The short version
- Anyway Ventures Limited, trading as Already Built, is responsible for the personal data described here.
- This website sets no cookies and runs no analytics or advertising trackers. Our host keeps short-lived server logs for security, and the page fonts load from Google.
- If you use our support form or email us, we use what you send only to deal with your enquiry, and keep it for 24 months after our last reply unless the law requires longer.
- We find local businesses with weak websites, build each one a new website, and email the business a private link. We use only information the business has published, and you can tell us to stop at any time; we will then never contact you again.
- We do not sell personal data, and we do not share it with anyone for their own marketing.
1. Who we are
1.1 Already Built is a trading name of Anyway Ventures Limited, a company registered in England and Wales.
Anyway Ventures Limited, trading as Already Built
Company number: 16318119
Registered office: Newbury House, Main Street, Little Ouseburn, York, YO26 9TD
VAT number: GB 501 6446 23
Email: hello@alreadybuilt.io
1.2 We are the controller of the personal data described in this notice, which means we decide why and how it is used. In this notice, "we", "us" and "our" mean Anyway Ventures Limited.
1.3 For anything about your personal data, email hello@alreadybuilt.io, use our support form, or write to us at the registered office above. We have not appointed a data protection officer, as the law does not require us to; the director responsible for data protection reads that mailbox.
1.4 We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025.
2. What this notice covers
2.1 This notice covers personal data we collect through this website (alreadybuilt.io), our support form, emails you send us, and our contact with businesses whose websites we think we can improve.
2.2 If you are a customer, or you use our client area at app.alreadybuilt.io or open a preview we have built, our full Privacy Notice for the Already Built service also applies and explains that processing in more detail. The two notices are consistent; where the full notice says more about a topic, it applies.
2.3 Much of our work is with businesses rather than individuals. Information about a limited company is not personal data, but information about a sole trader, a partner, or a named person at a business (such as their name and email address) is, and this notice covers it.
3. Visiting this website
Server logs
3.1 Our website is hosted by Netlify. When you visit, Netlify's servers automatically record technical information needed to deliver the page and protect the service: your IP address, the date and time, the page requested, the address of the page that linked you here, your browser and device type (the "user agent"), and the response sent. We use this only to keep the website secure and working, for example to investigate errors or misuse. We do not use it to identify or profile visitors.
Fonts
3.2 The typefaces on this website are loaded from Google Fonts, a service of Google LLC. To deliver them, your browser connects to Google's servers, which receive your IP address and browser details. Google states that it does not set cookies or use this information to build profiles; see Google Fonts privacy and the Google Privacy Policy.
No cookies or tracking
3.3 This website does not set cookies, does not store anything on your device, and does not use analytics, advertising or social media tracking. The animation on the home page runs entirely in your browser and sends nothing to us.
4. Support enquiries and emails
4.1 What we collect. When you use our support form, we collect your name, email address, business name (if you give it), the topic you choose and your message. Our host also records the time of the submission, your IP address and browser details with it, which are used to filter spam. When you email us, we receive your email address, name, message, any attachments and the technical information that comes with an email.
4.2 How it reaches us. Submissions are received and stored by Netlify, which checks them automatically for spam (using Akismet, a service of Automattic Inc.), and sends a copy by email to our mailbox, which is provided by Google Workspace.
4.3 What we do with it. We use it to answer your enquiry, to help with your website, account or a preview you received, to deal with billing questions, to act on a request to stop contacting you (section 5), and to keep a record of what was asked and answered. If you are a customer, your enquiry becomes part of your account record and is handled under the full Privacy Notice.
4.4 Please don't send sensitive information. Do not include passwords, card details or information about health or other special categories in the form or by email. If you need to give us a domain registrar login, we will tell you how to do so securely.
5. Businesses we contact about their websites
5.1 What we collect. For businesses whose website we think we can improve, we collect: the business name, address, phone number, website address and opening hours; email addresses the business publishes for contact (which may include a person's name at the business, or the address of a sole trader); the name of the owner or manager if the business publishes it; its social media pages; photos, menus, prices and descriptions from its own website; the business's rating, number of reviews and short summaries of what reviews say; and our own assessment of its website (speed, whether it works on phones, whether it is secure, whether it has online booking or ordering, and screenshots).
5.2 Where it comes from. All of it comes from public sources: the business's own website and social media pages, Google Maps business listings (through the Google Places API), online directories and booking or delivery platforms that list the business, and, for companies, Companies House. We do not buy lists of contacts.
