Privacy Policy

Last updated: 11 October 2026

Launch44 is committed to protecting your privacy. This policy explains what data we collect, why we collect it, and how we protect it.

1. Who we are

Launch44 is a trading name of Pamamonya Ltd, a company registered in England & Wales (Company No. 17148450), with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ. Pamamonya Ltd is the data controller for the personal data processed through the Launch44 platform at launch44.co.uk.

Contact: privacy@launch44.co.uk

2. What data we collect

Readiness checker (free)

Email address (optional), answers to 16 readiness questions, and the resulting readiness score. No account is required.

Early access waitlist

Email address and submission timestamp.

Marketing and service enquiry forms

When you contact us through an enquiry, demo, or service-interest form, we collect the details you choose to provide: your name, email address, role, organisation name, the stage you have reached in your readiness journey, and your current registration status. We use this to respond to your enquiry and tell you about the relevant Launch44 service.

Registered users

Full name, email address, organisation details, home details (name, address, type, age range, bed count, care model), personnel details (names, roles, qualification status, DBS check status: status only, no certificates), evidence statuses, dates and related details, including notes where held, generated drafts, and document generation history.

Data we obtain from other sources

When you enter your organisation's Companies House number, we retrieve publicly available company information (company name, registered address, director names) from the Companies House public register to cross-check the details you provide. This is the only personal data we obtain from a source other than you (Article 14 UK GDPR).

What we do NOT collect

We do not store DBS certificates, health declarations, reference letters, children's personal data, or any special category data. Evidence tracking records statuses, dates and related details, including notes where held. You keep the original evidence and submit it to Ofsted yourself. We also store account details and generated drafts, as described above.

3. Lawful basis for processing

We process your data under the following lawful bases:

  • Contract performance (Article 6(1)(b) UK GDPR): to provide the Launch44 service to registered users.
  • Legitimate interest (Article 6(1)(f)): to process waitlist signups, readiness checker submissions, and marketing or service enquiry form submissions for the purpose of responding to you and communicating product availability.
  • Legitimate interest (Article 6(1)(f)): for usage statistics (PostHog analytics), including an analytics cookie, account identification and statistics from your requests to our servers, used only to find where people get stuck and improve Launch44. You can object at any time with Turn off analytics (see section 8).

Where we rely on legitimate interests, we have carried out a balancing assessment: the processing is necessary to respond to people who have actively given us their details expecting a reply, there is no less intrusive way to achieve that, and it does not override your interests or rights; you can opt out at any time.

4. How we use your data

  • To provide the Launch44 registration guidance platform
  • To generate personalised documents using AI (your home and organisation details are sent to the AI model as generation inputs)
  • To compute and display readiness scores and checklist progress
  • To send transactional emails (magic link login, notifications)
  • To improve the product using PostHog usage statistics, which can be linked to your account and which you can turn off
  • To contact waitlist members when the product launches

We do not carry out automated decision-making that produces legal or similarly significant effects about you (Article 22 UK GDPR). Your readiness score and checklist are informational tools to guide your own decisions; they do not make any decision about you.

Marketing emails and opt-out

Some of our emails are direct marketing: for example the readiness-report results email, progress and re-engagement nudges, and your weekly progress recap. Under the Privacy and Electronic Communications Regulations 2003 (PECR), every one of these carries an easy opt-out: a one-click unsubscribe link in the footer and a List-Unsubscribe header your email client can act on. Unsubscribing takes effect immediately and requires no login; we suppress the address from all future marketing emails. Essential service messages (magic-link login, payment receipts, and statutory notifications) are not marketing and will still be sent.

5. Data processors and international transfers

We use the following third-party processors. Some are based outside the UK and data transfers are governed by UK International Data Transfer Agreements (UK IDTA) or Standard Contractual Clauses (SCCs).

ProcessorPurposeLocationSafeguard
Supabase Inc.Database, authenticationUSAUK IDTA / SCCs
Anthropic PBCAI document generation (default)USAUK IDTA / SCCs
OpenAI, L.L.C.AI document generation (fallback)USAUK IDTA / SCCs
Google LLCAI document generation (fallback)USAUK IDTA / SCCs
Resend Inc.Transactional emailUSAUK IDTA / SCCs
Vercel Inc.Hosting, CDNUSA / GlobalUK IDTA / SCCs
Stripe Inc.Payment processingUSA / IrelandUK IDTA / SCCs
PostHog Inc.Product analyticsUSA / EUSCCs
Upstash, Inc.Rate limiting (Redis)USAUK IDTA / SCCs

Data sent to our AI provider for document generation (Anthropic by default, and where used as fallbacks, OpenAI or Google) includes your home name, address, care model, age range, staffing details, and organisation name. These providers do not use API inputs for model training. The specific transfer instrument for each processor is set out in our data processing agreement with that processor.

