Privacy Policy

Last revised: 27 September 2026

1. Introduction

This Privacy Policy explains how Pineapple Pixel Ltd, trading as Compound Lab ("Compound Lab", "we", "us", "our"), collects, uses, discloses and protects personal data when you visit compoundlab.ai (the "Site") or contact us. We process personal data in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018 and, where applicable, the EU General Data Protection Regulation (together, "data protection law").

2. Data controller

The data controller for personal data collected through the Site is Pineapple Pixel Ltd, a company registered in the United Kingdom. Enquiries relating to this policy or to your personal data should be directed to dylan@compoundlab.ai.

3. Personal data we collect

3.1 Information you provide. If you contact us by email, we receive your email address and the contents of your correspondence. Where the website enquiry form is enabled, it asks for your name, work email, company or organisation and the context you choose to share. You may also choose to provide your goal, relevant capability and other business context. Please share only information needed for the conversation.

3.2 Information collected automatically. The Site does not load advertising trackers. It uses two measurement services to count page views and clicks on enquiry links in aggregate: Vercel Web Analytics, provided by our hosting provider, which does not use cookies or store IP addresses; and Google Analytics 4, run in Google's Consent Mode with all consent signals set to denied, so it sets no cookies, stores no identifiers and receives only cookieless, IP-anonymised pings. Neither identifies individual visitors, and we do not use advertising or personalisation features of either service. Our hosting and security providers may process technical data, including IP address, request details and browser information, to deliver the Site and protect it against abuse. A short-lived, in-memory request counter may be used to reduce repeated form requests; this is not used for advertising or visitor profiling.

3.3 We do not intentionally collect special category data through the Site, and we ask that you do not submit it.

4. Purposes and lawful bases

We process personal data for the following purposes and on the following lawful bases:

(a) Responding to enquiries. To respond to enquiries submitted through the Site or by email, and to manage the resulting correspondence. Lawful basis: our legitimate interest in responding to business enquiries directed to us.

(b) Providing services. To take steps at your request prior to entering into a contract, and to perform a contract with you. Lawful basis: performance of a contract.

(c) Site operation and security. To operate, secure and improve the Site. Lawful basis: our legitimate interest in maintaining a secure and functional website.

(d) Legal compliance. To comply with legal and regulatory obligations, including tax and accounting requirements. Lawful basis: compliance with a legal obligation.

We do not use personal data collected through the Site for automated decision-making that produces legal or similarly significant effects, and we do not add enquiry contacts to marketing lists.

5. Disclosure of personal data

We do not sell or rent personal data, and we do not share it for advertising purposes. Our website is hosted on Vercel. Email correspondence is processed through our business email services. Where the enquiry form is enabled, the information you submit is delivered to our private Slack workspace so we can respond. Google reCAPTCHA is used for form security only when enabled and loaded by your action. We may also disclose information to professional advisers where necessary, or to authorities where required by law.

6. International transfers

Some of our service providers may process personal data outside the United Kingdom and the European Economic Area. Where they do, transfers are protected by appropriate safeguards recognised under data protection law, including UK adequacy regulations, the UK International Data Transfer Addendum, or the European Commission's Standard Contractual Clauses.

7. Retention

We retain enquiry data for as long as necessary to deal with your enquiry, and for no longer than 24 months after our last contact, unless the enquiry leads to a client engagement. Where you become a client, we retain records for the duration of the engagement and thereafter for the periods required by applicable law, including tax and accounting legislation. Personal data that is no longer required is deleted or anonymised.

8. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls, and a policy of collecting only the data we need. No method of transmission or storage is completely secure, but we take reasonable steps to protect personal data against unauthorised access, alteration or loss.

9. Cookies

We do not use advertising cookies, and our analytics work without cookies: Vercel Web Analytics is cookieless by design, and Google Analytics 4 runs with consent denied, which prevents it from setting cookies. Google's processing is covered by Google's Privacy Policy. Security services may use technical identifiers to protect the Site. If an enabled form offers Google reCAPTCHA, the Google service is not loaded until you choose to load the security check; it may process device information and use cookies under Google's Privacy Policy and Terms of Service. You can contact us by email instead. Fonts and editorial images are served with the Site. Third-party booking or video services are not automatically embedded; following an external link takes you to a service with its own privacy practices.

10. Your rights

Subject to applicable law, you have the right to: request access to the personal data we hold about you; request rectification of inaccurate data; request erasure; request restriction of processing; object to processing based on legitimate interests; and receive your data in a portable format. Where processing is based on consent, you may withdraw consent at any time.

To exercise any of these rights, contact dylan@compoundlab.ai. We will respond within one month. If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ico.org.uk) or, if you are in the EEA, with your local supervisory authority.

11. Client engagements

Where we provide services to a client organisation, personal data processed in the course of that engagement is governed by the service agreement and data processing agreement entered into with that client, not by this policy. A copy of our standard data processing agreement is available on request.

12. Changes to this policy

We may update this policy from time to time. The current version will always be available at this address, with the date of the most recent revision shown at the top of the page.

13. Contact

Pineapple Pixel Ltd, trading as Compound Lab: dylan@compoundlab.ai