Nothing hidden. Including this page.

The short version

We’re Outside The Box Consulting, a UK cyber security consultancy. Legally, that’s Outside The Box Consulting Limited, registered in England and Wales under company number 16093723, with a registered office at 82a James Carter Road, Mildenhall, IP28 7DE. For anything on this page, we’re the data controller and the person to email is hello@outsidethebox.io.

Our stance is the same one we bring to client work: nothing hidden. Every change we make to this policy is listed at the bottom of this page, dated, in plain English, so you can see what changed and when, rather than a bare “last updated” stamp you’re asked to trust.

And the headline: we count visits without cookies. The only cookies come from HubSpot’s tracking script, which loads only if you press Accept on our cookie banner. Reject, or ignore the banner, and nothing third-party loads and no cookie is set. If HubSpot’s tracking script is not switched on for the site at all, there is no banner, because there is nothing to accept. The rest of this page is the detail behind that.

Find the section that describes you, visitor, correspondent, chat user, client, and read that one. Each tells you what we collect, why, and exactly how long we keep it. The last two sections cover your rights and the short list of companies that process data for us.

You’re visiting this website

Reading this site is about as private as browsing gets. We’re a security firm; a website that quietly harvests its visitors would be a strange advertisement for the day job.

The site is hosted on Microsoft Azure, in an EU/UK region. Like every web server, Azure keeps standard server logs: your IP address, the pages you requested, the time, and your browser’s user-agent string. We use these for security and to keep the site running, spotting abuse, debugging errors, and for nothing else. They’re kept for Azure’s standard retention period and then gone.

Everything on the page is served by us. Fonts, images, stylesheets, all from our own domain. Until you press Accept on the cookie banner, your browser makes no third-party requests just because you opened a page here, which means no third party learns you visited.

We count visits ourselves, without cookies. For each page view we keep the page (without any query string), the website you came from (the domain only, never the full address), a rough screen size (phone, tablet, desktop or wide), the country if our network provider tells us, any campaign tag in the link, and the previous page on this site. We also count a few actions: opening or sending the contact form, following a key link, reaching a section of a page, searching the site’s documents (the term, with anything that looks like an email address, a link or a long number discarded), a page that was not found, and how long a page was open, in bands such as under ten seconds or over three minutes.

What we do not keep: your IP address, any cookie, any identifier for you or your visit, your user agent, the full address of the page you came from, or anything you type into a form. Because nothing identifies you, we cannot tell one visitor from another, and the figures are counts of events, not of people. The records are deleted after six months.

Our counts are sent to our own service on Microsoft Azure, from this site and from outsidethebox.works, which is ours too. If your browser sends a Do Not Track or Global Privacy Control signal, we send no counts at all, show no banner and never load HubSpot.

Cookies and the banner

When HubSpot’s tracking script is switched on for the site, the first visit shows a banner asking whether you accept cookies. Reject and Accept carry the same weight, and the default is no. When it is not switched on, there is no banner and no “Cookie settings” link, and no cookie is set.

If you press Accept, we also load HubSpot’s tracking script. It sets cookies in your browser and shows us which pages lead to an enquiry. If you press Reject, or ignore the banner, HubSpot’s tracking script is not loaded and no cookie is set. You can change your choice at any time with “Cookie settings” in the footer (shown whenever there is a choice to make); rejecting after accepting removes the script and clears HubSpot’s cookies for this site.

We keep your choice on your device, in local storage, so that we do not ask again. It is a word and a date, not an identifier, and it lasts twelve months.

One more honest footnote: the light/dark toggle in the navigation also remembers your choice using your browser’s local storage. That’s a preference saved on your own device, never sent to us or to anyone else, and clearing your browser data removes it.

We do not use Google Analytics, advertising pixels or chat widgets.

You’ve contacted us

If you fill in our contact form, it goes to our own service on Microsoft Azure in the UK. From there it is stored in HubSpot, our customer record system, hosted in the European Union (Germany), and emailed to our inbox. This happens whether or not you accepted cookies, because you asked us to reply.

What we store is what you gave us: your name, your email address, your company if you told us, and your message, plus what the enquiry is about. Nothing is bought in from elsewhere.

Why we store it is equally short: to reply to you, and to manage the relationship if the conversation goes somewhere. That’s “legitimate interests” in UK GDPR terms, you asked us something; we’d like to answer and remember that we did.

The Works demo

If you choose “Try Works” on the contact form, the same applies, with one addition: your name, work email address and organisation also go to our demo service, which emails you a link to confirm the address. You agree to the demo terms on the form before you give us any details; we record that you agreed, when, and which wording you saw.

