Privacy Policy

1. Who we are

INTAI LIMITED is a UK AI governance, risk, compliance and assurance consultancy, supporting organisations across the UK, Europe and the United States. We help boards, executives and operational teams govern artificial intelligence responsibly, through advisory services, governance framework and operating model design, training, and a suite of free self-assessment tools published on this website.

For the purposes of UK GDPR, INTAI LIMITED is the data controller for the personal information described in this policy, meaning we decide how and why that information is processed. Our correspondence address is Boxwood Farm, Station Road, Old Bursledon, Southampton, United Kingdom, and we also maintain working locations in Salford (MediaCity) and London. You can reach our team by email at enquiries@intai.co.uk or through the contact page.

Where we act as a data processor on behalf of a client, for example where a client asks us to review AI systems that process personal information they control, that relationship is governed by a separate data processing agreement rather than by this policy.

2. Scope of this policy

This policy covers personal information we collect through:

• our website at intai.co.uk and its subpages, including research, blog, industry analysis and knowledge content;
• the INTAI Assessment Suite™, including all readiness, opportunity, governance, risk, policy, vendor, executive and training-related assessments and diagnostics;
• enquiry, contact and consultation booking forms;
• our INTAI Research newsletter and other subscriber communications;
• client, supplier and partner relationships, including proposals, engagements and contract administration; and
• recruitment, where we advertise or receive speculative applications for roles at INTAI; and
• the INTAI Governed AI Portal (the “Portal”), including sign-up, free trials, user accounts, billing and the service messages we send to Portal users (see Section 7).

It does not cover the practices of third-party websites we link to, or third-party AI systems, tools or platforms that a client operates independently of INTAI. Where a firm uses the Portal to process its own clients’ personal data, the firm is the controller of that data and INTAI processes it only as the firm’s processor under the Data Processing Terms in our Terms and Conditions; Section 7 explains this further. If you follow a link from our site to another organisation’s website, that organisation’s own privacy notice will apply.

3. Information we collect

The information we collect depends on how you interact with us. It generally falls into the following categories.

Information you give us directly

• Contact details, such as your name, work email address, phone number, job title, organisation name and organisation size, when you submit an enquiry, book a consultation, complete an assessment, subscribe to INTAI Research or apply for a role;
• The content of messages you send us, including through the contact form, email or during a consultation;
• Your responses within an INTAI assessment or training diagnostic, including the statements you select, free-text answers where offered, and any organisational context you provide (for example, sector, adoption stage or department);
• Information you provide during a client engagement, such as details required to scope, deliver, invoice and administer our services; and
• Any documents you choose to send us, for example CVs, RFPs, policies or supporting materials.

Information we collect automatically

• Technical information about your device and visit, such as IP address, browser type and version, operating system, referring page, pages viewed, time spent on pages and general location derived from your IP address;
• Interaction data, such as which assessment you started, how far you progressed, and whether you completed and downloaded or emailed a report; and
• Cookie and similar tracking data, as described in Section 7.

Information we receive from other sources

Occasionally we may receive limited information about you from a colleague who refers you to us, from a professional networking platform such as LinkedIn where you engage with our content, or from a client who identifies you as a stakeholder within an engagement. We do not purchase marketing lists or buy personal data from third-party data brokers.

4. How and why we use your information

We use personal information for the following purposes:

• to operate this website and keep it secure, reliable and easy to use;
• to deliver the assessment or training diagnostic you request, calculate your results and generate your report;
• to respond to enquiries, arrange consultations and answer questions about our services;
• to provide, manage and invoice client engagements, including scoping, delivering and reviewing consultancy work;
• to send requested reports, follow-up information or, where you have agreed to receive them, our research newsletter and other marketing communications;
• to understand how our website and assessments are used, so we can improve their content, accuracy and usability;
• to maintain our own records, including financial, contractual and regulatory records; and
• to meet our legal, regulatory and professional obligations, including in connection with our own progress toward ISO/IEC 42001, ISO/IEC 27001 and Cyber Essentials, where records of information handling form part of that evidence base.

5. Our lawful bases for processing

UK GDPR requires that we identify a lawful basis for every use of personal information. Depending on the purpose, we rely on one or more of the following:

• Consent, for example when you opt in to receive our research newsletter or accept non-essential cookies; you can withdraw consent at any time and this will not affect the lawfulness of processing carried out before you withdrew it;
• Contract, where processing is necessary to deliver a service you have requested, such as generating your assessment report or performing a signed consultancy engagement;
• Legitimate interests, where processing is necessary for our legitimate business interests and does not override your rights and freedoms; examples include improving our services, keeping our website secure, and understanding how our assessments are used in aggregate; and
• Legal obligation, where processing is necessary to comply with the law, for example retaining certain financial or contractual records.

