Privacy policy

Effective date: 11 October 2026

This policy explains how LGR Labs Ltd uses personal data when you visit our website, contact us or work with us. It applies wherever you are: in the UK, the European Union, Switzerland, the United States or elsewhere. Our game World Owner has its own privacy policy.

1. Who we are

LGR Labs Ltd is the controller of the personal data described here. We are a private limited company registered in England and Wales, company number 17511153.

Email: enquiries@lgrlabs.com. Write to this address about anything in this policy, including your rights.

When we build or run a website, automation or AI assistant for a client, the personal data of that client’s own customers belongs to the client. In that case the client is the controller, we act as their processor under our terms of business, and the client’s privacy notice applies.

2. What we collect and why

We don’t send newsletters. If we ever offer one, we will ask for your consent first. We don’t make decisions about you using only automated means, and we don’t build profiles of visitors.

3. Cookies and similar technologies

We don’t use advertising cookies, and the site loads no third-party trackers, social media widgets or advertising tags. Our fonts and statistics run on our own systems, so loading a page sends nothing to font providers or analytics companies.

Statistics. If you accept statistics in the cookie banner, the site counts your visit in our own statistics, hosted with our database at Cloudflare. It sets one cookie, lgr_visit (13 months), so that a returning visitor isn’t counted as new, and keeps a marker in your browser’s session storage (lgr.session) until you close the tab, so that one visit isn’t counted twice. We store only daily totals, such as visits per page or per country; we don’t store your IP address or any identifier, and the statistics can’t tell us who you are. If you reject statistics, or your browser sends a Global Privacy Control signal and you haven’t chosen otherwise, nothing is counted and no statistics cookie is set. Rejecting is as easy as accepting, and you can change your choice at any time with the Cookie settings link at the bottom of every page.

Strictly necessary storage. The cookie lgr_consent remembers your choice for 6 months; after that we ask again. Your currency, language and language-suggestion choices are kept in your browser’s local storage (lgr.currency, lgr.locale and lgr.suggest) and never leave your device. Our hosting provider may set a strictly necessary security cookie to tell people from automated attacks. Under the UK Privacy and Electronic Communications Regulations and the EU ePrivacy rules, this storage doesn’t need consent; for the statistics, we ask first. You can delete cookies and stored data at any time in your browser settings.

4. Who we share it with

We don’t sell personal data, and we don’t share it for advertising. We share it only with people who help us run the business, under contracts that require them to protect it:

• Cloudflare, Inc. hosts the website and its database, delivers pages, protects the site from attacks and runs the code that handles the enquiry form and the visit statistics.
• Resend (Plus Five Five, Inc.) sends the emails the website generates: the notification of your enquiry to us and the confirmation to you.
• Our email and office software provider, which hosts our mailboxes and documents.
• Our accountants, bank and payment providers, to invoice, take payments and keep accounts.
• Specialists who work on a project with us, only when your project needs them and under confidentiality and data processing terms.
• AI services we use in our own work, only business services whose terms say they don’t use what we send to train their models. We don’t put your personal data into AI tools unless your project needs it and our agreement with you allows it.
• Professional advisers and authorities, where the law requires it or to establish or defend legal claims.

5. International transfers

We are based in the UK. The European Commission recognises the UK as providing an adequate level of data protection, so data can flow from the EU to us; Switzerland recognises the UK too. Some of our providers, including Cloudflare and Resend, process data in the United States and other countries. When data leaves the UK or the EU, we rely on an adequacy decision (such as the EU–US Data Privacy Framework and its UK extension, where the provider is certified) or on standard contractual clauses with the UK International Data Transfer Addendum. You can ask us for a copy of these safeguards.

6. Your rights

Under UK and EU data protection law (the UK GDPR, the EU GDPR) and the Swiss Federal Act on Data Protection, you can ask us to:

• give you a copy of your personal data;
• correct it, or complete it;
• delete it;
• restrict how we use it;
• stop using it where we rely on legitimate interests (you have the right to object);
• send it to you or to someone else in a commonly used format.

Where we rely on consent, you can withdraw it at any time; this doesn’t affect what we did before. Email us to use any of these rights. We reply within one month, free of charge, and may ask you to confirm who you are.

If you are unhappy with how we use your data, please tell us first. You can also complain to a supervisory authority: in the UK the Information Commissioner’s Office (ico.org.uk); in the EU the authority in your country (listed at edpb.europa.eu); in Switzerland the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

If you live in the United States

Some US states, including California, Colorado, Connecticut, Virginia and others, give residents the right to know what personal information a business holds about them, to correct and delete it, and to opt out of its sale, of sharing for cross-context behavioural advertising and of targeted advertising. We collect only the categories described in section 2, for the purposes described there. We don’t sell personal information, share it for cross-context behavioural advertising, use it for targeted advertising or use sensitive personal information to infer characteristics about you. We treat a Global Privacy Control signal as a valid opt-out. To use your rights, email us; an authorised agent can also contact us for you. We will not treat you differently for using them.

7. Children

Our services are for businesses and are not directed at children under 16. We don’t knowingly collect their personal data.

8. Security

We encrypt connections to the website, protect our accounts with two-factor authentication, give access only to the people who need it and choose providers with recognised security standards. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities where the law requires.

9. Changes to this policy

When we change this policy we update the effective date above. If a change matters to how we use your data, we will tell you before it applies.

10. Translations

This policy is published in several languages. If they differ, the English version prevails, unless the law where you live says otherwise.