/Legal
out sauce and broch (WATTWAY LTD) · Last updated: 7 October 2026
out sauce and broch are trading names of WATTWAY LTD, a company registered in England and Wales (company number 15205774), registered office 66 Herbert Gardens, London NW10 3BU. In this notice, “we” and “us” means WATTWAY LTD, and it covers the out-sauce.ai and broch.ai websites and the broch app at app.broch.ai.
This notice explains what personal data we collect through our websites and in the course of running our business, why we collect it, and your rights. It applies where we decide how and why your data is used (where we act as a “controller”).
One important boundary: when we build and run data and AI tools for our clients, we handle personal data inside those projects on our clients' instructions, as a processor under a signed data processing agreement. That processing is governed by the client's own privacy notice and our DPA, not by this notice. Our sub-processors for that work are listed at out-sauce.ai/subprocessors, and the AI providers we use at broch.ai/ai-providers.
Enquiries. When you contact us by email or through a contact form, we collect your name, email address, company, and whatever you include in your message. We use it to respond to you and follow up on your enquiry. Legal basis: our legitimate interest in responding to people who contact us and in developing our business.
Bookings, on out-sauce.ai. If you book a call through out-sauce.ai, we collect your name, work email, your answers to a few short questions about your business, and your chosen time slot. The booking runs on our own site and is stored in our database so we can prepare for and hold the call. We also email its details to our own team when it comes in. Legal basis: legitimate interest, as above.broch.ai has no booking form; you reach us there by email.
The product demos, on app.broch.ai. There are two demos, one for an ecommerce business and one for a lead gen business. To open either you give us your email address, and we email you a 6-digit code to confirm it is yours; the same code opens both. We keep that address (and, if it is a work address, the company it belongs to), when you were in a demo, which demo and which screens you opened, which link brought you there, your browser type, and any questions you ask Brainwaves there. We use this to know which businesses are looking, to follow up if you would like us to, and to see which parts of the product people care about. Brainwaves questions are answered by OpenAI, the AI provider behind that feature.There is no third-party analytics and no advertising anywhere on app.broch.ai. Legal basis: our legitimate interest in showing our product to people who ask to see it.
Signing in to your dashboard, on app.broch.ai. If you are a client, your work email signs you in with a 6-digit code we email you. We record when you were last there and which screens you open, so we can see which parts of your dashboard are used and support you better. That record is made by our own server as pages load; nothing runs in your browser to do it. We keep it for 12 months. Legal basis: our legitimate interest in running and improving the service we provide you.
Newsletter. We don't send a newsletter today. If we launch one, signing up will be a separate, clearly marked choice: we will collect your email address only with your consent, and every email will include an unsubscribe link. Legal basis: your consent, which you can withdraw at any time.
Clients and suppliers. If you work for a client, prospective client or supplier of ours, we hold your business contact details, correspondence and contract records. Legal basis: performance of a contract, and our legitimate interest in managing our business relationships. We keep contract records for six years after the relationship ends, in line with limitation periods.
Referral and affiliate programmes. If you take part in the out sauce referral programme or the broch affiliate programme, we process your details and those of the person you introduce in order to run the programme, including identifying referrer and referred client to each other as set out in that programme's terms. Legal basis: performance of the programme terms, and consent for the introduction itself.
Website analytics. On out-sauce.ai, with your consent, we use PostHog to understand how the site is used: pages visited, approximate location (city level), device and browser type, and how you found us. PostHog is hosted in the EU and sets cookies only if you accept them in the cookie banner. Legal basis: your consent. You can change your mind at any time via the “cookie settings” link in that site's footer.broch.ai runs no analytics at all today, and sets no cookies. If that changes, we will update this notice and ask for your consent before anything is set.
Web fonts and scripts. Both websites, and the app's sign-in page, load their typefaces from Google Fonts, so your browser requests those files from Google and Google receives your IP address as part of that request. Pages inside the app also load two script libraries from public content delivery networks (jsDelivr and Tailwind), which receive your IP address when your browser fetches them. No cookie is set by any of it. Legal basis: our legitimate interest in serving the sites as designed.
Website logs. Our hosting providers keep short-lived technical logs, including IP addresses, for security and to keep the sites running: Vercel for out-sauce.ai, and Railway for broch.ai and app.broch.ai. Legal basis: legitimate interest in running a secure website.
We use a small number of service providers who process data on our behalf: Google Workspace (email, documents and storage), Supabase (database and account storage, UK and EU regions), Anthropic (AI processing for client features where enabled, United States), Vercel (out-sauce.ai hosting, EU region), Railway (broch.ai and app.broch.ai hosting, United States), Resend (sends the demos' sign-in codes and emails our team the details of a new booking, United States), OpenAI (answers Brainwaves questions in the demos, United States), and PostHog (analytics on out-sauce.ai, EU-hosted, only with your consent). Each is bound by a data processing agreement. Separately, Google Fonts serves the typefaces on both sites and receives your IP address when your browser fetches them.
We do not sell personal data, and we do not share it with third parties for their own marketing.
We may also disclose personal data where the law requires it, or to professional advisers (lawyers, accountants, insurers) under confidentiality obligations.
Most of our providers process data in the UK or EU. Railway, Resend, OpenAI and Anthropic process data in the United States: for those transfers we rely on the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum. Where a US provider is certified under the UK Extension to the EU-US Data Protection Framework, we may rely on that instead. The same safeguards apply to any other provider processing outside the UK or EU. Where we can, we choose UK or EU hosting regions.
Enquiries and bookings that go nowhere: deleted within 12 months. Demo sign-ins and the screens viewed: 12 months after the last visit. Client sign-ins: which screens you opened, 12 months from the day you opened them. Client and supplier records: six years after the relationship ends. Analytics data: 12 months in PostHog. Website logs: 30 days.
broch.ai sets no cookies. There is no analytics on it and nothing to consent to, which is why you have not been asked. app.broch.ai sets one strictly necessary cookie after you verify your email, for the demos and for client sign-ins alike, to keep you signed in for 30 days; it sets no analytics cookies.
out-sauce.ai uses two kinds. Strictly necessary cookies make the site work: for example, remembering your cookie choice. These do not need consent. Analytics cookies (PostHog) are set only if you accept them in the banner, and you can change or withdraw that choice at any time via “cookie settings” in that site's footer.
You have the right to ask us for access to your personal data, to have it corrected or deleted, to restrict or object to our processing of it, to receive it in a portable format, and to withdraw consent where consent is our basis for processing. To exercise any of these, email legal@out-sauce.ai. We respond within one month.
If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk, though we would appreciate the chance to resolve it first.
WATTWAY LTD (trading as out sauce and broch), 66 Herbert Gardens, London NW10 3BU. Email: legal@out-sauce.ai.