Privacy Policy
Last updated: 14 October 2026
This Privacy Policy explains how AI Compliancy (“we”, “us”, “our”) collects, uses, and protects personal data when you use our website at aicompliancy.co.uk and the preparation tool available through it (the “Service”). We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
AI Compliancy is a trading name of Boris Semanco, a sole trader in the United Kingdom, who is the data controller for the personal data described in this policy.
- Website: aicompliancy.co.uk
- Contact: aicompliancy@outlook.com
- Postal address: 5 Brayford Square, London, E1 0SG, United Kingdom
- ICO registration reference: ZC097790, registered 24 February 2026. The registered controller’s details can be checked on the public ICO register at ico.org.uk.
Two roles, not one. For your account, your login, your email preferences, the technical information your browser sends, and the record of what you have bought, we decide what is collected and why. In data-protection language, we are the controller.
The content you enter into the tool is different. Your software library, your assessment answers, your actions, your notes, your reports and your AI Use Rules belong to your organisation — and they can name people: a report records who prepared it, and your notes are free text — Article 26(2) of the EU AI Act asks for human oversight by a named person, and you record that in your own words in the actions tracker. The same goes for the knowledge check results of the people you share an AI-literacy learning module with (see People who take a knowledge check, below). For that content your organisation is the controller and we are only the processor: we store it, show it back to you, act on your instructions, and never use it for any purpose of our own. The terms on which we do that are in section 14 of the Terms of Service.
If someone whose name appears in an organisation's records asks us about their data, we will not answer for that organisation. We will point them to it, and let it know they asked.
2. The personal data we collect
| Category | Examples |
|---|---|
| Account & identity | Your business name, your work email address, the type of organisation you are, and whether your business has customers, staff, recruitment or operations in the EU or EEA — given when you create an account. |
| Authentication | Login credentials (email address and password), managed by our authentication provider. |
| Assessment content | The information you enter into the tool — for example the software your organisation uses, your answers to assessment questions, and the compliance records, actions and reports you generate, and the AI Use Rules you write. This can include the names of people: a report records who prepared it, your AI Use Rules name the people you put in charge, and a free-text note is yours to word as you choose — including naming whoever you assign human oversight to. We hold this as a processor, for your organisation. |
| Knowledge check results | When an organisation shares one of our AI-literacy learning modules with its team, each person who takes its knowledge check gives their name and work email address. We record those with their answers, score, the date and the number of attempts, and show the result to the organisation that shared the link. We hold this as a processor, for that organisation. |
| Email preferences | Whether you asked for optional emails, the date you asked and the exact wording you agreed to, and a record of the emails sent to you. |
| Feedback | What you send through “Leave feedback” in the dashboard: an optional star rating, your message, and the page you were on when you sent it. It is stored with your account and business, so we know who it came from. |
| Corrections and suggestions | What you send through the form on the AI-features pages: your message, the tool page it came from, and your email address only if you choose to give one. No account is needed and none is linked. |
| Technical & usage | Information your browser sends automatically, such as IP address, device and browser type, and basic usage information needed to operate and secure the Service. |
Sensitive data does not belong in the tool. We do not collect special category data and the Service is not built to hold it. Please do not enter anything revealing a person's health, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade-union membership, sex life or sexual orientation, or their biometric or genetic data, or details of criminal offences, into any free-text field. Where you need to record an AI use that touches data of that kind, describe the use, not the person. This is also a term of use — see section 5 of the Terms of Service.
People who take a knowledge check
An organisation that uses the Service can send its team a link to one of our AI-literacy learning modules. No account is needed to take it. If you open such a link and take the knowledge check:
- What is recorded: the name and work email address you type in, your answers, your score, the date, and how many attempts you have made.
- Who sees it: the organisation that sent you the link, in its own account. It is the controller of your result; we are its processor and hold it on its behalf, on the terms in section 14 of the Terms of Service.
- What we do not do: we do not email you, add you to any list, use your answers for marketing or for any purpose of our own, or create an account for you.
- Your rights: to see, correct or remove your result, ask the organisation that sent you the link. If you contact us instead, we will pass your request to it and help it answer.
