Privacy Policy

Last updated: 24 October 2026

This Privacy Policy explains how OneLuton ("we", "us", "our") collects, uses, stores, and protects personal data when you visit luton.one, sign up for an account, build a website with us, use our free tools or LutonIQ, or visit a website published using OneLuton. One policy covers every OneLuton product. Where a section applies to only one product, we say so.

We are committed to protecting your privacy and processing your data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

1. Who we are

OneLuton is operated from the United Kingdom and primarily serves people and businesses in Luton and the surrounding area. Our products are the website builder, free business tools, and LutonIQ, a local intelligence assistant at luton.one/iq. For the purposes of UK GDPR, we are the data controller of personal data you provide directly to us (for example, your account details).

When you build a website with OneLuton and your visitors submit data through it (for example, a contact form), you are the data controller of that data and we act as a data processor on your behalf.

To contact us about anything in this policy, including to exercise your rights, use our contact form.

2. What data we collect

Account data

• Name and email address
• Encrypted password (or your account identifier if you sign in with a third-party provider)
• Business name and category, postcode/town (used to personalise your generated site)

Site data

• Content you create or upload: text, images, logos, business information, services, articles, etc.
• Settings and preferences (theme, fonts, layout, published status)

Visitor analytics (for sites you publish)

We provide privacy-friendly analytics for websites built with OneLuton. We log page views with: page URL, referrer, country (derived from IP), browser/device family, and a session identifier. We do not use third-party tracking cookies for this and we do not store full IP addresses or build cross-site profiles.

Contact form & newsletter submissions

When a visitor submits a form on a site you've built, we store the submission so you can access it. The data belongs to you. We do not use it for our own purposes.

LutonIQ (only if you use it)

• The questions you ask, any topic you pick, and the answers generated
• If you are signed in: your saved research, linked to your account
• If you are signed out: a one-way hashed code made from your network address and browser type, used only to apply the daily question allowance. We cannot reverse it to identify you.

Please do not include sensitive personal details (such as health, finances or other people's information) in your questions. You do not need them to get useful answers.

Technical data

• Authentication session cookies (to keep you signed in)
• Browser type, operating system, and approximate location for security and abuse prevention

3. Why we use your data and the lawful basis

4. AI-generated content

When you use AI features to generate site content, the business details you provide (name, category, location, description) are sent to our AI provider strictly to generate your site. We do not use your input to train AI models, and our providers are bound by contractual terms preventing them from doing so.

LutonIQ: your question, together with relevant extracts from our curated local knowledge base, is sent to our AI provider to produce an answer. The same no-training terms apply. Answers are general information, not professional advice.

5. Who we share your data with

We never sell your personal data. We share it only with the trusted providers we rely on to run the service, for hosting, data storage and security, sign-in, AI content generation, and delivering transactional emails such as sign-in and password resets. Each provider processes your data only on our instructions and only what is needed to provide the service.

We may also disclose data if required by law, court order, or to protect our rights and the safety of users.

6. International transfers

Where personal data is transferred outside the UK, we rely on the UK's adequacy regulations or use the UK International Data Transfer Agreement / EU Standard Contractual Clauses with additional safeguards.

7. How long we keep your data

• Account data and saved tools: while your account is active. Successful account deletion removes your profile, saved invoices, quotes, customers, tool profile and numbering from active storage. There is no account recovery option.
• LutonIQ research: signed-out chats stay in your browser tab and clear when you close it. Saved research stays in your account until you delete it or your account. Allowance codes are kept only as long as needed to apply daily limits.
• Site content: while the site exists. Site deletion removes website records; account deletion removes all your websites and owned uploads, including review photos.
• Website submissions and reviews: while the website exists, unless removed earlier. These records are removed with the website or account.
• Analytics data: retained for up to 24 months while the website exists, and removed with the website or account.
• Billing records: 6 years (UK tax law).

Downloaded files, copies shared with others and browser data on other devices cannot be erased remotely. Backups, security logs and support correspondence may remain subject to operational or legal retention; account deletion does not promise their immediate erasure. Contact us for a wider deletion request or retention details.

8. Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data ("right to be forgotten")
• Restrict or object to processing
• Receive your data in a portable format
• Withdraw consent at any time (where consent is the basis)
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, use our contact form. We will respond within one calendar month.

9. Security

We protect your data with industry-standard measures: HTTPS everywhere, encrypted passwords, encryption at rest, role-based database access (Row Level Security), principle-of-least-privilege for staff, and regular security reviews.

10. Children

OneLuton is not intended for children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with data, contact us and we will delete it.

11. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email or via a notice in the product. The "Last updated" date at the top of this page will always reflect the latest version.

12. Contact

Questions, requests, or complaints: use our contact form.