We use it to set up your demo, to email you about it and to follow up about Works. Our basis is legitimate interests: a business enquiry from someone who has asked to try the product, with your agreement recorded as above.

We send you one email to confirm your address; once you confirm, one saying your demo is ready (and, separately, one from the demo itself with a link to choose a password), and two short emails during the week asking whether you would like a longer trial or to give feedback. When your access ends we tell you so. We send no marketing from this.

Your demo workstream, on our shared demo instance, is yours alone: nobody else, including colleagues at your organisation, can see it, your changes, your name or your email address. Its content resets every 24 hours, so please do not enter real client or personal data. Your access ends seven days after you confirm your address, and the workspace is removed then. The demo runs on a separate server, which receives your name and email address because it has to send you your login link. It keeps an account record for your email address after your access ends, disabled and unusable, because the product cannot delete accounts; on request we overwrite the address with a placeholder.

Demos are for work email addresses. Personal webmail, temporary addresses and forwarding or relay services are refused, and so are more than five active demos at one organisation. The check runs in your browser for your convenience, and again on our service, which is the one that decides. A refusal never affects “Talk to us”: you can send a message from any address.

If the form shows a security check once you reach the last step of a demo request, it is a Cloudflare Turnstile widget that stops automated submissions. It loads only then, not when you open the page, and it is a security function, so it does not use the cookie banner. We set no cookie for it, but Cloudflare receives your request to run the check, including your IP address and browser details, and processes them for that purpose under its own privacy policy.

To have your demo request erased, email support@outsidethebox.io. We will delete your request and your HubSpot contact, and overwrite the demo account’s address by hand.

How long: we keep an enquiry for as long as the conversation lasts, and then review enquiries every year and delete the ones that went nowhere. If you email us once and we never speak again, your details don’t sit in a database for a decade. And no, contacting us does not put you on a mailing list. We don’t have one.

If both our email and HubSpot are unavailable when you send a message, the form tells you so and asks you to email us instead; we do not keep a copy of a message that could not be delivered.

Who sees it: the consultants at Outside The Box, and HubSpot as our processor. We don’t share contact details with partners, pass them to resellers, or trade them for a slot in someone’s webinar. If you contact us, you hear from us, that’s the whole flow.

When you submit the form we send you an immediate acknowledgement by email, with a copy of what you wrote, so you have a record that it arrived.

The same applies if you skip the form and just email hello@outsidethebox.io, same data, same purpose, reviewed yearly.

You’ve used the assistant

The “Ask us anything” button opens an AI assistant that answers questions about this firm using the content of this website. It’s ours, not a third-party chat widget, and it sets no cookies.

Here’s exactly what happens when you send it a question. Your message goes to our service on Microsoft Azure in the UK, which passes it, along with the site’s own content, to Microsoft’s Azure AI service in the UK to generate a reply. It is processed to produce that answer and is not used to train models. We don’t store the conversation: it lives in your browser tab and disappears when you close it. Nothing is logged against you, and there is no transcript for us to read later.

If the assistant can’t help, it offers an “Ask a person” button. That carries the questions you asked into the contact form’s message box, held in your browser’s session storage, never in the web address, never sent anywhere until you press send. It’s cleared the moment it’s used, you can edit or delete every word first, and nothing reaches us unless you submit the form.

We do keep a count of how many questions the assistant answers and how much it costs us to run, numbers only, never the questions themselves, and nothing that identifies who asked.

Because we can’t see the conversation, please don’t put anything sensitive in it, no incident details, no personal data, nothing you wouldn’t say to a stranger. If you want to tell us something real, use the contact form or email us, where a human is on the other end.

The assistant answers from this website and nothing else. It isn’t giving you security advice, it can be wrong, and it will tell you to email us when a question deserves a person. Treat it as a faster way to read the site, not as counsel.

You’re a client

If we work together, we hold more than a contact record, contracts, statements of work, invoices, correspondence about the engagement, and the deliverables themselves. We hold them because we have to run the engagement, bill for it, and stand behind the work afterwards. Legally, that’s performance of a contract, plus our legitimate interest in being able to answer for our advice.

Engagement records are kept for six years after the engagement ends, the limitation period for contract claims in England and Wales. If either of us ever needs to establish what was agreed and what was delivered, the record exists. After six years, it doesn’t.

Anything security-sensitive you share with us during an engagement, architecture diagrams, findings, the things you’d rather your competitors never saw, is governed by the confidentiality terms in our engagement contract, which go well beyond anything this page needs to say. The retention clock applies to it all the same.

Individual contacts at client firms, the people we actually talk to, sit in the same CRM as everyone else, reviewed yearly like any other enquiry. It’s the engagement record that carries the six-year retention, not your inbox history.