3. How and why we use your data
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Creating and managing your account and providing the Service | Performance of a contract |
| Saving and displaying your assessments, actions and reports | Performance of a contract |
| Sending service-related messages (e.g. account confirmation, password reset, changes affecting your account) | Performance of a contract / legitimate interests |
| Sending optional update emails you asked for | Consent (withdrawable at any time) |
| Reading your feedback and using it to improve the Service | Legitimate interests |
| Reading corrections and suggestions and updating the AI-features catalogue | Legitimate interests |
| Using the names of tools you add yourself (software that is not in the AI-features catalogue) to decide which tools to add to the catalogue | Legitimate interests |
| Securing the Service and preventing misuse | Legitimate interests |
| Responding to your enquiries and support requests | Legitimate interests |
| Complying with our legal obligations | Legal obligation |
No automated decisions about you. The Service works out risk levels and obligations from the answers you give about your organisation's software. Those are conclusions about a business and its tools, not about any individual, and they are yours to review, change and override. We do not make decisions about individuals by automated means that produce legal effects for them or similarly significantly affect them, and we do not profile you.
Not used to train AI. Nothing you enter into the tool is sent to an AI service, and none of it is used to train an AI model.
4. Service providers (processors)
We use trusted third-party providers to run the Service. They process personal data only on our instructions and under appropriate data-protection terms:
- Supabase — database, authentication and secure storage of your account and assessment data.
- Netlify — website hosting and content delivery, and receiving what is sent through the corrections form on the AI-features pages.
- Resend — delivery of service emails, such as account confirmation and password-reset messages.
- Stripe — payment processing when you buy a pass. Card details are entered on Stripe's own checkout page and are never seen or stored by us.
Encrypted backup storage. A copy of each database backup is also kept in Microsoft OneDrive. It is encrypted on our own computer before it is uploaded, and only we hold the key, so Microsoft stores it without being able to read any of it.
We can see your account ourselves. To run the Service, answer a support request and keep it secure, we can see your business name, the email addresses on your account, the type of organisation you are, the software in your library and your answers about it, and what you have bought. We do not read the notes you write against a tool or one of its features — those are yours alone.
When the law requires it. We may disclose personal data where we are legally obliged to — for example to a court, a regulator, or a law-enforcement body acting under a valid request. We will tell you if that happens, unless we are prohibited from doing so.
If the business changes hands. If AI Compliancy is incorporated, restructured, or sold, personal data may pass to the new owner as part of the business. Whoever takes it on would be bound by this policy, or by one that protects your data to the same standard, and we would tell you before it happened.
5. Emails we send
There are two kinds, and they follow different rules:
- Service messages — about your own account and what you already have: confirming your address, welcoming you once it is confirmed, resetting your password, and letting you know when something changes here that could affect your report — a tool in your library, a risk question, or an obligation in your tracker — and telling you before a significant change to the Terms of Service or this policy takes effect. These are part of providing the Service and are sent to all account holders.
- Optional messages — sent only if you ticked the box when you signed up, or turned it on in My Account. These are about new features and offers, and may include an invitation to buy a pass. We record when you agreed and the exact wording you agreed to.
You can stop the optional messages at any time — every one carries an unsubscribe link, and the setting is in My Account. Turning them off does not affect service messages, which are needed to run your account. We do not sell your email address or pass it to anyone else for their marketing.
We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.
6. International transfers
Where your data is held:
- Your account and everything you enter into the tool are stored by Supabase in its EU West (Ireland) region — inside the European Economic Area.
- Backup copies of the database are kept on encrypted devices under AI Compliancy's control in the United Kingdom for up to 60 days, and an encrypted copy in Microsoft OneDrive for up to 30 days (and up to 30 more in its recycle bin once deleted). Microsoft is US-headquartered and may store it outside the UK; the copy is encrypted before it leaves our computer and Microsoft does not have the key.
- Netlify, Resend and Stripe are US-headquartered providers and may process personal data outside the UK, including in the United States. Netlify serves the website, Resend sends service email, and Stripe handles payments.
Transfers to the European Economic Area are covered by the UK's adequacy regulations. Transfers to a United States provider certified under the UK–US data bridge, as Netlify is, are covered by that arrangement. For any other transfer we rely on the safeguards recognised under UK data-protection law, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
7. How long we keep your data
We keep your account and assessment data for as long as your account is active and for as long as needed to provide the Service. Compliance records and reports you create are retained so they remain available to you as a record of the assessments you carried out.
