Will my business data be used to train AI models?
Not to train general-purpose AI models for unrelated third parties: our Data Processing Addendum says so. Your information is confidential and used to deliver your services, and our terms limit us to using the content and data you provide for the purpose of delivering the Services. Your material does train your own agent. Delivering the work involves third-party providers.
- Our terms give us a non-exclusive licence to use the content, data and materials you provide for one purpose only: delivering the Services. That purpose limitation is the backbone of the answer.
- Both parties agree to keep the other's confidential information confidential, to use it only to perform or receive the Services, and to protect it with reasonable care.
- Discovery sessions are recorded only with your consent, and the recording is used to build, train and improve the systems and the agent we deliver to you.
- Our Data Processing Addendum states that we process your personal data only to provide the services to you, do not use it for unrelated purposes, do not sell it, and do not use it to train general-purpose AI models for unrelated third parties.
- Delivering the work involves third-party hosting, infrastructure and AI providers. A current list of the categories of provider we use is available on request.
What "used to deliver your services" actually means
Two clauses in our terms do the work here. Under intellectual property: "You grant us a non-exclusive licence to use the Content, data and materials you provide for the purpose of delivering the Services." That is a purpose limitation, not a general permission. Your data is there so we can build and run the thing you commissioned.
Under confidentiality: "Both parties agree to keep the other's confidential information confidential, to use it only to perform or receive the Services, and to protect it with reasonable care." The usual carve-outs apply, for information that is or becomes public through no breach, that a party already held without restriction, or that must be disclosed by law or a regulator. You can read both clauses in full in our Terms of Service.
The discovery recording, and what "training your agent" means
We visit your business and, with your consent, record the discovery conversation. Recordings are only ever made with your agreement, and how we handle them is described in our Privacy Policy. If you would rather we did not record, say so.
The wording on our about page, that every detail becomes training for your systems and agent, means something specific and worth being precise about. Our terms put it this way: recordings and their transcripts are used to build, train and improve the systems and Agent we deliver to you. That is your agent, configured on your material. The word "training" there is doing a job about your agent, not about general-purpose models elsewhere. What we do and do not commit to on those sits in our addendum, and the section below sets it out with its limits attached.
Who is the controller and who is the processor
From our terms: "Where we process personal data on your behalf to deliver the Services, we act as your processor and you act as the controller. Where we determine our own purposes (for example our own business administration and marketing), we act as a controller in our own right."
The processor terms are set out in our Data Processing Addendum, which gives customers who need a processor agreement on file the terms required by Article 28 of the UK GDPR. Article 7 of that addendum covers AI processing directly: we process your personal data only to provide the services to you, we do not use it for unrelated purposes, we do not sell it, and we do not use it to train general-purpose AI models for unrelated third parties. The security measures behind that sit in Annex 2 of the addendum rather than being restated here. You remain responsible for having a lawful basis to share the personal data you give us.
The limit of the promise, stated plainly
We cannot deliver this work alone. Our terms say we may engage sub-processors and selected service providers, including third-party hosting, infrastructure and AI providers, and our addendum commits us to selecting providers that offer appropriate protections, under written contracts no less protective than the addendum itself. On training, the addendum's wording is that we select our service providers and configure our use so that your personal data is processed to serve you and is not used by those providers to train their general-purpose models for unrelated purposes, so far as their terms allow. That final clause is a real limit and we are not going to hide it: their terms are theirs, not ours.
So the honest position is this. Our own commitments are contractual and you can read them. Our commitments about providers are commitments about how we select and configure, bounded by what those providers offer. We are not going to tell you what any particular provider does or does not do with data, because that is their statement to make and not ours. If you want the specifics, a current list of the categories of provider we use is available on request, and we would rather you asked early than late.
What to check before you commission anything
If data handling is the deciding factor for you, do three things. Ask for the current list of the categories of provider we use. Read the Data Processing Addendum, particularly Article 7 on AI processing safeguards, Article 9 on international transfers and Article 12 on return and deletion of data. Tell us in advance about anything unusual in your data, because our addendum says special category data is not requested or required by us and should not be provided without our prior written agreement.
We would rather have that conversation early. It is easier to scope around a constraint than to unpick one later.
Do I have to let you record the discovery session?
No. Recordings are only ever made with your agreement, as our terms and our about page both say. The recording exists because the more we understand about how you actually operate, the sharper your systems and your agent become. If you would rather we did not record, tell us and we will not.
Could my data end up improving another client's agent?
Your data is used to deliver your services. Our addendum says we process your personal data only to provide the services to you, that we do not use it for unrelated purposes, and that we do not sell it. What we do carry across clients is our own background intellectual property: our tooling, our methodologies, our libraries and our general know-how, which our terms say we retain rights in. That is method, not your material.
Does my data stay in the UK?
We are not going to claim it never leaves the UK, because we cannot honestly promise that. What our addendum commits to is that where personal data is transferred outside the United Kingdom, whether by us or by a sub-processor, an appropriate safeguard under Chapter V of the UK GDPR is in place before the transfer takes place: a finding of adequacy, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism recognised under the Data Protection Laws.
What happens to my data if I stop working with you?
On termination or expiry of the services, our addendum says we will, at your choice, delete or return the personal data we process on your behalf, and delete existing copies, unless the law requires us to retain it. On request we will certify in writing that we have complied. Separately, our terms are clear that we are not the system of record for your business, so keep your own copies of anything you need and retrieve it in good time.
Still want to ask it in person?
Tell us what you are building and we will give you a straight answer, and a plan, within 72 hours.