We do not rely on the “vital interests” or “public task” bases, as neither is relevant to our activities.

6. The INTAI Assessment Suite™ and Training tools

Before you begin most assessments or training diagnostics, we ask for basic contact details, typically your name, work email address and organisation, so that we can generate and deliver your personalised report. We explain this at the point of collection, together with a short privacy note confirming that this information is used only to generate and deliver your report and will not be shared with third parties for their own marketing purposes.

Your responses to the statements within an assessment are used to calculate domain scores, an overall index and a maturity level, and to generate the executive commentary, priorities, strengths and roadmap shown in your report, as explained in full on our Assessment Methodology page. Your results and report may be stored securely so that, where you choose to email a copy to yourself or a colleague, we can process that request and, where relevant, follow up with information genuinely useful to you, such as related assessments or services connected to the gaps identified.

Assessment results are indicative and self-reported; they are not independent audits, and are not shared publicly or used to identify you in any published research without your separate, explicit agreement.

7. The INTAI Governed AI Portal

The Portal is INTAI’s hosted software service through which financial advice firms and their staff run approved AI-assisted workflows under governance controls. This Section explains how we handle personal information in connection with the Portal. It should be read with Section 8 (the Portal) and Section 13 (Data Processing Terms) of our Terms and Conditions.

7.1 Two roles: controller and processor

There are two kinds of personal information in the Portal, and INTAI’s role differs for each:

• Account and billing information about the firm and its users (the people who sign up, administer and use the Portal). INTAI is the controller of this information, and this policy applies to it.
• Firm data, including information about the firm’s own clients, which a firm or its users submit to the Portal or authorise it to retrieve from the firm’s business system. The firm is the controller of this information. INTAI processes it only as the firm’s processor, on the firm’s instructions, under the Data Processing Terms. If you are a client of a firm that uses the Portal and have questions about how your information is handled, please contact that firm; its own privacy notice applies.

7.2 Information we collect as controller

• Sign-up and trial: firm name, your name, work email address, the firm’s Financial Conduct Authority firm reference number, the estimated number of advisers, the date and time you accepted our Terms (with a record of the version you accepted), the IP address used, and email verification status.
• User accounts: name, work email address, role, team, organisation, password (stored only as a salted hash), two-step authentication enrolment (the authenticator secret is stored encrypted), training records, sign-in history, session details and IP addresses.
• Billing: the billing contact’s name and email, billing address, VAT number, the number of adviser seats, subscription status, invoice and payment history, and identifiers issued by our payment provider. Card numbers and bank account details are collected by Stripe directly and are never received or stored by INTAI.
• Governance evidence and security logs: records of which user ran which workflow and when, the policy decision applied, the human review decision, the AI provider and model used, administrative changes, sign-in attempts and security events. These records contain identifiers, versions, decisions, timestamps and counts, not client content.
• Usage and productivity metrics: aggregate counts of workflows used, tasks assisted and estimated time recovered, shown to the user, their firm and, in aggregate only, their network.

7.3 How and why we use it

We use this information to: create and administer accounts and trials; verify identity and secure the Portal (including two-step authentication, rate limiting and detecting misuse); apply the one-trial-per-firm rule and prevent fraud; take payment, issue invoices and manage subscriptions and seat limits; send service messages (email verification, invitations, trial reminders, payment notices, security alerts and notices of changes to the service or these terms); provide support; produce the governance evidence and assurance reporting that is the purpose of the Portal; measure adoption and productivity in aggregate; and meet our legal, regulatory and contractual obligations. Our lawful bases are performance of a contract (providing the Portal), our legitimate interests (security, fraud prevention, service improvement and demonstrating that AI is governed properly) and legal obligation (financial and tax records). Service messages are not marketing and you cannot opt out of them while you hold an account; marketing communications are covered by Section 9.

7.4 AI providers

The Portal routes approved workflows to third-party AI models. INTAI currently uses Anthropic, PBC as its approved AI provider, and may add other approved providers on notice to firms. Before anything is sent to an AI provider, the Portal removes fields the workflow does not need and replaces personal identifiers such as names, dates of birth and National Insurance numbers with tokens; the AI provider receives only the minimised, tokenised content of the request. Our agreements with AI providers do not permit them to use this content to train their models. During a free trial, only synthetic (fictitious) client records are used and no real client data can be entered. AI outputs are drafts: every output is reviewed by a person at the firm before it is used, and no decision with legal or similarly significant effects on an individual is made by the Portal automatically (see Section 16).

