mDOS Privacy Policy

Version: Not numbered
Last updated: 18 October 2026

Archived version. See all archived versions.

Archived version. This is the version dated 18 October 2026, kept for reference after Version 3.0 replaced it on 21 October 2026. It no longer applies. The current version is at mdos.ai/privacy.

This Privacy Policy explains how MDOS AI LTD (“we”, “us”, “our”) collects, uses, stores, and protects personal data when you use the mDOS platform (“the Platform”) at app.mdos.ai.

MDOS AI LTD is a limited company registered in England and Wales under company number 17526969, with its registered office at 3 Warren Close, Brighton, BN2 6DT, United Kingdom. MDOS AI LTD builds, operates and provides the mDOS platform.

We have not appointed a statutory Data Protection Officer, as we are not required to do so under UK GDPR Article 37. Data-protection matters are handled by Ross Crawford, Founder; contact privacy@mr-digital.co.uk.

Mr Digital Ltd, our Founding Partner Agency, is a separate company. If you are looking for the privacy policy for its website (mr-digital.co.uk), please visit mr-digital.co.uk/privacy.

1. Definitions

“Platform” means the mDOS Master Digital Operating System & AI Growth Engine accessible at app.mdos.ai and any associated services, APIs, and tools.

“Client” means any individual or organisation that creates an account on the Platform or accesses the Platform through a managed partnership with an mDOS Expert Partner.

“Client Data” means all content, data, files, and information that a Client or their authorised users upload, create, or store on the Platform. This includes but is not limited to: website pages, blog posts, images, documents, contact records, form submissions, email campaign data, CRM records, brand assets, and configuration settings.

“End User” means any individual who visits a website powered by the Platform.

“Authorised User” means any individual granted access to the Platform dashboard by a Client.

“Personal Data” has the meaning given in the UK General Data Protection Regulation (UK GDPR).

“Data Controller” means the entity that determines the purposes and means of processing personal data.

“Data Processor” means the entity that processes personal data on behalf of the Data Controller.

2. Our Role in Data Processing

2.1. Platform Account Data: When you create an account and use the Platform dashboard, we act as the Data Controller for your account information (name, email, login credentials, usage data).

2.2. Client Data: When you use the Platform to collect and manage data about your own customers (e.g., CRM contacts, form submissions, email subscribers), you are the Data Controller and we are the Data Processor. We process this data solely on your behalf and according to your instructions. Our obligations as a Data Processor are set out in our Data Processing Agreement.

2.3. End User Data: When visitors browse websites powered by the Platform, cookie and analytics data may be collected. The Client (website owner) is the Data Controller for this data. We process it on their behalf.

2.4. WiFi Portal Data: When customers connect to your WiFi through the mDOS captive portal, your business (Client) is the Data Controller and we are the Data Processor for the customer data collected (name, email, phone, date of birth, consent preferences).

2.5. Website Intent, Intent Pixel and B2B Enrichment Data: When a Client switches on the Platform’s Website Intent Tracker, Intent Pixel, outreach, Digital PR or contact-enrichment features, the Client is the Data Controller for the resulting visitor, prospect and contact records and we are the Data Processor. These features are described in sections 3.5 and 3.6.

2.6. Our Own Websites and Business Development: Our own websites (including mdos.ai) load the same mDOS website scripts as Client sites, and we may use the Platform’s Website Intent, outreach and enrichment features for our own business development. Where we do, MDOS AI LTD is the Data Controller for that processing, and this Privacy Policy is our notice to the people concerned.

2.7. Error Tracking Data: For application error data captured by our error tracking system (Sentry), we are the Data Controller. This data contains error stack traces and request context — never personal data. Email addresses are automatically redacted from error reports.

3. What Data We Collect

3.1. Account Data (we are the Controller):

Full name
Email address
Authentication credentials (hashed password, OAuth tokens where applicable)
IP address and approximate location
Browser type and device information
Login timestamps and session data
Role and permission assignments
Activity log entries (actions taken within the Platform)
Product analytics, only with your analytics consent: pages and features used, identified by your internal user ID, role and a one-way hash of your email address (processed by PostHog; IP address capture is disabled)

3.2. Client Data (Client is the Controller, we are the Processor):

The categories below vary by which modules your account has enabled — module-specific categories (WiFi portal, booking/reservation, point of sale) only apply if that module is active on your account.

