Last updated 2 November 2026

Privacy policy

This policy explains what personal data FALLINGHIPPO LIMITED collects through fallinghippo.com, through email and through our company social media pages, why we collect it, who we share it with, how long we keep it and what your rights are. Our apps each have their own privacy policy, because each one handles different data.

1. Who we are

fallinghippo.com is run by FALLINGHIPPO LIMITED, which trades as FallingHippo. In this policy "we", "us" and "our" mean that company. We decide why and how the personal data described here is used, which makes us its "controller" under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Company

FALLINGHIPPO LIMITED

Company number

17415391, registered in England and Wales

Registered office

71-75 Shelton Street, London, England, WC2H 9JQ

Email

[email protected]

Data protection registration

ZC264249 (Information Commission register of fee payers)

We haven't appointed a data protection officer. The law only requires one for public bodies and for organisations whose core work involves large-scale monitoring of people or large-scale use of sensitive data, and we do neither. One of our directors is responsible for data protection, and privacy questions sent to the address above are read and answered by a person.

2. What this policy covers

This policy covers personal data we handle when you:

• visit fallinghippo.com or any page on it;
• email us, or write to us by post;
• follow, message or comment on our company pages on social media, such as LinkedIn, TikTok and X;
• work with us, or work for a business that supplies us or partners with us.

It does not cover our apps. Each app, such as usBox, has its own privacy policy that explains the data that app uses. Where a page on this site collects details for one of our apps, for example a waitlist, the form links to that app's policy and that policy applies to what you enter. This policy also doesn't cover websites run by other people that we link to.

3. A few terms we use

• Personal data means any information about you from which you can be identified, directly or indirectly. Your name, email address and IP address are all personal data.
• Controller means the organisation that decides why and how personal data is used. For this policy that's us.
• Processor means a company that handles personal data on a controller's behalf and only on its instructions, such as our web host.
• Processing means anything done with personal data, including collecting, storing, reading, sharing and deleting it.

4. What we collect and where it comes from

When you visit the site

You don't need to sign up or give us anything to use this site. When your browser asks for a page, our web host, Cloudflare, automatically receives and logs some technical information, as any web server does. This usually includes:

• your IP address, which can show your approximate location (country or town, never your street);
• the date and time of the request and the page or file requested;
• your browser type and version, operating system and device type, as your browser reports them;
• the address of the page that linked you here, if your browser shares it;
• security information, such as whether a request looks like it comes from an automated attack.

This comes from your device. We don't combine it with anything else to work out who you are.

When you email or write to us

We receive your email address, your name if your email shows it, the content of your message, any attachments, and the technical details that come with any email, such as the time it was sent. If you write by post, we receive your name and address and what you write. We only get what you choose to send. Please don't send us sensitive information, such as details about your health, unless we've asked for it.

When you send us ideas or feedback

If you send us an idea for an app, or feedback on something we make, we receive it along with your contact details. Our terms of use explain how we treat ideas.

When you interact with our social media pages

If you follow, message, mention or comment on our pages on LinkedIn, TikTok, X or another platform, we can see your public profile name and picture, what you write to us or about us, and anything else your settings make visible. The platform also gives us statistics about visits to our pages. These come to us as totals, such as how many people from a region viewed a post, and don't identify you.

When you do business with us

If you, or the business you work for, supplies us or works with us, we hold your name, job title, work email and phone number, and our correspondence and records of what we agreed. These come from you, from your employer, or from public sources such as your company's website or LinkedIn profile.

What we don't collect

We don't collect sensitive ("special category") data such as health, religious beliefs, ethnicity or sexual orientation through this site, and we don't collect information about criminal convictions. We don't buy personal data from data brokers or anyone else.

5. How we use it and our lawful basis

Data protection law only lets us use personal data where we have a lawful basis. The table below lists every way we use the data in section 4, the basis we rely on and how long we keep it. Section 6 explains our legitimate interests in more detail.

You don't have to give us any personal data to browse this site. If you want a reply to a message, we need a way to contact you. We don't use your data for any purpose that isn't in this table. If we ever want to use it for a new purpose, we'll check it's compatible with the original one, or ask for your consent, and update this policy first.