7.5 Payments

Payments for the Portal are processed by Stripe Payments Europe, Ltd. and its affiliates (“Stripe”) through a Stripe-hosted checkout page and customer portal. When you pay, Stripe collects your payment details and billing address directly and acts as an independent controller for its own purposes, such as fraud prevention and regulatory compliance, under the Stripe Privacy Policy. INTAI receives from Stripe only what it needs to manage your subscription: confirmation of payment, the billing name, address and VAT number, the last four digits and type of the payment method, invoice records and Stripe’s reference identifiers.

7.6 Who we share Portal information with

In addition to the recipients in Section 10, Portal information is processed by the sub-processors listed in Section 13.5 of our Terms and Conditions: Google Cloud (hosting, London region, and secrets management), Neon (database hosting), Anthropic (approved AI provider), Stripe (billing) and Brevo (transactional email). A firm’s network or parent organisation, where the firm belongs to one, can see aggregate information about the firm’s adoption, training coverage, governance status and risk trends, but not the firm’s client records, prompts or AI outputs. Some of these providers process information outside the UK; Section 11 describes the safeguards we use.

7.7 How long we keep Portal information

• Free trial accounts become read-only when the trial ends and are deleted 30 days later unless the firm subscribes.
• Sign-up records for trials that were never verified are deleted after 30 days; verified sign-up and terms-acceptance records are kept for the life of the firm’s account and six years afterwards, as evidence of the contract.
• User accounts are kept while the firm’s subscription is active. When an account is deactivated or a subscription ends, account details are retained for the period in Section 8.9 of our Terms and then deleted, except where they form part of governance evidence.
• Governance evidence (which contains no client content) is kept for the life of the subscription and six years afterwards, or such other period as the firm agrees with INTAI, so the firm can demonstrate how AI was governed.
• Billing records are kept for six years after the end of the tax year to which they relate.
• Security logs are kept for up to two years.
• Client content processed for a workflow is retained only for the period set for that workflow (typically days or weeks), after which it is deleted automatically, in accordance with the Data Processing Terms.

7.8 Cookies on the Portal

The Portal uses only strictly necessary cookies: a session cookie that keeps you signed in and a short-lived cookie used during business-system authorisation. It does not use analytics or marketing cookies.

8. Cookies and similar technologies

Our website uses cookies and similar technologies in line with PECR and UK GDPR. Cookies are small text files stored on your device that help websites function and help us understand how our site is used. We use the following broad categories:

• Strictly necessary cookies, which are required for the website and its security features to work and cannot be switched off; these do not require consent;
• Functional cookies, which remember choices you make, such as progress through an assessment, so you are not asked to repeat information unnecessarily;
• Analytics cookies, which help us understand how visitors use our site, which pages and assessments are most useful, and where visitors experience difficulty, so that we can improve the site; and
• Marketing cookies, which may be used, where you have consented, to understand the effectiveness of our content and communications.

Where a cookie is not strictly necessary, we ask for your consent before it is set, and you can change your preferences at any time through your browser settings or, where available, our cookie preference tool. Most browsers also let you block or delete cookies; doing so may affect how parts of the site, including assessments, function.

We do not use cookies to build advertising profiles of individual visitors for third-party advertisers.

9. Marketing communications

We will only send you marketing communications, such as our INTAI Research newsletter, where you have subscribed or otherwise given us your consent, or where the law allows us to contact existing clients or enquirers about similar services (a “soft opt-in”). Every marketing email includes a clear way to unsubscribe, and you can also ask us to stop at any time by emailing enquiries@intai.co.uk.

Unsubscribing from marketing communications will not affect service-related messages, such as delivery of an assessment report you have specifically requested, or communications necessary to administer a client engagement.

10. Who we share your information with

We do not sell personal information. We share it only where necessary, with the following categories of recipient:

• Service providers who support our operations under contract, such as website hosting and infrastructure providers, email delivery and newsletter platforms, customer relationship management (CRM) tools, analytics providers, and PDF or document generation services used to produce your assessment report;
• Portal sub-processors, namely Google Cloud (hosting), Neon (database), Anthropic (approved AI provider), Stripe (payment processing) and Brevo (transactional email), as described in Section 7 and in Section 13.5 of our Terms and Conditions;
• Professional advisers, such as our accountants, auditors, insurers or legal advisers, where necessary for their services to us;
• Regulators and authorities, such as the ICO, HMRC or law enforcement, where we are required to do so by law; and
• A buyer, in the unlikely event that INTAI or its assets are sold, merged or reorganised, in which case personal information may be transferred as part of that transaction, subject to equivalent protections.

Any third party that processes personal information on our behalf is contractually required to keep it secure and to use it only for the purposes we specify.

