Skip to content

Privacy Policy

Effective Date: 16 October 2026

This policy explains how MXD Group Limited (“MxD”, “we”, “us”, “our”) collects and uses personal information when you visit mxd.digital or contact us. It covers the website only. Client engagements are governed by the separate agreement between us, and your use of the site is governed by our Terms of Service.

1. Who we are

MXD Group Limited is the data controller for the information described here. We operate from London, Dubai and Auckland. For any question about this policy or to exercise your rights, contact [email protected].

2. Information you give us

When you complete a form on this site - the contact form, a free-tool request, the newsletter signup, a popup enquiry or the CEO AI Readiness Test - we collect what you enter. Depending on the form that includes your name, email address, phone number, company name, website, role, and whatever you write in a message or select in an assessment. Email address is the only field required across every form; the rest are optional and you can leave them blank. If you use Ask MxD, we process the company email you verify with a magic link and the questions you type to select answers from our website. If you keep chatting, your questions and the answers are saved in your private Ask MxD history. Please do not include personal or sensitive details in a chat question; use the contact form if you want to speak with the team.

3. Information we collect automatically

We use analytics to understand how the site is used. This records pages viewed, referring URL, approximate location derived from IP address, device and browser type, and interactions such as which form step you reached. Where you have given us your email address through a form, including an Ask MxD link request, we associate your prior and subsequent activity on this site with it, so that an enquiry arrives with the context of what you were reading. Our servers also use IP addresses to rate-limit form submissions and Ask MxD requests and block abuse. Chat analytics records whether the chat was opened, an approved answer was shown or the contact form was opened; they do not include the text of your question. You can turn analytics off for your browser at any time on our analytics settings page; the setting applies across mxd.digital, go.mxd.digital and our client portal.

4. Cookies and similar technologies

We and our analytics and advertising providers set cookies and use similar browser storage. These support core site functions (such as remembering that you already submitted a form), measurement of site usage, and measurement of advertising on LinkedIn and OpenAI. You can clear or block cookies in your browser settings; core pages will continue to work, though some conveniences will not.

5. Why we use it, and on what basis

We use your information to respond to enquiries and provide the service or tool you asked for, including selecting a website answer when you use Ask MxD (necessary to take steps at your request prior to entering a contract, or to perform one); to send marketing about our services where you have asked for it or where we have a legitimate interest in contacting a business about services relevant to it; to measure and improve the site and our advertising (legitimate interests, or consent where required for cookies); and to comply with our legal obligations. You can object to processing based on legitimate interests, and you can opt out of marketing at any time using the unsubscribe link in any email or by emailing us.

6. Who we share it with

We do not sell personal information. We share it with service providers who process it on our behalf, under contract and only on our instructions:

  • Vercel - website and application hosting.
  • PostHog - product analytics and session measurement.
  • Google (Tag Manager, Analytics) - website measurement.
  • OpenAI - advertising measurement via the OpenAI Pixel and server-side conversion events, including a hashed email address for conversion matching; and routing Ask MxD questions to approved website answers. Chat questions are sent without contact-form details and are not used to train OpenAI models by default.
  • LinkedIn - advertising measurement and conversion tracking via the LinkedIn Insight Tag.
  • Our customer relationship management system - so an enquiryreaches the right person and we can follow up.
  • Resend - delivery of transactional and notification email, including Ask MxD magic links.
  • Upstash - rate-limiting records that protect forms and Ask MxD from abuse, an encrypted short-lived sign-in link, your encrypted chat session, encrypted chat history and an aggregate monthly chat-spending counter.

7. International transfers

Some of these providers process data outside the United Kingdom and the European Economic Area, including in the United States. Where that happens we rely on the transfer mechanisms those providers make available, such as the UK International Data Transfer Addendum or Standard Contractual Clauses, together with additional safeguards where appropriate.

8. How long we keep it

We keep enquiry and client-contact records for as long as needed to deal with your enquiryand to maintain the business relationship, and afterwards only as long as we need them for our legitimate business or legal purposes. Analytics records are kept in line with our providers' retention settings. Ask MxD saves the latest 20 conversations for your verified work email, with up to 30 exchanges in each. The records are encrypted and expire within 90 days after the last exchange in that conversation. OpenAI may retain API inputs and outputs in abuse-monitoring logs for up to 30 days. Chat sign-in links expire after ten minutes or on use, and chat sessions after seven days or when you sign out. Sign-in rate-limit records expire within 30 days; the aggregate spending counter expires after 35 days. You can ask us to delete your data sooner - see the next section.

9. Your rights

Depending on where you live, you have rights to access the personal information we hold about you, to have it corrected or deleted, to restrict or object to how we use it (including for direct marketing), and to receive it in a portable format. Where we rely on consent, you can withdraw it at any time without affecting processing that already happened - for analytics, on our analytics settings page. To exercise any of these, email [email protected]. There are step-by-step deletion instructions, including for data received through Meta platforms, on our data deletion page. If you are unsatisfied with our response you can complain to your data protection regulator; in the UK that is the Information Commissioner's Office (ico.org.uk).

10. Children

This site is aimed at businesses and is not directed at children. We do not knowingly collect personal information from anyone under 16.

11. Security

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls on the systems that hold enquiry data, and rate limiting on our forms. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy from time to time. The current version will always be available at this page, with the effective date above.

13. Contact

Questions about this policy, or about the information we hold on you, go to [email protected]. For anything else, [email protected] reaches us.