Privacy notice
We ask only for information needed to understand and deliver the agreed work. Do not send passwords, credentials or unnecessary customer records. The sections below explain what may be used, why, who may process it and how long it is intended to be kept.
The applicable basis depends on the person and purpose. Coral Shark does not treat one legal basis as covering everything.
Where Coral Shark relies on legitimate interests, the interests are providing and securing a requested B2B service, maintaining reliable business records, preventing misuse and improving the service proportionately without overriding the rights and freedoms of the people whose information is involved.
Coral Shark is VAT registered. VAT registration number 526 782 857. Effective date 1 January 2026.
Most contact and workflow information comes directly from you or from the business you represent. Technical, order, payment, delivery and security records may also be created by Coral Shark’s systems and service providers as the service operates. If a customer later supplies information about another person, Coral Shark expects that information to be relevant, lawful to share and limited to what the workflow genuinely needs.
AI-assisted analysis can structure or interpret workflow evidence, but Coral Shark does not use the ordinary Owner’s Brief to make solely automated decisions about an individual that produce legal or similarly significant effects. Consequential price, scope, legal, relationship or similar business decisions remain human-controlled unless a separately approved deterministic rule genuinely determines the answer.
Evidence boundary
Coral Shark separates FACT, ESTIMATE, INFERENCE and UNKNOWN. A statement you provide remains your evidence. A calculation is labelled as a calculation. AI-assisted structure or interpretation remains inference unless independently verified and must not silently overwrite direct evidence.
No OpenAI analysis capability is active in this content-only publication. If bounded analysis is separately activated later, the OpenAI API may receive workflow evidence required for that analysis. A prior controlled proof used store:false; no claim is made that Coral Shark has verified Zero Data Retention, Modified Abuse Monitoring, regional storage or actual retention settings for a future account. Provider retention and processing rules remain provider facts rather than Coral Shark guarantees.
In this content-only publication, Cloudflare delivery and security and Google Workspace human email may be active. Resend, OpenAI and Stripe capabilities are not active; they are named below only as conditional future providers if the relevant service capability is separately authorised and activated. Coral Shark does not claim that all information stays in the UK or EU. The safeguard for any transfer without applicable UK adequacy regulations must be identified from the provider, purpose and verified account and contract position. This notice does not state that the coralshark.co Google Workspace account has accepted a Google CDPA, SCCs or a UK Addendum. Contact hello@coralshark.co if you want the currently verified information about a particular active transfer.
Cloudflare may provide content delivery, DNS and security for the public site. A production D1 database exists for separately gated capabilities, but no database-backed customer action is active in this content-only publication. EU jurisdiction for that database does not mean every Cloudflare processing activity is EU-only.
The verified hello@coralshark.co mailbox is provided through Google Workspace and may be used for human business email. No claim is made here that this account has Google Vault, legal-hold controls or a configured data region.
Resend transactional email is not active in this content-only publication. It may be used later for service messages only after that capability and its actual processing settings are separately verified and activated.
OpenAI API analysis is not active in this content-only publication. It may be used later for bounded workflow interpretation only after that capability and its actual account, retention, region and transfer settings are separately verified and activated.
Stripe payments are not active in this content-only publication. Stripe is a possible future card-payment provider only if paid checkout and its actual processing settings are separately verified and activated.
Provider terms, sub-processors, locations and account settings can change. Coral Shark must verify the actual configuration before activating or materially widening customer-data processing.
Retention is purpose-specific and can be extended where information is needed for a legal claim, dispute or security investigation. Human email is kept only while it is needed to respond to the enquiry, provide or support a requested service, handle a complaint, maintain necessary business records, meet a legal obligation or deal with a security issue. Google Workspace inbox and archive messages are not automatically deleted, so no fixed deletion date is promised for that email.
The separately controlled application-data design uses these baselines when the relevant gated capability and record class exist:
Depending on the circumstances and lawful basis, UK data-protection law can give you rights to request access, correction, deletion, restriction or portability of personal data. Rights are not absolute and can be limited by legal obligations or the need to establish, exercise or defend legal claims.
Where Coral Shark relies on legitimate interests, you can object to that processing. Coral Shark will consider the objection and stop the processing unless there are compelling legitimate grounds to continue or the processing is needed for legal claims. You can always object to direct marketing; Coral Shark does not currently infer direct-marketing permission from an ordinary service enquiry.
Send a request to hello@coralshark.co. Coral Shark may need enough information to verify the request safely.
You may send a data-protection complaint electronically to hello@coralshark.co. Coral Shark will acknowledge receipt within 30 days, make appropriate enquiries, keep you informed without undue delay and communicate the outcome without undue delay. This is an acknowledgement commitment, not a promise that every complaint will be resolved within 30 days. You also retain the right to complain to the UK Information Commissioner’s Office (ICO).
This notice should be reviewed whenever the service, provider set, storage/access technology, purpose or retention model changes materially. New uses of personal information must not be hidden behind an old notice.
The current Phase‑1 build does not intentionally set non-essential advertising or cross-site tracking cookies. Its bounded first-party commercial events do not need to copy raw workflow narratives or customer identity into anonymous acquisition events. Before publication, the rendered build must be scanned again for cookies, pixels, local/web storage, link-decoration behaviour and any third-party scripts. If storage/access technology is used, Coral Shark must explain the technology, purpose, third parties and duration and obtain consent unless a current PECR exception genuinely applies.
Status
The controller identity, address, verified mailbox, current provider activity and lawful-basis explanation have been populated from durable operating evidence. Account-specific Google contractual safeguards and controls are not represented as verified. Marking this notice “reviewed” is deliberately withheld until the rendered website/legal surface is accepted under the separate legal/publication gate.