11. International data transfers

We primarily store and process personal information within the UK and European Economic Area. Portal data is hosted in the UK. Some of the service providers described in Sections 7 and 10, including our AI provider and payment provider, may process information in countries outside the UK, including the United States, typically where they operate global cloud infrastructure.

Where personal information is transferred outside the UK, we ensure appropriate safeguards are in place, such as reliance on the UK’s adequacy regulations, the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, so that your information continues to receive a level of protection equivalent to that provided in the UK.

12. How long we keep your information

We keep personal information only for as long as necessary for the purposes described in this policy, taking into account:

• how long it is needed to provide the service you requested, for example the duration of an active client engagement plus a reasonable period afterwards;
• legal, tax and accounting requirements, which typically require us to keep financial and contract records for at least six years;
• whether you remain subscribed to marketing communications, and how recently you last engaged with us; and
• any relevant limitation periods for legal claims.

Assessment responses and reports are generally retained for a limited period to allow us to respond to your follow-up requests and improve our services, after which they are deleted or anonymised. Retention periods for the Portal are set out in Section 7.7. You can ask us to delete your information sooner, subject to the exceptions described in Section 14.

13. How we protect your information

We use appropriate technical and organisational measures to protect personal information against unauthorised access, alteration, disclosure or destruction, including access controls, encryption of data in transit, secure hosting arrangements and limiting access to personal information to those who need it to do their jobs.

As an AI governance consultancy, we hold ourselves to the same standards we advise our clients to meet. We are currently progressing toward certification against ISO/IEC 42001 (AI management systems), ISO/IEC 27001 (information security management) and the UK Government-backed Cyber Essentials scheme; we will update this section, and the badges shown on our website, once each certification is formally achieved, and we do not claim any certification we do not currently hold.

14. Your rights under UK GDPR

Subject to certain exceptions and conditions set out in data protection law, you have the right to:

• be informed about how we use your personal information, which this policy is intended to satisfy;
• access a copy of the personal information we hold about you;
• rectification of personal information that is inaccurate or incomplete;
• erasure of your personal information in certain circumstances, sometimes known as the “right to be forgotten”;
• restrict our processing of your personal information in certain circumstances;
• data portability, allowing you to obtain and reuse certain information for your own purposes;
• object to processing based on legitimate interests, including direct marketing, at any time; and
• withdraw consent at any time, where we rely on consent as our lawful basis.

To exercise any of these rights, contact us using the details in Section 19. We will normally respond within one calendar month; if a request is complex, we may extend this by a further two months and will explain why. We may need to verify your identity before acting on a request, and there are some circumstances where the law allows us to decline or limit a request, which we will explain if they apply.

15. Children’s information

Our services are intended for business use by adults acting on behalf of their organisation. We do not knowingly collect personal information from children, and our assessments and training tools are not designed or marketed for use by children. If you believe a child has provided us with personal information, contact us and we will take appropriate steps to remove it.

16. Automated decision-making and profiling

When you complete an INTAI assessment, your selected statements are used by an automated scoring engine to calculate domain scores, an overall index, a maturity level and accompanying commentary, as described on our Assessment Methodology page. This is an automated process, but it does not produce a legal or similarly significant effect on you: it generates an indicative, informational report about your organisation’s current position, not a decision about you as an individual, and it does not determine whether we will provide services to you or on what terms.

Where you choose to book a consultation or engage us as a client following an assessment, that relationship always involves a human member of our team; we do not make client engagement, pricing or contractual decisions using automated means alone.

In the Portal, a rules-based policy engine may automatically allow, restrict, block or escalate a workflow request based on the user’s role, training status, the workflow’s approval status and the classification of the data involved. This affects whether a workflow runs, not any individual’s legal rights, and a person at the firm can always ask their administrator or compliance officer to review the outcome. Every AI-generated output in the Portal is a draft that must be reviewed and approved by a person before it is used; the Portal does not make automated decisions with legal or similarly significant effects on individuals.

17. Changes to this policy

We may update this policy from time to time, for example to reflect changes in our services, the law, or guidance from the ICO. Where changes are significant, we will take reasonable steps to bring them to your attention, such as a notice on our website. The “last updated” date at the top of this page shows when it was last revised; we encourage you to review it periodically.

18. How to complain

We hope we can resolve any concern you have about how we handle your personal information; please contact us first using the details in Section 19 so we have the chance to put things right.

You also have the right to lodge a complaint with the Information Commissioner’s Office, the UK’s independent regulator for data protection, at any time. You can contact the ICO at ico.org.uk, by telephone on 0303 123 1113, or by post at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.