5.3 What we do with it. We use it to decide whether we can build a clearly better website for the business, to build a website concept (a preview) for it, and to contact the business, by email to its published business address and occasionally by a message through its own website contact form or social media page, with a private link to the preview and a few follow-up emails (no more than five emails about a concept in all). We record whether our emails were delivered, opened or replied to, and how the preview link is used, so that we know whether our work is useful and when to stop.
5.4 Our lawful basis. We rely on legitimate interests: our interest in offering a useful service to businesses that are likely to benefit from it, and the business's interest in hearing about it. The UK GDPR recognises direct marketing as a purpose that may be carried out for a legitimate interest. We have carried out a legitimate interests assessment and balanced our interests against yours. In particular:
- we use only business contact details that the business has chosen to publish so that people can contact it, and only to contact it about its own website;
- we contact a business about one concept, with no more than five emails spread over several days, and stop as soon as it orders, replies to say no, or unsubscribes;
- every email says who we are, where we found the address and how to stop, and unsubscribing takes one click;
- a person reviews every preview before it is sent; previews are on private links that search engines are told not to index;
- we keep the data for a limited time (section 10) and do not share it for anyone else's marketing.
5.5 Automated assessment. We use software, including AI, to score how well a business's website works and to draft the preview and the first line of our email. The score only decides whether we build a preview; it has no legal or similarly significant effect on anyone.
5.6 Your right to object, and how to opt out. You can object to direct marketing at any time, and we will stop. You can:
- use the unsubscribe link in any email we send;
- use the "not for me" link on the preview;
- reply to our email to say so;
- choose "Opt out of contact" on our support form; or
- email hello@alreadybuilt.io.
We act on an objection within one working day. We then remove the preview, stop all contact, tell our email sending service, and keep only a one-way code (a hash) of the email address, website, phone number and Google listing on a suppression list, so that we never contact you again. We do the same if an email to you bounces or you complain about one. If you simply do not reply, we do not put you on that list: we delete your details 12 months after our last contact, and after that we may find your business again and contact you about a new concept. Keeping that minimal record is the only way to make sure your objection is respected, and we use it for nothing else.
6. Our customers
6.1 If your business orders from us, we use your details to provide the service, manage your account, take payment and meet our legal obligations. That processing is described in full in our Privacy Notice for the Already Built service, with our Cookie Policy, our Terms and our list of sub-processors.
6.2 For personal data about visitors to the websites we host for customers, and their customers' enquiries, orders and bookings, the business is the controller and we act as its processor under our Data Processing Agreement. Please contact the business about that data; if you contact us, we will pass your request on.
7. Our lawful bases
| Purpose | Data | Lawful basis |
|---|---|---|
| Running and securing this website | Server logs | Legitimate interests: keeping our website available and secure |
| Answering support enquiries and emails | What you send us, and its technical details | Legitimate interests: responding to people who contact us. Where you are a customer, or are asking about becoming one: performance of a contract, or steps before entering one |
| Filtering spam from the support form | Form contents, IP address, browser details | Legitimate interests: protecting our mailbox and services from abuse |
| Finding and contacting businesses about their websites | Published business information and contact details (section 5) | Legitimate interests: offering our service to businesses likely to benefit from it |
| Keeping a suppression list | One-way codes of the email address, business website, phone number and Google listing | Legal obligation and legitimate interests: making sure we respect your objection |
| Handling legal claims, and complying with the law | Any of the above, as needed | Legal obligation, or legitimate interests: establishing, exercising or defending legal claims |
7.1 Where we rely on legitimate interests, you have the right to object (section 11). We do not rely on consent for any of the processing in this notice, and we do not use your data to make decisions about you that have legal or similarly significant effects.
8. Who we share data with
8.1 We use service providers (processors) who act only on our instructions, under contracts that require them to protect the data. For the processing in this notice they are:
- Netlify, Inc.: hosting this website, its server logs, and receiving, spam filtering and emailing support form submissions (with Automattic Inc.'s Akismet service for spam filtering);
- Google LLC (Google Workspace): our email, including the mailbox that receives support enquiries and the mailboxes we use to contact businesses;
- for the businesses we contact (section 5), the providers that help us research businesses, build previews and send emails, such as Supabase, Render, Anthropic, Google (Places API and PageSpeed Insights) and our outreach email service. The full, current list is in our sub-processors list.
