What we collect, why, and what stays with you.

Controller

MARGO LEGAL LTD is the controller. Company number 17322603. Registered in England and Wales. Registered office: 66 Paul Street, London, England, EC2A 4NA. Contact: hello@margolegal.com. Source: Companies House record for MARGO LEGAL LTD, company number 17322603.

What we collect

A course subscription uses your work email, the signup source, the consent-notice version and the subscription, confirmation, delivery, bounce and unsubscribe events needed to operate the course. A 20-minute call request can include your first and last name, work email and law firm. Do not submit client names, matter details, contract text, legal questions, privileged material or special-category data.

Margo waitlist

Joining the Margo waitlist requires only your work email address and separate consent to Margo product updates. The form is submitted through Netlify Forms and the submission is stored with our website hosting at Netlify; a hidden honeypot field provides bot protection. Applying to the design-partner programme collects your firm, role, commercial-contract team size, the workflow you would want measured, its approximate volume, your work email and your consent to take part in research sessions - non-confidential business information only. There are no email open pixels or click-tracking links, and joining does not enrol you in the course or grant access to Margo.

Unconfirmed requests are removed after 30 days. Inactive confirmed profiles are removed after twelve months. Readable profile and message details are removed 30 days after unsubscribe, bounce or complaint; a minimal email suppression hash remains to prevent further contact. Records involved in an unresolved delivery are held for reconciliation before cleanup. Unsubscribe stops future queued messages immediately, although a message already being sent may still arrive.

Fit-review call requests

You can request a 20-minute call by emailing hello@margolegal.com. We use your name, work email, firm and any times you suggest to arrange the call, and we may send a Google Meet invitation through Google Workspace. If we send you a Google Calendar booking link and you use it, Google processes the booking details. Requesting a call creates no engagement and does not enrol you in any Margo Legal email list. Please do not include client names, matter details or confidential information in your request.

Legal AI Operating Essentials course

The optional seven-day Legal AI Operating Essentials course uses separate course-specific consent. Margo Legal sends a confirmation email first through Google Workspace. The seven lessons begin only after you confirm the work email, and each plain-text message includes a direct unsubscribe route. The course uses no open or click tracking. Opening or downloading a resource, completing a score, booking a call, receiving cold outreach or connecting on LinkedIn never subscribes you.

Readiness Score

The twelve score answers and calculation stay in your browser. Margo Legal does not receive the raw answers through the score. A later fit-review request is a separate action.

Emailed results and resource requests

The Margo waitlist is open for the product update described on the signup form. The waitlist uses Netlify form handling and explicit consent at collection. Any other email request, if enabled, will use its own consent form, no download or tool will require one, and we will record your email address, request purpose, source page, exact consent wording, consent time and any requested result snapshot. The address is used only for the stated purpose: the one-off item and a single one-off reply about it, or the newsletter you explicitly joined. The lawful basis is your consent, which you can withdraw at any time by replying to the message or contacting hello@margolegal.com.

Website score requests. If you request a website score, we collect your name, work email, business name and website address. We use them to run public checks on that website, email you the one-page score and follow up once about it. The form is handled by Netlify Forms; submissions are stored by Netlify in the United States under the UK Extension to the EU–US Data Privacy Framework. We delete submissions from Netlify within 30 days and keep the request and score record for up to 12 months from our last contact, unless you become a client. You can ask us to stop at any time by replying "stop" or emailing hello@margolegal.com.

Review and audit enquiries

If you ask about the Website & AI-Visibility Review or the AI Visibility Audit using the form on that page, we collect your name, work email, business or firm name, website address and, if you give it, who looks after your website. We use them only to reply about that service. Our lawful basis is taking steps you ask for before a possible contract. The form is handled by Netlify Forms; submissions are stored by Netlify in the United States under the UK Extension to the EU–US Data Privacy Framework. We delete submissions from Netlify within 30 days and keep the enquiry record for up to 12 months from our last contact, unless you become a client. You can ask us to stop at any time by replying "stop" or emailing hello@margolegal.com.

Retention once enabled: a one-off request, its snapshot and its delivery record are removed within 30 days of delivery. Newsletter records are removed within 30 days after you unsubscribe or a delivery permanently fails, and a one-way suppression hash remains to honour the unsubscribe. Consent records are kept for as long as the consent they record is relied upon.

Business research and outreach

Margo Legal may contact a limited number of people at incorporated law firms about professional workflow research and relevant Margo Legal resources. For this purpose, we may use your professional name, role, work email, firm, firm website, public professional profile, public professional posts, comments, reposts with added words, public descriptions of the firm’s services and our records of delivery, replies and objections. We do not use client-matter information, private-life information or special-category data for this outreach.

These details may come from your organisation's website and press releases, Companies House and other public professional and company registers, public professional profiles, lawful business directories, public company-research services, and any replies you send us. Public availability is not treated as consent. Provider output may be used as a research hypothesis, but it is not treated as proof of a firm’s private working conditions.

We may also email one relevant person at an incorporated business (a limited company, LLP or PLC), including law firms, to offer Margo Legal's services, such as a no-charge website score, website and AI-visibility reviews, AI training and policy work or propose a referral partnership. We use your name, role, work email, business name and website, findings from public checks of that website, and our records of delivery, replies and objections. We rely on legitimate interests. We may also record your public LinkedIn profile address and connect with you or comment publicly on your posts there. We won't send you sales messages on LinkedIn. Connection requests and comments may be sent by an automated assistant acting for Hamza Suleman, within limits he sets. You can object at any time by replying "stop" or emailing hello@margolegal.com, and we will not contact you again.

