Privacy Policy
Last updated: 25 August 2026
This policy explains how Congruent ("we", "us") collects, uses and protects personal data when you use our website congruentindex.com — in particular when you contact us, book a call, or browse the site. It is written for UK / EU data protection law (UK GDPR and the Data Protection Act 2018).
Who we are
Congruent is the data controller for personal data collected through this website. You can reach us at hello@congruentindex.com for any privacy question or to exercise your rights.
What we collect
Information you give us directly
- Contact form: your first and last name, email address, company name, and the message you write.
- Booking a call: your name, email address, and the meeting details you choose (and any information you add when booking).
- Email: anything you send us if you email hello@congruentindex.com directly.
Information collected automatically
- Usage and device data — only if you accept cookies. Two tools do this, and neither runs until you choose Accept on the cookie banner. HubSpot, our CRM, records pages viewed, approximate location derived from your IP address, and browser and device type, and links an enquiry to the visits that preceded it. PostHog, hosted in the EU, records how the site is used — including session replay, described under Cookies below.
- Aggregate analytics via Vercel Web Analytics, which is privacy-friendly, does not use tracking cookies and does not identify you. This one runs whether or not you accept.
How we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Respond to your enquiry and arrange/hold a call | Legitimate interests (handling a request you initiated) / taking steps to enter into a contract |
| Analytics and session replay, to understand and improve how the site is used | Consent — which you can withdraw at any time using the Cookie choices link in the footer, or by clearing this site's data |
| Keep the site available and secure | Legitimate interests |
| Send you marketing communications (only if you opt in) | Consent — which you can withdraw at any time |
Cookies and similar technologies
We ask before we set anything that is not strictly necessary. Until you choose Accept on the banner, none of the cookies below is set and neither analytics tool runs. If you choose Reject, we also clear any of these cookies your browser is already carrying. You can change your mind at any time using the Cookie choices link in the footer, or by clearing this site's data in your browser settings; either brings the banner back.
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
__hstc | HubSpot | The main visitor-tracking cookie — records the domain, a visitor token, timestamps and the session number | 6 months |
hubspotutk | HubSpot | Identifies your browser so an enquiry you send can be matched to the visits that preceded it, and so duplicate contact records can be merged | 6 months |
__hssc | HubSpot | Tracks the current session and the number of pages viewed in it | 30 minutes |
__hssrc | HubSpot | Records whether you have restarted your browser | End of the browsing session |
ph_<project key>_posthog | PostHog | Distinguishes one visitor from another and links the events in a single visit, so we can see how the site is used | 365 days |
A cookie is set before you choose, and it is not ours. The contact page loads
HubSpot's booking and form scripts through a content-delivery network operated by Cloudflare.
Cloudflare sets __cf_bm on its own domains — one for each HubSpot service the page
reaches — to tell human visitors from automated ones. It expires after about 30 minutes, cannot
be read by this website or by any script running on it, and is not used to build a profile of
you or to follow you across other sites. It is set because the page loads, not because you
accepted, and rules in the UK treat security cookies of this kind as strictly necessary, so they
do not require consent. It is a separate matter from the Cloudflare entry in the table further
down this page, which covers our own domain and email routing.
Session replay. PostHog also stores analytics data in your browser's local storage alongside its cookie, and — because session replay is switched on — records your interactions with these pages: mouse movement, clicks, scrolling, and the pages you move between. We use it to find where the site is confusing. Recording only ever starts after you accept, the recordings are hosted in the EU, and we do not use them to identify you personally. Rejecting the banner, or clearing this site's data, stops it.
How long your choice lasts. Whichever button you press, we record the choice and the date it was made in your browser's local storage, and we act on it for twelve months. After that we ask again, because consent given a long time ago is not good evidence of what you want today. You do not have to wait for us to ask: the Cookie choices link in the footer of every page brings the banner back whenever you want it, and clearing this site's data has the same effect. Nothing about the choice is sent to us or stored on our servers — it stays in the browser you made it in, so a different browser or device will ask you again.
Vercel's analytics is cookieless and needs no consent. Blocking cookies in your browser settings will not stop you using the site, booking a call or sending us an enquiry.
Who we share it with
We don't sell your data. We use a small number of trusted service providers who process it on our behalf, under their own data-protection terms:
| Provider | What for |
|---|---|
| HubSpot | CRM, contact forms and meeting scheduling (EU data hosting) |
| PostHog | Website analytics and session replay, only after you accept cookies (EU-hosted) |
| Vercel | Website hosting and privacy-friendly analytics |
| Cloudflare | DNS and email routing |
| Calendar & Google Meet for calls you book |
Some providers may process data outside the UK/EU; where they do, this is covered by appropriate safeguards such as UK/EU Standard Contractual Clauses or an adequacy decision.
How long we keep it
We keep enquiry and contact data for as long as needed to deal with your request and maintain our relationship with you, and then delete or anonymise it. You can ask us to delete your data sooner (see your rights below).
How we produce our work — use of AI
Congruent uses AI tools — including Anthropic's Claude — to help research, draft and quality-check the analyses and reports we produce for clients. This is always under human direction and review: a named Congruent lead signs off every client report before it is issued, and AI never delivers work to a client on its own. We use Anthropic's commercial API, under which the inputs and outputs we send are not used to train AI models, and we operate a strict data boundary that keeps raw client records and personal data out of AI prompts.
Personal data you submit through this website (enquiries and bookings) is handled by the providers listed above and is not used to train AI models. Where AI processes data as part of a paid client engagement, that processing is governed by the client agreement and Data Processing Agreement, which names Anthropic as a sub-processor — see the full sub-processor register.
Your rights
Under UK GDPR you have the right to access, correct, delete, restrict or object to our use of your personal data, to data portability, and to withdraw consent at any time. To exercise any of these, email hello@congruentindex.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.
Changes to this policy
We may update this policy from time to time; the "last updated" date above shows when. Material changes will be reflected here.
Contact
Questions about this policy or your data: hello@congruentindex.com.