Skip to content

Privacy policy

This page explains what we collect when you visit robotostudio.com, why we collect it, who we work with, and what your rights are.

Questions? If anything here doesn't make sense, email us and we'll explain it like normal people: yo@robotostudio.com

Who "we" are

"Roboto Studio", "we", or "us" means Roboto Studio Ltd, registered in England & Wales.

For anything privacy-related, the data controller is: Roboto Studio Ltd, yo@robotostudio.com

We're responsible for how personal data is collected and used on this website.

What we collect (and why)

We only collect what we need to:

  • Keep the site running on Vercel
  • Understand what's working (and what's not)
  • Reply when you reach out to discuss a project
  • Send you things you explicitly sign up for (like the newsletter)
  1. Things your browser sends anyway

When you visit the site, some information is automatically collected by our infrastructure and analytics:

  • IP address: Security, debugging, rough geographic stats, and, if you send a form, scoring and briefing your enquiry (see "Forms")
  • Browser type and version: Making sure the site works everywhere
  • Device and operating system: Same as above
  • Pages you visit, links you click, time on page: Understanding what content resonates
  • Referrer (how you got here): Knowing which channels actually work

Legal basis: Legitimate interests (running and improving our website, security, debugging).

  1. Forms (contact, "get in touch", etc.)

If you fill out a form on the site, we'll collect:

  • Your name
  • Your email
  • Anything you write in the message box
  • The fact that you ticked the consent box

What we do with it:

  • Reply to your message: Email + internal tools
  • Keep a light-touch record: So we remember what we talked about
  • Improve lead qualification: So we can respond faster and smarter
  • Score and brief leads with AI: AI models read your message, your name, your email's domain and what PostHog holds about your visit, including your IP address, rough location and browser. Code also reads your company's website and searches the web for your company and your role. The result is a short brief and a score for our sales team. It never decides on its own whether we reply

We use Formspark (or equivalent) to handle submissions securely, then our own systems to respond and follow up.

Legal basis:

  • Contract / taking steps at your request (you asked us to contact you)
  • Legitimate interests (running a B2B agency, keeping track of conversations)

Want us to stop? If you ask us to stop contacting you, we will. No questions asked.

  1. Analytics & session recording (PostHog)

We use PostHog to understand how people actually use the site. That includes:

  • Page views and navigation paths: what's getting read
  • Events: form submissions, clicks on key calls-to-action
  • Heatmaps and session recordings: so we can see where people rage-click when something is broken

Where we connect events to a person (for example, capturing your email when you submit a form), this may include:

  • Email address
  • Name
  • High-level site interaction (e.g. "submitted contact form", "subscribed to newsletter")

We do not use this to make automated decisions about you with legal effects. It's there so we can ship a better website and fix UX issues.

Legal basis:

  • Legitimate interests (understanding how people use the site, improving UX, measuring marketing performance)
  • Consent where required (e.g. for non-essential cookies in certain jurisdictions)

Consent controls: What PostHog does depends on where you are and what you choose.

  • Where we don't show a cookie banner and don't offer a reject option (including India and most of the US): PostHog runs in full from your first visit. The way to opt out is to turn on Global Privacy Control in your browser. You can also email yo@robotostudio.com to use your privacy rights, but an email can't turn PostHog off in your browser.
  • In California: there's no banner, and PostHog runs in full from your first visit, until you reject it with "Cookie settings" in the footer or your browser reports Global Privacy Control.
  • Where we show a cookie banner (including the EEA and UK), before you choose: we count page views only. There are no cookies, no session recordings and no form events, and we remove the query string from the page address. To count visitors, PostHog works out a temporary ID on its servers from a hash of the date, your IP address, your browser's user agent and our site address. It removes the IP address and user agent from the stored event, and the ID changes every day. The stored event still holds your browser, operating system, device type, screen and viewport size, timezone, language, the page title, the referring address without its query string, a session ID and a person ID.
  • If you accept: PostHog runs in full.
  • If you reject: PostHog sends nothing after the reject takes effect, and we delete the PostHog cookies already in your browser. Events already queued in your browser when you reject can still leave.
  • If your browser reports Global Privacy Control, wherever you are: PostHog sends nothing at all, and we delete the PostHog cookies already in your browser.

Where we offer a choice, you can change it at any time with "Cookie settings" in the footer.

  1. Newsletter

If you subscribe to our newsletter:

  • Email address (and possibly name): Store with our email provider
  • Opens and clicks: Track basic metrics so we know if the content is actually useful

Unsubscribe anytime via the link in the email or by emailing us directly.