Website content (pages, blog posts, case studies, services, etc.)
Media assets (images, documents, videos uploaded to the Media Library)
CRM records (contact names, email addresses, phone numbers, company associations, tags, notes, deal information)
Form submissions (any data submitted through forms built on the Platform)
Email campaign data (recipient lists, email content, open/click tracking data)
Testimonials and team member profiles
Brand settings and configuration data
Promotions, events, and resource content
SEO settings, redirects, and analytics configuration
Activity logs and audit trail data
WiFi portal data (name, email, phone, date of birth, marketing consent, device MAC address, session timestamps)
Loyalty programme data (membership records, points balance, tier status, points earned/redeemed, rewards claimed)
Event and ticketing data (tickets purchased, payment amounts, QR code identifiers, check-in timestamps)
Booking and reservation data (dates, party sizes or attendee counts, room or resource selections, rate plans, special requests, dietary requirements, deposits, calendar sync tokens encrypted AES-256-GCM)
Point of sale data (order records, items ordered, payment methods, terminal reader identifiers)
Customer portal data (portal login tokens hashed SHA-256, email preferences, GDPR data export/deletion requests)

3.3. End User Data (Client is the Controller, we are the Processor):

Cookie consent preferences
Analytics data (page views, sessions, referrers) if the Client has configured tracking
Form submission data (when an End User completes a form on a Client's website)
IP addresses (for security, rate limiting and abuse prevention)
Where the Client has enabled the relevant features, website visitor identification and engagement data as described in section 3.5

3.4. AI-Processed Data:

The Platform uses third-party AI providers — principally Google Gemini and Anthropic Claude, and OpenAI for specific features (image generation for SEO article illustrations, the voice agent, and as an optional text model an operator can select) — for the following purposes:

Sentiment analysis of customer reviews (processing review text to determine positive/negative/neutral sentiment)
Content generation assistance (generating draft text for marketing, descriptions, and emails based on Client instructions)
AI-powered insights in reporting dashboards (analysing aggregated data to generate narrative summaries)
Voice agent interactions (processing speech-to-text and generating responses for business telephone enquiries)

AI processing is performed on Client Data solely to provide Platform features. We do not use Client Data to train AI models, and our providers do not use it to train theirs. Requests are routed between providers based on the task, so a given request may be processed by Google Gemini, Anthropic Claude or OpenAI; in each case the data is processed under that provider's enterprise API terms and is excluded from model training. Clients can disable AI features per account via module settings.

3.5. Website Visitor Identification (Website Intent Tracker and Intent Pixel):

Where a Client (or we, on our own websites) switches these features on, the mDOS website script identifies which organisations are visiting a website so that business-to-business sales teams can see which companies are researching them. It is designed to identify organisations, not individual people. It processes:

IP address. The visitor’s IP address is read by our servers from the connection (it is not sent by the page itself) and is looked up at the moment of the visit against an IP-range reference table held inside the Platform, compiled from public internet-registry data and, where a Client has configured one, a licensed business IP dataset. Visits from home broadband and mobile networks are not attributed to an organisation from their IP address. The IP address is not written to the Website Intent records — not in full, truncated or hashed — and no visitor IP address is sent to any third-party lookup service. IP addresses are personal data under the UK GDPR and EU GDPR, including when they belong to a business network, which is why we treat this lookup as processing of personal data even though its output is an organisation.
Browser user-agent. Used to filter out bots and reduced to a browser family (for example “Chrome”), which is stored with the visit.
Visit and engagement data. Pages viewed, time on page, referring website, campaign (UTM) parameters and the country associated with the organisation’s IP range. If the Intent Pixel is enabled, also scroll depth, video progress, clicks on buttons and outbound links, form-field focus and abandonment, and booking-funnel steps. Form input values are never read; button labels are captured only as short text with email addresses and long digit sequences removed.
Organisation data. The name, website domain, network owner and, where available, industry, size band and company registration number of the organisation identified. Industry and size are looked up by the organisation’s own domain from UK Companies House and, only where the Client has separately opted in, Apollo.io — never by a visitor’s IP address.

