Written and reviewed by the Green Arrow Consultancy team, led by Darren Tyler, founder and chief executive.
We sell privacy engineering, so it would be embarrassing to run a site that quietly tracked you. This page describes exactly what happens to data on greenarrow.app, in the order it actually happens.
The published pages of greenarrow.app set no cookies and run no analytics, advertising or third-party trackers. Fonts are served from this domain. The web server keeps standard access logs for security and diagnostics. The interactive AI demonstrations are different: what you type there is sent to a language model provider, so do not put anything confidential in one.
Green Arrow Consultancy Ltd is the data controller for this website. The registered office is Sophia House, 28 Cathedral Road, Cardiff, CF11 9LJ, Wales, United Kingdom. The company number is 12491770 and the VAT number is 344486874. We are registered with the Information Commissioner's Office under registration ZA822868, which you can check on the ICO register.
For any question about this notice or about personal data, email info@greenarrowconsultancy.com or call 029 2117 5902. We do not have a statutory obligation to appoint a data protection officer, and we have not appointed one. Enquiries go to the founder.
This notice covers greenarrow.app. Client work is governed by the contract and the data processing terms agreed with that client, not by this page.
This is the whole list. It is short on purpose.
The demonstrations under the Neuro platform are real applications, not videos. When you type a question into one, that text is sent to our server and then to a large language model provider so a reply can be generated. That is the point of the demonstration, and it is worth being explicit about it.
Please do not enter personal data, client information, credentials or anything confidential into a public demonstration. The demonstrations run on invented sample datasets and exist to show behaviour, not to process real work.
We keep a short usage log for the demonstrations covering the time of the request and a rate limiting counter, so that one visitor cannot exhaust the service for everyone. Demonstration traffic is subject to a per-address hourly limit and a daily total.
Some tools on this domain sit behind a sign-in because they are client proofs of concept rather than public demonstrations. Those hold an account record for the person granted access, consisting of a name, organisation, job title and email address, and a session cookie while signed in. They are not linked from the published pages and are excluded from search indexing.
| What is recorded | Why | Lawful basis | How long |
|---|---|---|---|
| IP address | Security, abuse prevention, rate limiting | Legitimate interests | Rotated on a rolling schedule |
| Requested URL and status code | Diagnosing faults and broken links | Legitimate interests | Rotated on a rolling schedule |
| User agent string | Telling browsers, crawlers and AI agents apart | Legitimate interests | Rotated on a rolling schedule |
| Referring page | Understanding how people arrive | Legitimate interests | Rotated on a rolling schedule |
The site is hosted on our own server infrastructure in the United States. Logs are not used to build a profile of any individual and are not shared.
If you email, call, or use the form on the contact page, we hold your message and contact details in order to answer you. If we go on to work together, that correspondence becomes part of the engagement record. The lawful basis is our legitimate interest in responding to an enquiry, and then performance of a contract.
The form asks for a name and a message, both required, and an email address so a reply is possible. Organisation and the subject dropdown are optional and you can leave them blank. When you submit it, the contents are sent to our own server and emailed to us. The address the submission came from is recorded in that email, which is what lets us deal with abuse of the form.
It sets no cookies. There is no CAPTCHA, no analytics on the submission, and no third-party form service, so filling it in tells nobody but us that you did. Spam is handled by a hidden field that only an automated system would complete, and by a rate limit, rather than by profiling you.
We do not add enquiry addresses to a marketing list, and we do not run an email newsletter from this site. Correspondence is kept while the relationship is live and then for as long as we need it for legal, tax and accounting purposes.
Our email is provided by a mainstream business email provider, and our hosting is on infrastructure we control. Those are the only processors involved in running this website, apart from the language model provider used by the demonstrations.
Under the UK GDPR you have the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object, and rights relating to automated decision making. Nothing on this website makes an automated decision that produces a legal or similarly significant effect.
To exercise any of these, email info@greenarrowconsultancy.com. We will respond within one month. There is no charge unless a request is manifestly unfounded or excessive.
If you are unhappy with how we have handled your personal data you can complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk. We would rather you told us first so we can fix it.
This notice was last updated on 4 September 2026. If it changes materially we will change the date and, where the change matters, say what changed. There is no archive of previous versions, but the site is public and widely archived.
Questions about your own privacy programme belong on the privacy consulting page instead.
The published pages of greenarrow.app set no cookies. There is no analytics, no advertising and no third-party tracking on them. Fonts are served from this domain rather than from a font provider, so loading a page does not tell anyone else that you visited. The only browser storage the pages use is a single sessionStorage entry that remembers you have already seen the opening animation, so it does not replay on every page. It is cleared when you close the tab.
Yes, and this is the part worth reading. The demonstrations under the Neuro section are interactive applications. Anything you type into one is sent to our server and on to a large language model provider in order to generate a reply. A short usage log is kept for rate limiting and abuse prevention. Please do not enter personal data, client data or anything confidential into a public demonstration. The demonstrations run on invented sample datasets.
The web server keeps standard access logs: IP address, timestamp, the URL requested, the HTTP status, the number of bytes sent, the referring page and the user agent string. These are used for security, abuse prevention and diagnosing faults, on the basis of our legitimate interests. They are rotated and deleted on a rolling schedule.
Both arrive in the same mailbox and are used to answer you and, if we go on to work together, to manage the engagement. We do not add enquiry addresses to a marketing list. Correspondence is retained while the relationship is live and then for as long as we need it for legal and accounting purposes.
Your name and message, which are required, and your email address so we can reply. Organisation and the subject dropdown are optional. The submission is emailed to us and the sending address is recorded in that email for abuse prevention. The form sets no cookies, uses no third-party service, and has no CAPTCHA, so nothing about you is shared with anyone else in the process. The lawful basis is our legitimate interest in responding to an enquiry.
Green Arrow Consultancy Ltd, Sophia House, 28 Cathedral Road, Cardiff, CF11 9LJ, Wales, United Kingdom. Company number 12491770. We are registered with the Information Commissioner's Office under registration number ZA822868. Contact info@greenarrowconsultancy.com for any data protection question.
Under the UK GDPR you can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to erase it, object to processing based on legitimate interests, ask us to restrict processing, and ask for portability where it applies. Email us and we will respond within one month. If you are not satisfied you can complain to the Information Commissioner's Office at ico.org.uk.
No. We do not sell personal data, we do not share it for cross-context behavioural advertising, and we run no advertising technology on this site. Our service providers are limited to hosting, email and, for the demonstrations only, a language model provider.
Written and reviewed by the Green Arrow Consultancy team, led by Darren Tyler, founder and chief executive.
We audit consent, cookies, tags and data flows for a living, across estates of hundreds of sites. Tell us what is worrying you.