Legal basis: Consent. You can withdraw it whenever you like; we'll stop sending marketing emails. We may keep a minimal record to make sure we don't accidentally re-add you.

Cookies and similar tech

We use a mix of:

  • Strictly necessary: Keep the site functioning, security, basic performance
  • Analytics: PostHog, understanding what's working
  • Preference: Remembering things like closed banners or submitted forms
  • First visit details: We keep the page you landed on, the referrer and any UTM tags in your browser's local storage, whatever you choose in the banner. They leave your browser only if you submit a form, as part of that form

Where the law requires it, we'll:

  • Ask for your consent before dropping non-essential cookies
  • Give you a way to change your mind, with "Cookie settings" in the footer

You can also control cookies from your browser settings.

Where your data lives (and who processes it)

Our site is built with Next.js and hosted on Vercel. That means some technical data (like IP addresses and logs) may be processed in data centres outside the UK/EU.

Third parties we work with:

  • Vercel: Hosting and deployment
  • Vercel Web Analytics and Speed Insights: Counting page visits and page speed, whatever you choose in the banner
  • Vercel AI Gateway: Passing on all the requests we make to AI models
  • PostHog: Analytics, events, heatmaps, session recordings
  • c15t, run by Inth: Keeping a record of your cookie choice, with your browser's user agent and, in some regions, your IP address
  • Formspark: Processing form submissions
  • Cal.com: Booking details, if you book a call
  • TypeSafe and DigitalOcean: Reading lead and job application text, to help us sort it
  • OpenAI and Microsoft Azure: Reading lead text and visit data, to score and brief leads with AI
  • Anthropic, AWS and Google: Reading lead text and visit data, through Claude, as the backup providers for that. Anthropic also reads the questions you ask on our pages
  • Exa: Searching the web with your name and your email's domain, to find your company and your role
  • Firecrawl: Reading your company's website, and searching the web when Exa can't
  • Email & CRM providers: Sending emails, keeping track of conversations

Some of these providers are based outside the UK/EU (particularly in the US).

International transfers: When personal data is transferred out of the UK/EU, we rely on legally recognised safeguards:

  • Standard Contractual Clauses (SCCs)
  • The UK Addendum
  • Additional technical and organisational measures (encryption, access controls)

How long we keep things

We don't keep personal data forever.

  • Analytics data: Per our PostHog configuration, only as long as needed to understand performance
  • Server/security logs: Limited period for security and debugging
  • Contact emails & form submissions: As long as reasonably needed to manage our relationship (sales cycle, project history)
  • Newsletter data: Until you unsubscribe; minimal suppression record after

Legal requirements: If we're legally required to keep something for longer (tax, legal, regulatory), we'll do so, then delete or anonymise it.

Global Privacy Control (GPC)

If your browser reports Global Privacy Control (Brave, Firefox with the toggle on, DuckDuckGo), we treat that as a request to opt out of PostHog analytics and marketing tracking, and PostHog sends nothing at all. You don't need to interact with the cookie banner; the signal is enough. Vercel Web Analytics and Speed Insights still count page visits and page speed. We don't sell or share personal data with third parties for cross-context behavioural advertising, regardless of GPC.

Your rights

If you're in the UK or EU (and we choose to apply these rights globally anyway), you have:

  • Access: Ask what we hold about you and get a copy
  • Rectification: Fix incorrect or incomplete data
  • Erasure: Ask us to delete your data, in certain circumstances
  • Restrict processing: Ask us to limit how we use your data
  • Object: Especially to analytics/marketing based on legitimate interests
  • Data portability: Have some data sent to you in a portable format
  • Withdraw consent: For anything based on consent (like newsletters)

To exercise these rights: Email yo@robotostudio.com. We may need to verify you're actually you before we act.

Complaints

If you're not happy with how we handle your data:

  1. Email us first at yo@robotostudio.com (we'd genuinely like to fix it)
  2. UK residents: Complain to the Information Commissioner's Office (ICO)
  3. EU residents: Complain to your local Data Protection Authority

Security and ISO 27001

We use HTTPS everywhere and work with reputable providers (Vercel, PostHog) that take security seriously. Access to systems is restricted to people who need it to do their job.

We are working towards ISO 27001 certification, which means formalising and independently auditing the way we manage information security.

No system is perfect, but we take reasonable steps to keep your data safe.

Changes to this policy

We may update this policy when:

  • We change analytics or infrastructure
  • Privacy laws change
  • We start doing something new with your data

We'll update the text on this page and change the "last updated" date. If we make big changes, we'll be more explicit about it.

Continued use: If you keep using the site after an update, we'll take that as you having read and understood the new version (or at least scrolled past it).