Identifying individuals. The Website Intent feature does not identify individual people by itself. A visit is linked to a named person only where that person has already identified themselves to the website operator — by submitting a form or clicking a tracked email link — and has accepted cookies. Without that consent, no person is linked.

Cookies and consent. By default these features wait for the visitor’s cookie consent. A Client may instead run them in a cookieless mode, in which the script reads and writes no cookies or browser storage and visits are grouped by an anonymous key that changes every hour. The cookies and storage keys involved are listed in section 11.

Cookie-banner answer counts. So that a website operator can see whether their cookie banner is working, the mDOS script sends one short message when the banner is shown and one when the visitor accepts or declines it — including when they decline. The message contains only the website operator’s account reference, which consent tool answered and the answer. It contains no cookie, identifier, page address or browser details (the page address is not even sent as a referrer), and nothing is read from or written to the visitor’s device to send it beyond the cookie choice itself. It also records whether mDOS was able to see an acceptance, so the website operator can tell a banner that is connected from one that is not. Our servers keep only an hourly count per website operator, deleted after 14 days. The IP address the message arrives from is used only to protect the service from abuse (rate limiting): our rate-limiting provider holds it for no more than a few minutes, and it is never stored with the count or used to identify an organisation. The legal basis is our and the website operator’s legitimate interest in running and demonstrating a working consent process.

Third-party IP lookups. The Platform contains a paid third-party IP-lookup tier, but it is disabled for every account and cannot currently be switched on. If we ever enable it, we will update this Privacy Policy and our Sub-Processor list first.

3.6. B2B Contact and Company Data We Obtain From Other Sources:

Some Platform features — SEO link-building outreach, Digital PR media-contact lists and Website Intent account enrichment — obtain publicly available business contact and company data from third-party data providers rather than from the person concerned. This section is our notice under Article 14 of the UK GDPR and EU GDPR.

What we obtain about people: name, business email address, job title and LinkedIn profile URL, together with the company or website domain they are associated with. We do not request personal email addresses or telephone numbers from these providers.
What we obtain about organisations: company name, domain, industry, employee-size band, registration number and company status.
Sources: Apollo.io and Hunter.io (business contact data for a given website domain), UK Companies House (public company register) and, for Digital PR, publicly available newsroom and media pages. Clients may also import contact lists they have obtained themselves (for example exports from prospecting tools), in which case the Client is responsible for the source.
What the provider receives from us: the website domain or company name being looked up (and, for Apollo.io, the provider’s own identifier for a person whose business email is being retrieved) — not your customers’ data.
Purpose: business-to-business prospecting — finding the right person at an organisation to contact about a relevant business matter (for example a link placement, a press story or a service) — and enriching CRM records.
Lawful basis: legitimate interests (section 5.2). We do not treat people whose details are obtained this way as having given marketing consent.
Your choices: every outreach email sent through the Platform gives you a way to opt out — either instructions and a privacy link in the sender’s own email signature, or a short footer with the sender’s privacy-policy link and a “reply ‘unsubscribe’” line; the sender chooses which before a campaign can start. You can also object or ask for your details to be removed at any time using the B2B contact-removal route in section 8.

3.7. Data We Do NOT Collect:

Payment card information (all payments are processed by Stripe — card data never touches mDOS servers)
Passwords in plain text (passwords are hashed using bcrypt with 12 rounds and never stored or logged in plain text)
Data from Client websites beyond what is stored in the Platform

4. How We Use Your Data

4.1. Account Data — we use this to:

Provide and maintain your Platform account
Authenticate your identity
Manage roles and permissions
Display activity in the audit log
Send essential service communications (e.g., password resets, security alerts, system notifications)
Monitor Platform performance and diagnose technical issues
Improve the Platform based on usage patterns (aggregated and anonymised)
Comply with legal obligations

4.2. Client Data — we use this solely to:

Store and serve content on your websites
Process and display CRM records, form submissions, and email campaigns as you instruct
Generate activity logs and audit trails
Provide data export functionality
Perform automated tasks you configure (e.g., scheduled publishing, email automation, campaign scheduling)
Provide technical support when you request it