Accounts nobody uses. If you do not sign in for two years, we will email the address on the account to say so, and delete the account and everything in it if we hear nothing back within 30 days. Nothing is deleted without that warning.
If you delete your account, it is removed immediately — your login, your software library, and every risk assessment, actions tracker and report you created, together with everything recorded inside them. This cannot be undone, and any time remaining on a pass is lost.
Backup copies. Separately from the live Service, we keep backup copies of the database so it can be restored after a fault. Each copy is kept for up to 60 days and then deleted, so anything removed from the Service — including a deleted account — is gone from every copy within 60 days. Backups are used only to restore the Service, never for anything else.
One thing is kept: your payment record. Where you have bought a pass, the record of that payment — held by our payment provider, Stripe, and including the email address and business name given at checkout — is retained as part of our financial records, which tax and accounting rules require us to keep for several years after the transaction. It is not used to contact you. If you want that record erased as well, write to us at aicompliancy@outlook.com and we will deal with it separately.
Feedback. Feedback is kept for as long as your account exists, and is deleted with it. Only we can read it — it is never shown to other customers, and it is not used to send you marketing.
Knowledge check results. Kept for as long as the organisation that shared the learning module keeps its account, so it has a lasting record of the training. They are deleted sooner if that organisation deletes them, and with its account if it closes it.
Corrections and suggestions. What is sent through the form on the AI-features pages is kept for up to 12 months and then deleted. An email address, if you gave one, is used only to reply about what you sent.
Technical and usage information. Server and security logs, including IP addresses, are kept only as long as they are needed to operate and secure the Service, diagnose faults and prevent misuse — in any case no more than 12 months — and are then deleted or anonymised.
Emails you send us. Support and enquiry correspondence is kept for up to two years after the matter is closed, so there is a record of what was asked and what was answered.
8. Cookies and local storage
The Service uses your browser’s local storage to keep you signed in and to remember certain preferences (for example, dismissing a notice). These are essential to the operation of the Service. We do not use third-party advertising or tracking cookies.
The training video. The home page and each knowledge check page show a training video hosted on YouTube. Nothing is loaded from YouTube until you press play. When you do, the video plays from YouTube's privacy-enhanced service (youtube-nocookie.com): YouTube, run by Google, receives your IP address and browser details and may store information in your browser, under Google's own privacy policy. If you would rather not, do not press play.
9. Your rights
Under UK data-protection law you have the right to:
- access the personal data we hold about you;
- ask us to correct inaccurate or incomplete data;
- ask us to delete your data (the right to erasure);
- restrict or object to certain processing;
- request a copy of your data in a portable format;
- withdraw consent, where we rely on consent.
To exercise any of these rights, contact us at aicompliancy@outlook.com.
We may ask you for enough information to be satisfied who you are before we act — we cannot hand personal data to someone we are unable to identify, and asking is a protection for you. We will respond within one month. If a request is complex, or you have made several, we may extend that by up to two further months; we will tell you within the first month if we do, and why.
These rights apply to the data we hold as controller. Where your name appears inside another organisation's records in the tool, that organisation is the controller and the request belongs to them — contact them, and we will help them answer it.
Complaints. If you are unhappy with how we handle your personal data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk, or by calling their helpline on 0303 123 1113. We would appreciate the chance to address your concerns first.
10. Security
We take appropriate technical and organisational measures to protect your personal data, including encryption in transit, access controls, and row-level security that keeps each organisation’s data separate. No online service can be guaranteed to be completely secure, but we work to protect your data and to respond promptly to any issues.
If something goes wrong. If a personal-data breach happens and it is likely to be a risk to people's rights and freedoms, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it. Where the risk to you is high, we will tell you as well, without undue delay, in plain terms: what happened, what it means for you, and what we are doing about it. If a breach affects content we hold for an organisation as its processor, we will tell that organisation without undue delay so it can meet its own duty to report.
11. Children
The Service is intended for businesses and is not directed at children. We do not knowingly collect personal data from anyone under 18.
12. Changes to this policy
We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Before a significant change takes effect, we will email the address on your account.
13. Contact us
For any questions about this Privacy Policy or your personal data, contact us at aicompliancy@outlook.com.