One thing we don’t do: we don’t name clients, use their logos, or describe their engagements publicly without written permission. If you’ve seen anonymised examples on this site, that’s why they’re anonymised.

Your rights

UK GDPR gives you rights over your data. Stripped of the legalese, they come to this:

• Ask what we hold. You can request a copy of everything we have about you. Given what you’ve read above, expect a short document.
• Correct it. If something we hold is wrong, tell us and we’ll fix it.
• Delete it. Ask and we’ll erase your data, unless the law makes us keep it, client engagement records inside the six-year window, for instance.
• Object or restrict. You can object to how we use your data, or ask us to pause while we sort out a dispute.
• Take it with you. You can have your data in a portable format to take elsewhere.
• Change your mind. Our own counts need no consent, because they use no cookie and identify no one. HubSpot’s cookies do, and you can withdraw that consent at any time with “Cookie settings” in the footer. To exercise any of these, email hello@outsidethebox.io. No forms, no portals, no proving your identity three ways for a record that contains your name and one email. We’ll respond within a month, as the law requires, usually much faster, because the data is small and the list of places to look is short.

If you think we’ve handled your data badly and we haven’t put it right, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to fix it first, but that’s your call, not a precondition.

Who processes your data

The complete list of companies that process data on our behalf. Most of it sits with Microsoft in the UK, plus HubSpot for enquiries and, only if you accept cookies, its tracking script, and GitHub for the source code.

PROCESSOR	WHAT IT DOES	WHAT IT SEES	WHEN
Microsoft Azure	Hosts this website and sends us your contact-form messages, in a UK region.	Standard server logs, IP address, pages requested, timestamps.	Every visit.
Microsoft Azure AI	Generates the site assistant’s replies, in the same UK region as the rest of our hosting.	The question you type into the assistant. Not used to train models; not stored by us.	Only if you use the assistant.
Microsoft Azure (Log Analytics)	Stores our own cookie-free counts, in the UK.	Page path, referring domain, screen size band, country, campaign tag, and the actions listed above; no IP, no identifier, no cookie.	Every page view, unless you send Do Not Track or Global Privacy Control; deleted after six months.
Microsoft Azure Monitor	Stores the number of questions the assistant answers and what it costs to run, and a note that an enquiry arrived, in the UK.	Numbers and labels only: for the assistant, never the questions or who asked; for an enquiry, its topic, whether it had a message and which route took it, never your name, email or message.	If you use the assistant, or send a form.
HubSpot (EU data centre, Germany)	Our customer record system. Receives your enquiry from our server. If you press Accept, its tracking script also runs in your browser.	Your name, email, company and message. With Accept: pages visited and a cookie identifier.	When you send a form; and, with Accept, as you browse.
Cloudflare	Runs the security check when you ask for a demo. Sets no cookie for us.	Your IP address and browser details, to run the check.	Only when you reach the last step of a demo request.
GitHub	Hosts the site’s source code, including this policy and its change history.	Nothing about you. Visitor data never touches it.	Never sees personal data.

That’s the whole list. No advertising networks, no data brokers, no “trusted partners”. Where a processor moves data outside the UK, it does so under the UK’s approved safeguards, the international data transfer agreement or a UK adequacy decision.

While we’re listing things: we never sell personal data, we never send marketing you didn’t ask for, and we never use client data for anything beyond the engagement it belongs to. If any of that changes, it won’t, this page changes first, in public.

Changes to this policy

Every substantive change to this policy gets a dated line below, what changed, in language you can check against the sections above. If we ever add a processor, a new purpose, or a longer retention period, it appears here and at the top of the page, not buried in a reworded paragraph.

We keep the full history of this page under version control, and we’ll provide the earlier text on request. Nothing hidden isn’t a line we drop when it’s our own paperwork.

v2.0: Counts widened, HubSpot added, cookie choice introduced

We now count a few more things without cookies (key actions, forms opened and sent, sections reached, time on page in bands, searches), kept for six months. Enquiries are stored in HubSpot (EU, Germany) as well as emailed to us. HubSpot’s tracking script loads only if you press Accept on the cookie banner (and there is no banner where it is not switched on). Do Not Track and Global Privacy Control are honoured. Enquiries are reviewed yearly rather than deleted at 24 months. Page counts are no longer kept for 31 days; the raw records go after six months.

v1.1: First-party page counts added

We began counting page views ourselves, page, referring domain, screen size band and country, deleted after 31 days. No cookies, no identifiers, no third-party analytics. Added Microsoft Azure Monitor to the processor list, and noted that we count the assistant’s questions without recording them.

v1.0: First published

Initial policy covering website visitors, enquiries, the site assistant and client engagements.

Questions about any of this? Just ask.