4.3. Website Intent and B2B Contact Data — used to:

Show sales teams which organisations are visiting their website, how engaged each organisation is, and a score and band (Hot, Warm or Cold) based on that engagement
Allow an organisation to be added to the CRM as an account or sales lead
Find an appropriate business contact at an organisation and send business-to-business outreach, with a way to opt out in every email
Measure whether outreach emails are opened and their links clicked, so that follow-up steps can be scheduled or stopped

4.4. We will NEVER:

Sell or rent personal data, or share your personal data or Client Data with third parties for their own marketing purposes
Use Client Data for our own marketing or analytics purposes
Access Client Data except to provide the service, perform maintenance, or respond to a support request
Train AI models on your Client Data

5. Legal Basis for Processing

Under the UK GDPR, we rely on the following legal bases:

5.1. Contract Performance (Article 6(1)(b)): Processing Account Data is necessary to provide the Platform service you have signed up for.

5.2. Legitimate Interests (Article 6(1)(f) UK GDPR and EU GDPR): We rely on legitimate interests for:

Monitoring Platform security, preventing abuse, and improving the service.
Website visitor identification (section 3.5): the interest is understanding which organisations are engaging with a business’s website so that it can follow up with relevant organisations.
B2B contact data and commercial outreach (section 3.6): the interest is contacting people in their professional capacity about matters relevant to their role and their organisation.

Balancing. We have weighed these interests against the rights and freedoms of the people concerned and consider them not overridden because: the processing concerns people in their professional capacity and uses business rather than private contact details; website identification is aimed at organisations, the IP address is used only transiently for a lookup inside the Platform and is not stored, and individuals are linked to a visit only where they have already identified themselves and accepted cookies; data from third-party providers is limited to business contact fields; every outreach email carries an unsubscribe link; and retention is limited (section 7). Where a Client operates these features as Data Controller, the Client is responsible for its own legitimate interests assessment, and we provide the information it needs to carry one out.

Right to object. You can object to processing based on legitimate interests at any time (Article 21). An objection to direct marketing, including B2B outreach, is absolute: once you object, we stop using your data for that purpose. See section 8.

Electronic marketing (PECR). Under the Privacy and Electronic Communications Regulations 2003, unsolicited marketing emails to individual subscribers — which includes sole traders and some partnerships — require prior consent (unless the “soft opt-in” applies). Emails to corporate subscribers (for example, an employee at a company’s business email address) may be sent without prior consent, provided the sender is identified and every message offers a simple way to opt out. The Platform will not start an email campaign until the sender has chosen how each message carries its opt-out and privacy information (in their own signature, or as a footer the Platform adds), and it stops outreach to anyone who has opted out, bounced or complained. Clients can also require a recorded marketing opt-in before any outreach is sent.

5.3. Legal Obligation (Article 6(1)(c)): We may process data to comply with legal obligations, such as tax records or responding to lawful requests from authorities.

5.4. Consent (Article 6(1)(a)): Where we send optional marketing communications about Platform updates or features to our account holders, we do so only with your consent. Non-essential cookies and browser storage on our websites and on Client websites, including advertising identifiers and linking a website visit to a named person, are used only with the visitor’s consent, as required by PECR. You can withdraw consent at any time.

5.5. Data Processing Agreement: For Client Data where we act as Data Processor, processing is governed by our DPA.

6. Data Storage and Security

6.1. Infrastructure:

Application hosting: Railway (containerised deployment; processing location as listed on our Sub-Processor list)
Database: Supabase (PostgreSQL with Row Level Security enforced on every database table, automated daily backups, point-in-time recovery)
Edge proxy: Cloudflare Workers (host-based routing, DDoS protection, WAF rules)
CDN: Cloudflare Pro (image optimisation, SSL termination, caching)
Media storage: Cloudflare R2 (company-partitioned by object key prefix, encrypted at rest)
Email delivery: Resend (DKIM/SPF/DMARC verified, dedicated sending domains)
Payments: Stripe Connect (PCI DSS Level 1 compliant — no card data touches mDOS servers)
Background tasks: Trigger.dev (serverless task execution for email campaigns, data processing)
Error tracking: Sentry (application error capture — no PII, only error context with automatic email redaction)
Rate limiting: Upstash Redis (API request throttling, brute-force protection)
Monitoring: BetterStack (uptime monitoring, heartbeat checks, incident alerting)
AI: Google Gemini API, Anthropic Claude API and OpenAI API (text analysis, content and image generation, voice agent — enterprise API terms, no model training on client data)
SEO data: DataForSEO (search rankings, keyword, backlink and website-crawl data for domains and keywords the Client specifies)
B2B data providers: Apollo.io and Hunter.io (business contact and company data, see section 3.6)
Calendar sync: Google Calendar & Microsoft Graph API (OAuth2, encrypted token storage AES-256-GCM)
All data is encrypted in transit (TLS 1.3) and at rest (AES-256)

