Origin C Limited
Privacy and cookies
This site sets no cookies and runs no analytics. The personal data it handles is what you choose to type into a form, plus a short-lived count of form submissions from your IP address. This notice says what happens to both, and how to stop it.
Notice dated 14 October 2026
Who we are
Origin C Limited is registered in England and Wales, company number 17433105. Its registered office is 62 Darlington Road, Ferryhill, England, DL17 8JS. It is the data controller for everything on this page.
Questions and requests go to the founder at founder@originc.co.uk. He reads and answers them himself.
Reading the site
Reading this site sets no cookies and stores nothing on your device. There is no analytics service and no tracking script on any page. Fonts are served from this site, not from a font network, so no other company sees that you loaded a page. That is why there is no cookie banner.
Like every website, the host sees each request: your IP address, your browser's user-agent string and the page asked for. Our host is Cloudflare, which keeps those request logs only as long as it needs them to run and secure its network, as its privacy policy describes. We rely on our legitimate interest in serving the site securely, and we do not use the logs to follow visitors.
The sign-up forms
Each form asks for an email address for one stated thing, and the line beside its button says what that is:
- Gate result: "One email, the day the Phase 0 result lands. Unsubscribe any time."
- Build email: "One email a month on the build: what passed, what failed, the numbers. Unsubscribe any time."
- Investor request: "I reply to every request myself. Unsubscribe any time."
The monthly build email is news about MurA and Origin C, which the law counts as direct marketing, so it is only ever sent with your consent. Nothing is sent until you press the button in the confirmation email. A sign-up you never confirm is deleted after 30 days.
With each sign-up we record the consent line you saw and its version (now 2026-10-13), so we can show what you agreed to. We never ask for your name, and we never buy, sell or share lists.
The confirmation email, the gate email and every build email carry an unsubscribe link. It opens a page with one button; pressing it deletes your record and nothing more is sent. Many mail apps also offer their own unsubscribe button, which does the same in one press. The founder's own replies are written by hand and carry no link: answer any of them with "unsubscribe" and he deletes your record.
Investor requests
The investor form asks for your email address and your organisation. The founder is told of each request and replies personally within 3 to 5 working days of your confirmation. He uses your details to answer you and to send what you asked for, and for nothing else. The same confirmation step applies, and the unsubscribe link in your confirmation email deletes your request. To stop his replies, answer any of them with "unsubscribe".
What we use, why and for how long
The Phase 0 gate result: one email
- Data
- Your email address, the pill you picked and your answer to the follow-up question if you gave them, the page and time of sign-up, and the consent line you saw.
- Lawful basis
- Your consent (UK GDPR Article 6(1)(a); PECR regulation 22).
- Kept
- Until the gate email has gone, then deleted, unless you also asked for something else (the build email or an investor reply). Unconfirmed sign-ups are deleted after 30 days.
The monthly build email
- Data
- The same as for the gate result.
- Lawful basis
- Your consent (UK GDPR Article 6(1)(a); PECR regulation 22).
- Kept
- Until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days.
Investor requests and the replies to them
- Data
- Your email address, organisation, fund or syndicate if you name it, and what we write to each other.
- Lawful basis
- Steps you ask us to take before any agreement (Article 6(1)(b)), and our legitimate interest in answering investors who contact us (Article 6(1)(f)).
- Kept
- The request record and our correspondence for 2 years after our last contact, reviewed and deleted by hand once a year, or longer if you become a shareholder, as company law requires. You can delete the record sooner with the unsubscribe link in your confirmation email.
The confirmation step
- Data
- Your email address and two random links: one to confirm, one to unsubscribe.
- Lawful basis
- Our legitimate interest in checking that the owner of an address asked for the email (Article 6(1)(f)).
- Kept
- The confirmation link works once and lapses after 30 days. The unsubscribe link lasts as long as your record.
Keeping bots out of the forms
- Data
- Your IP address, held in a counter of form submissions for the current hour. Turnstile signals, which Cloudflare processes (see below).