6. Data retention

  • Active accounts: retained for the duration of your account plus 12 months after deletion.
  • Waitlist emails: retained until the product launches or you unsubscribe, whichever is sooner.
  • Readiness checker submissions: retained for 24 months, then anonymised.
  • AI generation logs: job metadata (tokens, cost) retained for 24 months. Prompt content is not stored after generation completes.
  • Audit logs: retained for 36 months for operational and compliance purposes.

7. Your rights

Under UK GDPR, you have the right to:

  • Access: request a copy of the personal data we hold about you
  • Rectification: correct inaccurate data
  • Erasure: request deletion of your data (“right to be forgotten”)
  • Portability: receive your data in a machine-readable format
  • Restriction: limit how we process your data
  • Object: object to processing based on legitimate interest
  • Turn off analytics: object to PostHog usage statistics at any time with Turn off analytics in the website footer or Settings → Privacy in your workspace

To exercise any right, email privacy@launch44.co.uk. We may ask you to verify your identity before we act on a request, to protect your data. We will respond within one calendar month.

8. Cookies and analytics

We use strictly necessary cookies for authentication and session management. We also count how Launch44 is used, with PostHog, so we can see where people get stuck and improve the service. The Privacy and Electronic Communications Regulations allow this without asking first, because its only purpose is statistics about our own service and you can switch it off at any time (PECR Schedule A1, paragraph 5, inserted by the Data (Use and Access) Act 2025 from 5 February 2026).

What this involves: the PostHog browser library stores an analytics identifier in a cookie and local storage, and records page views, clicks (which kind of element, without its text or labels) and steps such as starting the readiness checker or generating a document. Our servers send similar events for work you start, such as document generation, approval and export. If you sign in, these events are joined to your account ID and to coarse details such as your subscription, home type and number of beds, so we can count how many people reach each step; they are not anonymous. By default we send no email address or organisation name, no error or security reports, and no test versions of pages. We do not record sessions. We use these statistics only to improve Launch44: never for advertising, and never to decide whom to email or call. Background work that you did not start from your browser, including scheduled emails and payment-provider notifications, sends no PostHog events.

If you accepted analytics in our earlier cookie banner, or you turn analytics back on after turning it off, that explicit choice also lets us attach your email address and organisation name, forward sign-in failure spikes, blocked access attempts and the security reports your browser sends, and show you test versions of some pages. Turn off analytics withdraws all of it.

To object, choose Turn off analytics in the website footer, or go to Settings → Privacy in your workspace. That stops PostHog in your browser at once, removes its stored identifiers, and saves a preference cookie so later requests from this browser send no analytics either. If the choice cannot be saved or the identifiers cannot be removed, the control shows a warning and a Try again option; until it is saved, a reload may still use analytics. The choice applies to this browser; set it separately on other browsers or devices. Every feature works with analytics off. You can turn it back on the same way.

Turning analytics off does not switch off the records used to operate the service: database audit and security records, payment transactions, email delivery records and document-generation cost records continue. Separately, we use Sentry for error monitoring and diagnostics, including sampled workspace session replays with text masked and media blocked. Operational records and diagnostics can include account or home identifiers and continue when analytics is off.

Turning analytics off does not automatically erase data already received or operational records. Contact us using the details in section 7 to request erasure.

9. Security

All data is encrypted in transit (TLS 1.2+) and at rest. Database access is controlled by row-level security policies. We do not store sensitive artefacts (DBS certificates, health records). Access to production systems is restricted to authorised personnel only.

10. Children's data

Launch44 does not collect or store any personal data about children. The platform is used by adults (home operators, managers, responsible individuals) to prepare registration documents. Any references to children in generated documents are generic descriptions of care provision, not personal data about specific children.

11. Complaints

If you believe we have not handled your data correctly, please contact us first at privacy@launch44.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Tel: 0303 123 1113
Web: ico.org.uk

12. Changes to this policy

We may update this policy from time to time. Material changes will be communicated by email to registered users. The “last updated” date at the top of this page will always reflect the most recent version.