6.2. Authentication:

Staff dashboard: Email/password with bcrypt hashing (12 rounds). JWT session tokens with company, venue, and role claims. Passwords found in known breach databases are automatically rejected.
Customer portal: Email-based magic link or password login. Portal tokens hashed (SHA-256) at rest.
OAuth integrations: HMAC-SHA256 signed state parameters with 10-minute TTL on all OAuth flows (Stripe Connect, Google Calendar, Microsoft Calendar, ad platforms).
Rate limiting: Authentication endpoints protected by Upstash Redis rate limiter to prevent brute-force attacks.
All authentication events are logged in the audit trail.

6.3. Access Controls:

Role-based access control across a 10-role model spanning five scope levels (platform, company, brand, group, and venue)
Permissions are enforced at the API level with module-level granularity across all 31 modules
Every action is recorded in an immutable audit log

6.4. Backups:

Automated daily database backups
Point-in-time recovery available
Media assets stored with redundancy

6.5. Incident Response:

Infrastructure monitored 24/7 with automated alerting
Security incidents are investigated immediately
Affected Clients will be notified within 72 hours of becoming aware of a personal data breach, in accordance with UK GDPR requirements

7. Data Retention

7.1. Active Accounts: Data is retained for the duration of your account. You can delete individual records (contacts, pages, etc.) at any time from the dashboard.

7.2. Deleted Content: When you delete content within the Platform, it is soft-deleted and retained for 30 days (allowing recovery). After 30 days, it is permanently deleted.

7.3. Account Cancellation:

Upon cancellation, your account and all associated data remains accessible for 30 days (grace period)
After 30 days, your sites go offline but data is archived for a further 60 days
After 90 days total, all data is permanently and irreversibly deleted
You will be notified at each stage via email
You may request a full data export at any point before permanent deletion

7.4. Audit Logs: Activity logs are retained for 12 months after account cancellation to support compliance and dispute resolution, then permanently deleted.

7.5. Website Intent Data: Visit, page-view and engagement records are deleted automatically after the retention period set by the Client — 90 days by default, adjustable between 7 and 730 days. A link between a visit and a named person is removed when that person’s record is erased.

7.6. B2B Contact Data: Contacts created through enrichment or outreach are kept in the Client’s CRM as Client Data and follow sections 7.1–7.3. Results returned by a data provider for a domain are reused for up to 30 days before the provider is asked again. An unsubscribe or objection is kept against the contact record so that it continues to be honoured.

7.7. Aggregated Data: We may retain anonymised, aggregated data (e.g., total platform usage statistics) indefinitely. This data cannot be used to identify any individual or Client.

8. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

8.1. Right of Access: You can request a copy of all personal data we hold about you. For Account Data, contact us. For Client Data, use the Data Export tool in Settings.

8.2. Right to Rectification: You can update your personal data at any time through the Platform dashboard. If you cannot update it yourself, contact us.

8.3. Right to Erasure: You can request deletion of your account and all associated data. We will process this within 30 days. Note that some data may be retained for legal compliance purposes.

8.4. Right to Restrict Processing: You can request that we restrict how we process your data while a complaint or dispute is being resolved.

8.5. Right to Data Portability: You can export all your data at any time using the Data Export tool in Settings. Exports are provided in portable formats (JSON, CSV, original media files).

8.6. Right to Object: You can object to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds. Your right to object to direct marketing, including B2B outreach, is absolute and applies without exception.