6. Our legitimate interests

"Legitimate interests" is a lawful basis that lets an organisation use personal data for a genuine reason, as long as that use is necessary and isn't outweighed by your interests, rights and freedoms. Where we rely on it, we have done this balancing exercise. In summary:

• Running and securing the site. Every website has to receive basic technical information to send pages to your browser. Using it to spot attacks protects you as well as us. The data is limited, short-lived and not used to identify or profile you. Security of networks and systems is also one of the "recognised legitimate interests" listed in the Data (Use and Access) Act 2025.
• Answering messages. If you write to us, you expect a reply. We only use your message for that conversation and the record of it.
• Running our business. Keeping records of who we work with and what we agreed is ordinary business practice and something you'd expect.
• Legal claims. Keeping relevant records for the time a claim could be made protects both sides.

You have the right to object to any use based on legitimate interests (see section 13). If you'd like a copy of our assessment for a particular use, email us.

7. Cookies and similar technologies

Cookies are small files a website saves on your device. Similar technologies include local storage, pixels and device fingerprinting. The Privacy and Electronic Communications Regulations 2003 (PECR) say a website must ask for your consent before storing or reading anything on your device, unless it's strictly necessary for a service you asked for or falls within a small number of other exceptions.

This website sets no cookies and uses no similar technologies. It doesn't use local storage, analytics, advertising tags, social media buttons or embedded videos. Our fonts, images and scripts are served from fallinghippo.com itself, so loading a page doesn't send your details to Google or any other company. That is why there is no cookie banner.

Our host, Cloudflare, may in some situations set a security cookie to tell people apart from automated attacks. That would fall under the "strictly necessary" exception and wouldn't need consent. We have checked the site and none is set at the moment. If that changes, we'll list the cookie here.

If we ever decide to add analytics or anything else that stores information on your device, we'll update this section first and ask for your consent where the law requires it. Recent changes to PECR allow some low-risk analytics without consent, provided we tell you and give you a simple, free way to object. We'd explain any such use here before it started.

8. Marketing

We don't have a mailing list for this site and we don't send marketing emails. If you email us, we won't add you to a list. If we ever start a newsletter, we'll only send it to people who have actively signed up, and every email will have a simple way to unsubscribe, as PECR requires.

9. Who we share it with

We don't sell personal data, rent it or share it with advertisers. We share it only in the situations below.

Companies that process data for us

These companies act as our processors. They may only use personal data on our instructions and to provide their service to us, under written contracts that meet the requirements of Article 28 of the UK GDPR.

Professional advisers

We may share relevant information with our accountants, lawyers and insurers where they need it to advise us or provide their service. They are bound by professional duties of confidentiality and act as controllers in their own right.

Social media platforms

When you use our pages on LinkedIn, TikTok, X or another platform, the platform collects data about you under its own privacy policy, which you can find on its site. For the page statistics described in section 4, the platform and we may be "joint controllers". Where that's the case, the platform's terms set out who is responsible for what, and the platform handles requests about the data it holds. You can also contact us.

The authorities

We'll disclose personal data to the police, a court, a regulator or another public body if the law requires us to, or where it's necessary to prevent or detect crime or to protect someone's safety. We share only what is needed and check that each request is lawful.

If the business changes hands

If we sell or transfer all or part of our business, or merge with another company, personal data may pass to the buyer or new owner, and to their advisers during the process under confidentiality terms. The new owner would have to use it in line with this policy, and we'd tell you if what happens to your data changed.

10. Data sent outside the UK

Cloudflare runs a global network and is based in the United States, and Google can process data in the United States and other countries. This means personal data may be transferred outside the UK. UK law allows this only where the destination has been found to give adequate protection, or where a safeguard approved by UK law is in place.

• The UK has made "adequacy regulations" for the countries of the European Economic Area and some others, so data can flow there freely.
• For the United States, both companies take part in the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as giving adequate protection to data sent to certified companies.
• Both companies' data processing terms also include the EU standard contractual clauses with the UK's International Data Transfer Addendum, which apply where the Data Privacy Framework doesn't.

If you'd like more detail on the safeguard that applies to a particular transfer, or a copy of the relevant terms, email us.

11. How long we keep it

We keep personal data only for as long as we need it for the purpose we collected it for, including any legal, accounting or reporting requirements. The table in section 5 gives the period for each use. When a period ends we delete the data, or anonymise it so it can no longer identify you.

Cloudflare doesn't publish a fixed retention period for the server logs it keeps when serving our site. Its privacy policy says it keeps such logs for as long as it needs to run and secure its service and then deletes them. We don't download, copy or keep these logs ourselves.

Emails deleted from our mailbox may remain in Google's backups for a short time before they are permanently removed, in line with Google's data processing terms.

