Privacy notice

Who we are

AI Consultory, aiconsultory@outlook.com. We provide AI consultancy programmes and a client workspace at aiconsultory.com.

What we collect

• Enquiries: name, email, company, service of interest, and your message.
• Site assistant: the text you type in the chat widget. This is sent to OpenAI to generate a reply. Do not include special-category or confidential data in the assistant.
• Workspace accounts: work email (verified by magic link), organisation name, programme choice, intake answers, and task progress.
• Technical logs: IP address, user agent, and an audit record of sign-in, workspace creation, task changes, and admin actions.

Lawful bases

• Enquiries: legitimate interests — to respond to a request you initiated.
• Workspace accounts: contract (to provide the workspace you asked for) and legitimate interests (security and audit).
• Site analytics: Vercel Analytics is cookieless. We run it under legitimate interests to understand traffic, with no advertising profile.

We do not currently process HR or special-category data in the workspace. If a future programme requires it, we will complete a DPIA and a processor contract first.

Who we share data with

We use these processors to run the site:

• Vercel — hosting, serverless functions, and cookieless analytics (London region for functions).
• Neon — Postgres database in AWS eu-west-2 (London).
• Resend — transactional email for magic links and enquiry delivery.
• OpenAI — site assistant replies only, when that feature is enabled.
• Microsoft — Outlook for the published contact address.

OpenAI processes data in the United States. If a client requires UK-only processing, we will not route their data through OpenAI.

Cookies

The only cookie we set is the strictly necessary Auth.js session cookie used to keep you signed in to the workspace. There is no advertising cookie and no consent banner is required for that session cookie.

Retention

• Enquiries: 12 months, unless a contract follows.
• Workspace data: for the life of the engagement plus six years where we must keep records for tax or contract purposes.
• Audit events: 12 months.
• Magic-link tokens: 24 hours.

Your rights

You can ask for access, correction, erasure, restriction, objection, or a copy of your data. Workspace users can download a JSON copy of their account from the dashboard. Email aiconsultory@outlook.com for any other request. You can also complain to the Information Commissioner's Office at ico.org.uk.