A short, honestprivacy notice.

1. Who we are

Oleka, which you’ll see on this site as Oleka Ai, is the trading name of THESONDERWAY LTD, a company registered in England and Wales under number 15674127. Its registered office is Flat 51 Austen House, Station View, Guildford GU1 4AN, and you can reach us at contact@oleka.co.uk.

For UK GDPR purposes THESONDERWAY LTD is the data controller for any personal data collected through this site, through direct enquiries, or through us contacting you first (§6).

2. What we collect

• Booking data. When you book a discovery call, our scheduling provider (Calendly) collects your name, email, time-zone and any answers you give to its intake questions.
• Email correspondence. Anything you send us by email, plus standard message metadata.
• Chat messages. What you type into the assistant on the home page. To answer you, your message is sent to OpenRouter (§7), which passes it to the two models that reply. We ask OpenRouter to route only to providers that don’t store or train on what you send, and we use paid accounts whose terms exclude training. We keep no copy ourselves: the conversation lives in your browser while the tab is open and is gone when you close it. It’s still a chat box on the open internet, so please don’t paste anything confidential.
• Enquiry form. Your name, email, company if you give it, and your message. It is emailed to our inbox through Migadu, our email host (§7), and kept like any other email. We store it nowhere else.
• Essential storage. Two flags, kept in your own browser. One records that you’ve dismissed the cookie notice, the other that you’ve seen the welcome message. Nothing else is stored on your device, and this site runs no analytics.

3. What we don’t collect

We don’t use third-party advertising pixels, fingerprinting scripts, session replay tools, or behavioural retargeting. We do not sell or rent data to anyone, ever.

4. Why we hold it · lawful bases

• Steps before a contract. When you book a call, send the enquiry form or email us about work, we use what you send to reply, talk it through and give you a price.
• Legitimate interests. Answering what you type into the site assistant, running the website and fixing bugs, which means our host keeps short-lived server logs.
• Contract. Once we’re working together, handling project files, invoices and credentials.
• Consent. If you opt into anything specifically (e.g. a future newsletter), you can unsubscribe at any time.

5. How long we keep it

Project files and contracts are retained for six years after final invoice (UK statutory minimum). Discovery-call notes that don’t result in an engagement are deleted after 90 days. Emails and enquiry form messages that don’t lead to an engagement are deleted two years after our last contact. Business contacts we approached first are different, and are covered in §6.

6. If we emailed you first

Sometimes we approach a business we think we can help, without it having contacted us first. If that is how you found this page, this is the section that applies to you. We did not get your details from you, so UK GDPR says we owe you the following the first time we get in touch.

What we hold

Your name, your job title, the company you work for, a work email address that company has published, and a note of where we found it. Nothing else: no personal addresses, no phone numbers, no profiling, and nothing about you outside your job.

Where it came from

A public source: the company’s own website, or a public register such as Companies House. If you ask us which one it was in your case, we’ll tell you.

Why we hold it

Our legitimate interests: offering services that are relevant to your business. We have weighed that against your privacy, and it is a narrow case: these are work contact details the company has already published, the message is about your work rather than about you, and one reply stops it for good.

How long we keep it

12 months from our last contact with you, then we delete it. Ask us to delete it sooner and we will, without asking why. The one thing we keep after that is the bare minimum needed to make sure we don’t contact you again by mistake.

Who else sees it

The list itself lives on our own computer in the UK, not with a hosting company. Beyond that, the only outside parties involved are Migadu (Switzerland), Google (USA), OpenAI (USA) and Anthropic (USA). What each one is for is set out in §7, along with what it means that some of them are outside the UK. We don’t sell your details, rent them, or pass them to anyone for their own marketing.

Your right to object

You can tell us to stop, and we will stop. Email contact@oleka.co.uk and say so. You don’t need to give a reason, we won’t ask for one, and we’ll confirm once it’s done. The other rights in §8 (seeing what we hold, correcting it, having it deleted, and complaining to the ICO) apply here too.

Who is responsible

The controller is THESONDERWAY LTD (trading as Oleka), registered in England and Wales, company number 15674127. Registered office: Flat 51 Austen House, Station View, Guildford GU1 4AN. Contact: contact@oleka.co.uk.

7. Sharing

Personal data goes only to the service providers needed to run the studio. That’s the full list. We don’t share with anyone else without writing to you first, and we never sell it.

• Calendly (USA): booking discovery calls.
• Vercel (USA): hosting this site and running the assistant and enquiry form; its servers see your IP address and keep short-lived request logs.
• OpenRouter (USA): generating the two replies in the site assistant. It passes your message to the model that answers: Anthropic (the Claude reply) and Google (the Gemini reply).
• Migadu (Switzerland): hosting the studio mailbox that sends and receives our email, including delivering what you send through the enquiry form.
• Google (USA): hosting the second mailbox some studio email is sent from.
• OpenAI (USA): researching a business we might approach, and drafting the first message.
• Anthropic (USA): the same research and drafting work, through a second assistant.
• A UK accountant (UK): invoicing, once an engagement begins.

Several of these are based in the United States, so some data leaves the UK. Each one sets out its own safeguards for that in the terms linked above, and those are the versions that stay current. We’d rather point you at them than copy a claim here that quietly goes out of date. If you want the specifics for your own records, email us and we’ll pull them together. List last reviewed: October 2026.

8. Your rights

Under UK GDPR you have the right to access, correct, delete, restrict, port, and object to processing of your personal data. Email contact@oleka.co.uk and we’ll respond within one month. If you are unhappy with how we have handled your data, tell us first at the same address and we will acknowledge your complaint within 30 days. You can also complain to the UK Information Commissioner’s Office at ico.org.uk.

9. Changes

If we materially change how we handle data, we’ll update the effective date at the top of this page and, if reasonable, notify clients with active engagements directly.