Purposes and lawful basis

We use fit-review details to arrange the call you request and to assess whether a possible engagement is suitable. We send the seven-day course only on consent, recorded through its dedicated form and confirmation step; you may withdraw that consent at any time. Emailed results, resource requests and the newsletter are sent only on the consent recorded through their own separate forms. Website score requests are different: we run the checks and send your score because you asked us to, and we rely on legitimate interests for a single follow-up email about it. You can object at any time. For the bounded business-research pilot, we rely on legitimate interests to identify one relevant professional contact at an incorporated firm, ask a proportionate workflow question and evaluate whether the research should continue. We balance that interest against the person’s rights through strict targeting, one contact per firm, limited data, human approval of templates and selection criteria, tracking disabled, an easy opt-out and immediate suppression. You may object to direct marketing at any time.

We may use minimal technical records for security and service reliability under our legitimate interests, balanced against your rights. Downloading a resource does not subscribe you to a course or newsletter.

Google Analytics 4 and consent

With your consent, the public website loads Google Analytics 4 to understand page views, broad traffic sources, devices and engagement. Google Analytics may receive the static page title, the page URL and referrer without query strings or fragments, device and browser details, approximate location and online identifiers stored in analytics cookies. Margo Legal does not send form contents, email addresses, firm names, Readiness Score answers or search terms to Google Analytics. It sends the small set of custom events listed in the Cookie Notice, each only with the detail named there, and it does not send Web Vitals telemetry. Analytics cookies and the Google tag remain disabled until you select Accept analytics. Google explains how it uses information from sites that use its services.

You can select Decline analytics and continue using the website. You can withdraw or change consent at any time through the Analytics choices control. Withdrawing replaces the accepted choice with a declined choice, disables analytics for the current page and removes Margo Legal’s Google Analytics cookies. It does not affect earlier processing based on consent. See the Cookie Notice for cookie names and controls.

Selection and checks

Public firm information may be checked against fixed size, practice and workflow criteria before outreach. Public evidence may also be used to select a short opening or relevant resource. A person approves our message templates and selection criteria. Each batch is then checked against them before release, using automated tools. This process does not make a legal or similarly significant decision about you.

Bounded public-source research with Exa

For a bounded, separately approved research experiment, Margo Legal may use Exa to search known law-firm domains for public firm pages about commercial-contract teams, named practice leaders, supplier-side contract work, firm news and legal-technology activity. We may also use firm and role terms to locate public professional profile candidates for an already verified decision-maker. No names, work emails or private notes are included in Exa firm-domain search queries. No existing contact name, work email or private note is included in those People Search queries. Exa results are treated only as private source candidates: Exa does not verify email addresses, clear suppression, certify Margo Legal's firm criteria or make a person eligible for outreach. Each retained source is checked and matched against approved criteria, using automated tools, before it can affect research or message preparation.

Bounded public professional activity research

For a bounded, separately approved research batch, Margo Legal may use Apify and a selected limited-permission Actor provider to retrieve recent public posts, comments, reposts and firm posts from already known public professional or company profile URLs. The batch uses no LinkedIn account cookies or private messages. A bare reaction or like is not treated as proof of interest, need or private working conditions and is not quoted as personalisation. Every retained source requires an exact public URL, date, excerpt and matching identity, and is checked against approved criteria using automated tools. This research does not send LinkedIn connection requests or messages.

Processors and recipients

The website host serves the public pages. Cloudflare provides the anti-bot check, stores the minimum course consent, confirmation, delivery, bounce and unsubscribe state in D1, and releases each due plain-text message directly to the Google Workspace Gmail API. Google Workspace sends it from Margo Legal. This route adds no open pixels and does not rewrite links for click tracking. Google Calendar and Google Meet process fit-review bookings and meeting invitations. Google Analytics 4 processes optional website analytics after consent. A specialist outbound-email service may distribute an authorised business-research message and record delivery, reply, bounce and suppression status. Exa may support the bounded firm-domain research described above. Apify and the selected limited-permission Actor provider may support the bounded public professional activity research. Approved AI or research services may otherwise help structure public-source research before it is checked against approved criteria. We do not sell personal information. Processor access is limited to providing the relevant service and is subject to its terms and safeguards.

International transfers

Some processors may handle information outside the United Kingdom. Where that happens, we rely on the processor's stated transfer safeguards and contractual protections. Ask us if you want the current processor and transfer details for your request.

Retention

Google Analytics event and user-level data is configured for the shortest practical property retention available for the reporting need; aggregate reports may remain longer. Analytics cookies can persist for up to two years unless you withdraw consent or delete them sooner. An unconfirmed course request and its queued confirmation are removed after three days. Course operational profile and message data is removed within 30 days after the course ends, you unsubscribe, or a delivery permanently fails, unless another separately consented purpose applies. For a bounce or complaint, a one-way email hash and the suppression reason may be retained to prevent another send; the message and readable address are removed. Unsuccessful or inactive 20-minute call requests are normally deleted or anonymised after twelve months. Public-source outreach research, message and delivery records are deleted or anonymised within 180 days of the last authorised touch unless a shorter pilot schedule applies. A minimal suppression record may be retained for as long as needed to honour an objection and prevent further contact. Client records follow the relevant business and legal retention schedule. We may retain a record longer where needed to establish, exercise or defend legal claims.

Your rights and objections

You may ask for access, correction, deletion, restriction, portability or an objection where the law provides it. The right to object to processing for direct marketing is absolute. Reply stop to an outreach email or contact hello@margolegal.com; Margo Legal will stop the contact and maintain only the suppression information needed to respect your request.

Complaints

Contact us first if you would like us to resolve a concern. You can also complain to the Information Commission (still known as the ICO), the UK supervisory authority.

Changes

Material changes will be dated on this page. We will not turn a one-off request into newsletter consent.