12. How we keep it safe

We use technical and organisational measures that are appropriate to the risk, including:

• serving the whole site over HTTPS, with HTTP Strict Transport Security, so pages can't be read or changed on their way to you;
• security headers and a strict content security policy, so the site only loads its own files;
• keeping the site free of third-party scripts, which removes a common route for data leaks;
• limiting access to our mailboxes and accounts to the people who need it, with two-step verification on our Google Workspace accounts;
• keeping passwords in a password manager and never sharing them by email or chat;
• choosing providers that offer strong security commitments and written data processing terms.

No system is completely secure. If a breach of security led to personal data being lost, changed or disclosed, we would assess it straight away. Where the law requires, we'd report it to the Information Commission without undue delay and, where feasible, within 72 hours of becoming aware of it. If the breach was likely to put you at high risk, we'd also tell you directly and explain what you can do to protect yourself.

If you think you've found a security problem with this site, please tell us at [email protected]. Our security.txt file has the details.

13. Your rights

The UK GDPR gives you the following rights over your personal data. Some only apply in certain situations, and we'll explain if one doesn't apply to your request.

14. How to use your rights

Email [email protected] with "Privacy request" in the subject line, or write to us at our registered office. Tell us which right you want to use and give us enough detail to find the data, such as the email address you wrote from. You don't have to use a particular form or particular words, and you can ask someone else, such as a solicitor or relative, to make the request for you with your written permission.

• Checking it's you. We may ask for information to confirm your identity, so we don't give your data to someone else. We'll only ask for what we need.
• How long it takes. We'll respond without undue delay and within one month of receiving your request. If we need to confirm your identity or ask you to clarify the request, the month starts when we get your reply. If a request is complex, or you've made several, we can extend this by up to two further months. We'd tell you within the first month and explain why.
• How we search. For access requests, we'll make reasonable and proportionate searches for your data, as the law requires.
• Cost. It's free. If a request is clearly unfounded or excessive, we can charge a reasonable fee based on our costs or refuse it. We'd explain why and tell you about your right to complain.
• If we can't do what you ask. We'll tell you why, unless the law stops us, and tell you how to complain.

15. Automated decisions

We don't make any decisions about you by automated means alone, and we don't use your data to build a profile of you.

16. Children

This site is a general company website. It isn't aimed at children and doesn't ask anyone for personal data. If you're under 13, please ask a parent or carer before you email us. If you're a parent or carer and believe a child has sent us personal data, email us and we'll delete it. Our apps explain how they treat children's data in their own privacy policies.

17. Other websites and our apps

This site links to other websites, including our apps and our social media pages. Those sites have their own privacy policies and we're not responsible for how they use your data. Check their policies before you give them any personal data. Our apps are covered by their own policies, which you'll find in each app and on its page on this site.

18. Complaints

If you're unhappy with how we've handled your personal data, please tell us first so we can try to put it right. You can complain in any way you like, but the quickest is to email [email protected] with "Complaint" in the subject. We will:

• acknowledge your complaint within 30 days of receiving it;
• look into it without undue delay and keep you updated on our progress;
• tell you the outcome and what we've done about it.

You also have the right to complain to the Information Commission, which regulates data protection in the UK. It took over from the Information Commissioner's Office (ICO) on 30 September 2026. Its website is ico.org.uk/make-a-complaint and its helpline is 0303 123 1113. It will usually expect you to have raised the matter with us first. You also have the right to go to court if you believe your rights have been breached.

19. Changes to this policy

We review this policy at least once a year and whenever we change how we use personal data. If we make a change, we'll update this page before the change takes effect and change the date at the top. If a change significantly affects how we use data we already hold about you, and we have your contact details, we'll tell you directly. Earlier versions are available on request.

• 2 November 2026. Expanded after a full legal review. Added sections on what we collect from social media and business contacts, a full purposes, lawful basis and retention table, legitimate interests, marketing, professional advisers, data transfers, a full rights table, how we handle requests and the new complaints process. Updated the regulator's name to the Information Commission.
• 2 November 2026. Rewritten for the new site. Removed references to the old page and to other products.
• 28 September 2026. First full version.

20. Contact us

For anything about this policy or your personal data, email [email protected]. You can also write to FALLINGHIPPO LIMITED, 71-75 Shelton Street, London, England, WC2H 9JQ. That is our registered office address, which forwards post to us, so email is quicker.