8.7. Rights Related to Automated Decision-Making: We do not make any solely automated decisions that produce legal or similarly significant effects on you.

To exercise any of these rights, contact us at privacy@mr-digital.co.uk. We will respond within one month, and may ask for information to confirm your identity.

8.8. B2B Contact Removal and Opting Out of Outreach: If you have received B2B outreach sent through the Platform, or believe your business contact details are held for prospecting:

Reply “unsubscribe” to any outreach email (or follow the opt-out instructions in it). Replies asking to stop are recorded as an opt-out and stop further outreach from that sender; unsubscribe links in emails sent before 27 September 2026 continue to work.
Or email privacy@mr-digital.co.uk with the subject line “B2B contact removal”, including the email address (and, if you wish, the company domain) concerned, and tell us whether you want us to stop contacting you, erase your details, or both.

8.9. Data Held by Our Clients: Where a Client is the Data Controller (for example, the business whose website you visited or which contacted you), please contact that business directly. If you contact us instead, we will pass your request to the Client and help them respond.

8.10. Do Not Sell or Share My Personal Information:

We do not sell personal data, and we do not share it with third parties for their own marketing. Advertising measurement data is sent to advertising networks only on behalf of a Client, into that Client’s own connected advertising account, and only for visitors who have given advertising consent (see our Sub-Processor list). If you would like to record an opt-out request of this kind, or you live in a jurisdiction that gives you a “do not sell or share” right, email privacy@mr-digital.co.uk with the subject line “Do Not Sell or Share” and we will action it.

9. Data Sharing and Third Parties

9.1. We share data with third-party service providers solely to operate the Platform. Our current sub-processors are maintained at mdos.ai/sub-processors.

9.2. All third-party providers are bound by data processing agreements and are required to process data in accordance with UK GDPR.

9.3. We will never sell your data to third parties.

9.4. We may disclose data if required by law, regulation, court order, or governmental authority.

9.5. If MDOS AI LTD is acquired, merged, or sells its assets, your data may be transferred to the successor entity. You will be notified in advance and given the option to delete your account before transfer.

9.6. B2B data providers (Apollo.io, Hunter.io) and public registers (UK Companies House) are sources of data described in section 3.6. We send them only the domain or company name being looked up.

10. International Data Transfers

10.1. Your data may be processed in the United States and European Union, depending on the infrastructure region configured for your account.

10.2. Where personal data is transferred outside the UK, we rely on UK adequacy regulations, the International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as appropriate.

10.3. You can request information about the specific safeguards in place by contacting privacy@mr-digital.co.uk.

11. Cookies

11.1. The Platform dashboard uses essential cookies for authentication and session management. These are strictly necessary and do not require consent.

11.2. Websites powered by the Platform may use cookies as configured by the Client (website owner). Cookie consent management is built into the Platform, and Clients are responsible for configuring it appropriately for their End Users. The Platform also generates a public cookie policy page for each Client, based on a scan of the Client’s website.

11.3. Cookies and browser storage set by mDOS scripts. The mDOS website scripts are used on our own websites (including mdos.ai) and, depending on which features the Client has switched on, on Client websites. They use the following first-party cookies and browser storage (in this table, “website owner” means us on our own websites and the Client on a Client website). Non-essential items are used only after the visitor has accepted the relevant cookie category, except where stated.