- Lawful basis
- Our legitimate interest in protecting the forms and the list from abuse (Article 6(1)(f)).
- Kept
- The counter deletes itself within 2 hours. We keep nothing from Turnstile beyond its pass or fail.
Emails you send us, and complaints
- Data
- Your address and what you write.
- Lawful basis
- Our legitimate interest in answering you (Article 6(1)(f)); for a data complaint, our legal duty under section 164A of the Data Protection Act 2018 (Article 6(1)(c)).
- Kept
- 2 years after our last contact, or after a complaint is closed.
No decision about you is made automatically, and none of this data is used for profiling.
Your right to object
You can object at any time to our use of your data for direct marketing, including the monthly build email, and we will stop. Use the unsubscribe link in any email, or write to founder@originc.co.uk.
You can also object to anything we do on the basis of our legitimate interests, listed above. We will stop unless we have compelling grounds to continue, which we will explain.
Who receives your data
- Cloudflare hosts the site, stores the sign-up records in Cloudflare KV, runs the Turnstile bot check and forwards mail sent to our addresses. It acts as our processor under its data processing addendum.
- Resend delivers our emails. It receives your address and the email in order to send it, keeps each email and its delivery record for 30 days, and acts as our processor under its data processing agreement. Open and click tracking are off.
- Google provides the Gmail mailbox where mail to founder@originc.co.uk is read and answered, including investor requests. It is a personal Gmail account, so Google acts under its own terms and privacy policy rather than as our processor. We plan to move this mailbox to a business service with processor terms by the end of 2026, and this notice will change when we do.
All three are United States companies, so your data may be handled outside the UK. Cloudflare, Resend and Google each state that they are certified under the UK Extension to the EU-US Data Privacy Framework, which UK law recognises as giving adequate protection. Cloudflare's network also serves pages from data centres around the world; transfers outside the United States are covered by the standard contractual clauses, with the UK Addendum, in its data processing addendum.
Bot protection
The forms are protected by Cloudflare Turnstile, a bot check with no puzzle. On a page with a form, your browser loads a small Turnstile script from Cloudflare when a form comes into view. Cloudflare names the signals it processes as your IP address, your connection's TLS fingerprint, your browser's user-agent string, and this site's Turnstile key and origin. It states that they are used to detect and block bots, not to identify or profile anyone, and that Turnstile does not read what you type into a form.
Cloudflare is our processor for the check. It also states that it acts as a controller in its own right when it uses the same signals to improve Turnstile; its Turnstile privacy addendum sets out that use. Turnstile here issues a one-time token that our server checks, and sets no cookie: the optional pre-clearance cookie is off. This page has no form, so no Turnstile script loads here.
Your rights
Under the UK General Data Protection Regulation and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, you have the right to:
- ask for a copy of the personal data we hold about you;
- have it corrected;
- have it deleted;
- restrict how we use it, or object to it (see above);
- receive it in a portable form;
- withdraw your consent at any time, without affecting what was done before.
Email founder@originc.co.uk for any of these. We answer within one month. The unsubscribe link deletes your record on its own.
Complaints about your data
If you are unhappy with how we have handled your data, email founder@originc.co.uk with "Data complaint" in the subject. We will acknowledge it within 30 days, look into it, keep you told how it is going and tell you the outcome without undue delay.
You can also complain to the regulator, the Information Commission (still known as the ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113.
About this site
Nothing on this site is an offer of shares, or an invitation or inducement to invest. It describes the company's work and plans. Targets, prices and dates on it are plans and design targets, not results: MurA has not been built yet.
Images of MurA are concept renders, not representative of the final mechanism. The mechanism is still being designed and will look different.
Other companies' names and products appear only to compare approaches; their trade marks belong to their owners. The text, images and design of this site are © Origin C Limited 2026. This site and this notice are governed by the law of England and Wales.
Changes to this notice
This notice is dated 14 October 2026. When the site changes in a way that affects your data, such as a new form or a new provider, this page changes first and the date moves.