligations.
• Handling data protection rights requests and complaints.

We do not use personal information for behavioural advertising, profiling or newsletter marketing.

For ordinary business to business enquiries and prospective commercial relationships, we rely on our legitimate interests in responding to business communications you have asked us to respond to, evaluating prospective engagements, managing reasonable business relationships, and operating and securing our website and systems. We consider this proportionate because the information involved is business contact information, provided deliberately, for a purpose you initiated.

Where processing is genuinely necessary to take steps at your request before entering into a contract with you as an individual, we rely on that contractual basis. We do not treat every employee of a prospective corporate customer as a party to a contract.

Where we must process information to comply with a legal or regulatory duty, we rely on legal obligation.

We do not treat the submission of a form as consent to unrelated processing. Where we ever rely on consent for a specific purpose, we will ask for it separately and you will be able to withdraw it.

When you request a readiness call, we record the details you enter so that we can assess the enquiry and prepare properly for the conversation. Depending on what you submit, that record may include:

• Full name and work email address.
• Company name, and company website if supplied.
• The trigger for the enquiry.
• The decision you are trying to make, including any free text context you write.
• Your timeline.
• Technology stack, if supplied.
• Additional context, if supplied.
• The service context you started from, the entry page and the referring source.
• Booking related information, once meeting booking functionality is introduced.
• Pseudonymised connection information, held as a one way hash, used for abuse prevention and rate limiting.

These records are stored in our managed database with access restricted to Lornets. They are not sold, and they are not shared with advertising platforms.

The contact form is operational. When you send an enquiry, we record the details you enter so that we can understand and answer it. Depending on what you submit, that record may include:

• Name and work email address.
• Company, and company website if supplied.
• Product or application URL, if supplied.
• The driver behind the enquiry, the stage you are at, your main concern and your timing.
• The entry page and the referring source.
• Pseudonymised connection information, held as a one way hash, used for abuse prevention and rate limiting.

Contact enquiries are stored in the same managed database, with access restricted to Lornets, and are notified to us by transactional email so that we see them promptly.

To protect our forms from automated abuse we record limited technical information alongside an enquiry, including a one way hashed representation of the network address the submission came from and basic browser identification. This is used to detect repeated or automated submissions, not to identify or track individuals across websites.

Our hosting and database providers process technical logs as part of running the service.

We do not sell personal information and we do not share it with advertising networks. Lornets remains the controller for the information described in this notice. We rely on a small number of service providers, each processing personal information on our instructions rather than for their own purposes:

• Supabase. Database hosting and backend infrastructure for readiness call and contact enquiry records. Processor acting on our instructions.
• Resend. Transactional email delivery for internal enquiry notifications and visitor acknowledgements. Processor acting on our instructions.
• Google Workspace. Business email, including receipt and handling of correspondence sent to our mailboxes. Processor acting on our instructions.
• Calendly. Scheduling of readiness calls on Calendly's own booking page, which you reach by choosing to book a time. Processor acting on our instructions.
• Plausible Analytics. Aggregate website usage and conversion measurement, without cookies, advertising or behavioural profiling. Processor acting on our instructions.
• Lovable. Website hosting and the development runtime that serves lornets.com. Processor acting on our instructions.

Emails you receive from us in connection with an enquiry, such as an acknowledgement that we have received it, are service communications about that enquiry. They are not a marketing subscription, and completing a form does not add you to any mailing list.

We may also disclose information where we are required to do so by law, or where it is necessary to establish, exercise or defend legal claims.

We use Plausible Analytics for aggregate website usage and conversion measurement. It reports page views, referral and campaign sources and a small set of commercial interaction events such as a readiness call enquiry being completed. We do not send it your name, email address, company, the content of anything you type into a form, or any record identifier. It is not used for advertising, session recording or behavioural profiling, and it does not introduce a persistent identifier for you on this site. We rely on our legitimate interest in understanding how the website is used and improving it.

We use Calendly to schedule readiness calls. Calendly is not embedded in this website and no Calendly script or cookie is loaded as you browse it. If you choose to book a time, you are taken to Calendly's own booking page, and the name, email address and any answers you enter there are processed by Calendly to create and confirm that booking. The booking link carries only fixed campaign labels and an opaque single-purpose reference, so that a confirmed booking can be matched to your readiness request. It contains no name, email address, company or record identifier. Your readiness form answers themselves remain in the Lornets database described above and are not sent to Calendly.

Our hosting, database, transactional email, scheduling and business email providers may process information outside the United Kingdom. We are completing contractual verification of the processing regions and the transfer safeguards that apply to each provider, and this section will be updated with that detail once it has been confirmed.

We do not claim, ahead of that verification, that all processing takes place in the United Kingdom or that a particular transfer mechanism is in place.

Enquiries that do not lead to an engagement are normally reviewed and deleted around twelve months after the last meaningful business interaction, unless there is an active or reasonably continuing opportunity, the record is needed for a legal claim or obligation, or the relationship has become a client relationship with its own retention requirements.

Client records are retained for the period required by the relevant contract, accounting duties and applicable law.

Qualified future opportunities are reviewed at around the same twelve month point rather than kept indefinitely. Security and abuse prevention information is retained only for as long as reasonably required for that purpose. Review and deletion are carried out as an operational process. We do not claim that deletion happens automatically.

Depending on the circumstances and the lawful basis involved, you may have the right to:

• Ask for access to the personal information we hold about you.
• Ask us to correct information that is inaccurate or incomplete.
• Ask us to erase information where there is no continuing reason for us to keep it.
• Ask us to restrict how we use information while a concern is resolved.
• Object to processing that relies on our legitimate interests.
• Ask for a portable copy of information where that right applies.
• Withdraw consent where processing actually relies on consent.

The right to object matters here. Most of our processing of business contact information relies on legitimate interests, so you can ask us to stop. If you object, we will stop unless we can show compelling legitimate grounds that override your interests, or the information is needed for legal claims.

To exercise any of these rights, contact us at privacy@lornets.com. Not every right applies in every situation. If a right does not apply to a particular request, we will explain why.

Submitting a readiness call request, sending a general enquiry, or booking a meeting once booking is available does not subscribe you to marketing communications. We do not operate a mailing list or newsletter, and we do not add submitted details to advertising audiences.

If Lornets introduces marketing communications in future, that will be a separate and clearly signposted choice.

If you are concerned about how Lornets has handled your personal information, write to privacy@lornets.com. We record data protection complaints, acknowledge them, investigate, and tell you the outcome without undue delay.

You may also complain to the Information Commissioner's Office, the United Kingdom supervisory authority, at ico.org.uk. That right is available to you at any time and is not affected or delayed by raising the matter with us first.

We use technical and organisational measures intended to protect personal information, including restricted access to stored enquiries, encrypted transport and limited data collection. No online service can be guaranteed to be completely secure, and we do not claim otherwise.

This notice will be updated as Lornets and its systems develop, in particular when booking, enquiry delivery or provider transfer details are confirmed. Material changes will be reflected on this page with a revised update date.

For privacy enquiries, data protection rights requests and data protection complaints, contact us at privacy@lornets.com. This mailbox is monitored by Lornets. Lornets has not appointed a statutory Data Protection Officer.

For general business enquiries, use the contact page.

See also our cookies and storage technologies notice.