Name	Type	Purpose	Duration	Category
`sb--auth-token`	Cookie	Signed-in session for dashboard and portal users. Not set for visitors who do not sign in.	Up to 400 days	Strictly necessary
`mr-digital-cookie-consent`, `consent_`, `mdos-consent:`	Local storage	Remembers the visitor’s cookie choices.	Until cleared	Strictly necessary
`mdos-announcement-dismissed:*`	Local storage	Remembers that the visitor closed a website announcement (for example a promotion banner) so it is not shown again. Holds only the time it was closed; it is not a cookie choice.	Until cleared	Strictly necessary
`mdos_lt`	Cookie	Short-link routing token that carries a click through a first-party short link. Random value, no personal data. Set only when the website owner has link attribution switched on.	30 minutes	Strictly necessary
`mdos_anonymous_id`	Local storage	Random device identifier used for first-party website analytics and, where the visitor later identifies themselves, to link their visits.	Until cleared	Analytics (consent)
`mdos_session_id`	Session storage	Groups page views and interactions into one visit (shared by website analytics, Website Intent and the Intent Pixel).	Browser session	Analytics (consent)
`mdos_vid`	Local storage	Visitor identifier passed to embedded mDOS widgets (for example booking and sign-up forms) so a visit is recognised across them. Before consent, a temporary identifier that is not stored is used instead.	Until cleared	Analytics (consent)
`_mdos_utm`, `mr_digital_utm`	Cookie	Remembers the campaign (UTM) parameters the visitor arrived with, for attribution.	30 days	Analytics or marketing (consent)
`_mdos_lp`, `mdos_signup_attr`	Cookie	Remembers the first page the visitor landed on, the site that referred them and a promo code from an emailed link, and passes them (with the campaign parameters) to the mDOS sign-up page, for attribution. Advertising click identifiers are included only with marketing consent.	7 to 30 days	Analytics or marketing (consent)
`_mdos_vid_claimed`	Cookie	Flag (value “1”, no identifier) recording that a tracked email link has already been matched to this browser, so the match is not repeated.	30 days	Analytics (consent)
`mdos_ab_vid`, `mdos_ab_view_*`	Cookie; session storage	Keeps a visitor in the same version of a page during an A/B test and avoids counting a view twice. Used only while an experiment is running, and only after you have consented — on external websites and on websites hosted on mDOS alike. Without consent you see the standard page and are not included in the test.	365 days; browser session	A/B testing
`_mdos_gclid`, `_mdos_ga`, `_mdos_li_fat_id`, `_fbp`, `_fbc`, `_mdos_test`	Cookie	Keeps advertising click and browser identifiers (Google, LinkedIn, Meta) — including when a visitor moves between the same owner’s websites — and an advertising test-event code, so a conversion can be reported to the website owner’s own advertising account.	Up to 90 days; test code 1 day	Marketing (consent)

11.4. The Website Intent Tracker and Intent Pixel (section 3.5) use only the analytics items above, and only after consent. Where a Client runs them in cookieless mode, they read and write no cookies or browser storage. The _mdos_xref and _mdos_linker values that may appear in a link between two websites are short-lived tokens carried in the web address; they are not stored, and they are only acted on after consent.

11.5. Our websites also use PostHog product analytics, which is loaded only after analytics consent and then uses its own cookie and local storage. Third-party advertising and analytics tags a Client adds to its own website (for example Google Analytics or the Meta pixel) are listed on that website’s cookie policy.

11.6. For full details on cookies used by the website of our Founding Partner Agency, Mr Digital Ltd, see mr-digital.co.uk/privacy.

12. Children's Data

12.1. The Platform is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children.

12.2. If we become aware that we have collected personal data from a child under 16, we will delete it promptly. If you believe a child has provided us with personal data, please contact privacy@mr-digital.co.uk.

13. Changes to This Policy

13.1. We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated “Last updated” date.

13.2. For material changes that affect how we process your data, we will notify you via email or through the Platform dashboard at least 30 days before the changes take effect.

13.3. Your continued use of the Platform after changes are posted constitutes acceptance of the updated policy.

14. Complaints

14.1. If you have concerns about how we handle your data, please contact us first at privacy@mr-digital.co.uk. We will respond within 30 days.

14.2. If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Website: ico.org.uk
Phone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

15. Data Breach Response

In the event of a personal data breach:

We will assess the breach within 24 hours of discovery
We will notify affected Clients (Data Controllers) within 72 hours, providing: nature of the breach, categories and approximate number of records affected, likely consequences, and measures taken
We will cooperate with Clients in their notification obligations to the ICO and affected data subjects
We will document all breaches in our internal breach register regardless of severity
We will conduct a post-incident review and implement preventive measures

For the avoidance of doubt, the 72-hour notification window begins when we become aware of the breach, not when the breach occurred.

16. Contact Us

For any questions about this Privacy Policy or our data practices:

MDOS AI LTD
Company No. 17526969
Brighton
United Kingdom

Email: privacy@mr-digital.co.uk
Phone: 01273 942 329

Data Protection Queries: privacy@mr-digital.co.uk