8.2 Google Fonts. Google receives your IP address and browser details when the fonts on this website load (section 3.2), and handles them under its own privacy policy.
8.3 Others. We may share personal data with our professional advisers (such as lawyers and accountants) and insurers; with a buyer or investor in our business, under a duty of confidentiality; and with the police, HM Revenue & Customs, regulators or other authorities where the law requires it or to protect our rights or the safety of others.
8.4 We do not sell personal data, and we do not share it with anyone for their own marketing.
9. International transfers
9.1 Some of our providers, including Netlify, Google and Automattic, are based in, or can access data from, countries outside the UK, including the United States. Where personal data is transferred outside the UK, it is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, for organisations certified under it), or by the UK International Data Transfer Agreement or the UK Addendum to the European Commission's standard contractual clauses, included in that provider's data processing terms.
9.2 You can ask us for more information about these safeguards by emailing hello@alreadybuilt.io.
10. How long we keep data
10.1 We keep personal data only for as long as we need it for the purposes in this notice, then delete or anonymise it.
| Data | How long |
|---|---|
| Server logs for this website | Kept by Netlify for a short period for security and operating the service, under its own retention policy. We do not keep separate copies. |
| Support enquiries and emails | 24 months after our last reply, in our mailbox and in our host's form store, unless we need them longer for a legal claim or a legal obligation |
| Support form submissions marked as spam | Deleted when we review them, and in any case within 90 days |
| Enquiries from customers about their account or billing | As part of the customer record: the length of the contract and 6 years after it ends |
| Businesses we contact that don't order | 12 months after our last contact (or your last use of the preview, if later), then deleted. Unless you opted out, we may find and contact your business again after that |
| Businesses we assess but never contact | 24 months after we found them (or their last activity, if later), then deleted |
| Previews | Removed 30 days after we send them, or sooner if you ask |
| Facts taken from Google Maps listings | No more than 30 days, then deleted or refreshed |
| Suppression list after an unsubscribe, objection, bounce or complaint | One-way codes of the email address, website, phone number and Google listing only, for as long as we contact businesses, so that we never contact you again |
| Backups | 30 days |
11. Your rights
11.1 Under data protection law you have the right to:
- access your personal data and receive a copy of it;
- have inaccurate data corrected and incomplete data completed;
- have your data deleted;
- restrict how we use it;
- object to our use of it where we rely on legitimate interests;
- object to direct marketing at any time; this right is absolute, and we will always stop;
- receive data you gave us in a portable format (data portability), where that right applies.
11.2 Some of these rights depend on our lawful basis and have exceptions. If one applies, we will explain it.
11.3 To use any of your rights, email hello@alreadybuilt.io or use our support form. We may need to confirm your identity before acting. We will reply within one month. For complex or numerous requests we may extend this by up to two further months, and we will tell you within the first month if we do. There is normally no charge.
12. Complaints
12.1 If you are unhappy with how we have handled your personal data, please tell us first at hello@alreadybuilt.io. We acknowledge every data protection complaint within 30 days, look into it, and tell you the outcome without undue delay.
12.2 You also have the right to complain to the UK data protection regulator, the Information Commission (formerly the Information Commissioner's Office, ICO), at ico.org.uk/make-a-complaint or by phone on 0303 123 1113.
13. Cookies
13.1 This website (alreadybuilt.io) does not set cookies and does not use local storage, session storage or any similar technology on your device, so it does not show a cookie banner.
13.2 Our client area and preview pages at app.alreadybuilt.io use a small number of cookies and similar technologies, described in our Cookie Policy.
14. Security
14.1 We use appropriate technical and organisational measures to protect personal data. This website is served only over an encrypted connection (HTTPS), with security headers that tell browsers to use it every time. Access to our mailbox, form submissions and systems is limited to the people who need it and protected by strong authentication.
14.2 No system is completely secure. If a personal data breach happens that is likely to put your rights at risk, we will tell the Information Commission within 72 hours where the law requires it, and tell you without undue delay if the risk is high.
15. Children
15.1 Our website and services are for businesses and are not intended for children. We do not knowingly collect personal data from anyone under 18. If you think a child has sent us personal data, please contact us and we will delete it.
16. Changes to this notice
16.1 We update this notice when what we do changes, or when the law changes. The version and the date it took effect are shown at the top of this page. If a change significantly affects how we use your personal data, we will tell you, for example by email if you are a customer.
16.2 This version (2026-10-16) took effect on 16 October 2026.