Data Processing Policy

1. Introduction

This Data Processing Policy (“Policy”) describes how AI ASSIST SMES LTD, trading as AI-Assist for SMEs (“we”, “us”, “our”) processes personal data in connection with our AI automation platform and related services (the “Service”). This Policy forms part of our commitment to compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

For the personal data of our customers and their staff (accounts, billing, support) and of visitors to our own website, AI ASSIST SMES LTD is the data controller. For the personal data our customers put into the Service about their own customers and contacts (for example chatbot conversations, leads, clients and bookings), our customer is the controller and we are their processor, under our Data Processing Agreement. Our ICO Registration Number is ZC272982.

This Policy should be read in conjunction with our Privacy Policy and Terms of Service.

2. Data Processing Purposes

We process personal data for the following specific purposes:

• Service Delivery: To provide, operate, and maintain our AI automation platform, including user account management, AI chatbot functionality, and automation tools.
• Payment Processing: To process subscription payments, manage billing cycles, issue invoices, and handle refunds.
• Communications: To send transactional emails (account verification, password resets, billing notifications) and, where consented, marketing communications.
• Service Improvement: To analyse usage patterns, diagnose technical issues, and improve the performance and features of the Service.
• Security and Fraud Prevention: To detect, prevent, and respond to security incidents, fraudulent activity, and abuse of the Service.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes, including tax and accounting obligations.

3. Lawful Basis for Processing

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Performance of a Contract (Article 6(1)(b)): Processing necessary to deliver the Service you have subscribed to, including account creation, service provision, and payment processing.
• Legitimate Interests (Article 6(1)(f)): Processing necessary for our legitimate business interests, such as improving our Service, ensuring security, and preventing fraud, where these interests do not override your fundamental rights and freedoms.
• Consent (Article 6(1)(a)): Processing based on your freely given, specific, informed, and unambiguous consent, such as for marketing communications and non-essential cookies.
• Legal Obligation (Article 6(1)(c)): Processing necessary to comply with our legal obligations, including tax reporting, financial record-keeping, and responding to lawful requests from authorities.

4. Sub-Processors

This table lists the service providers we use to deliver the Service. Only those listed in Annex 3 of our Data Processing Agreement are sub-processors of our customers' data, and each of those is bound by a written data processing agreement. Stripe and Plausible process only data about our own customers and website visitors. Google and Zoom receive data only when you connect your own account.

We will email account owners at least 30 days before we add or replace a sub-processor that processes our customers' data, and update this Policy. Customers can object as set out in our Data Processing Agreement.

5. International Data Transfers

Some of our sub-processors are located outside the United Kingdom. Where personal data is transferred to countries that have not been deemed to provide an adequate level of data protection by the UK Secretary of State, we ensure appropriate safeguards are in place:

• UK Adequacy Decisions: Transfers to countries recognised by the UK as providing adequate data protection (including the EU/EEA under the UK adequacy regulations).
• Standard Contractual Clauses (SCCs): For transfers to the United States and other countries without adequacy decisions, we rely on the International Data Transfer Agreement (IDTA) or the EU SCCs with the UK Addendum, as approved by the Information Commissioner's Office (ICO).
• Supplementary Measures: Where necessary, we implement additional technical and organisational safeguards, such as encryption and pseudonymisation, to ensure the transferred data remains protected.

Specifically:

• Supabase: Our database is hosted in the EU (Ireland, eu-west-1); customer account and service data is stored within the EU.
• Stripe: Operates globally with data stored in the US and EU. Transfers are covered by the EU Standard Contractual Clauses with the ICO International Data Transfer Addendum, and the UK Extension to the EU-US Data Privacy Framework.
• Vercel: Uses a global edge network. Transfers outside the UK are covered by SCCs with the UK Addendum.
• Resend: Data is processed in the US. Transfers are covered by SCCs with the UK Addendum.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected. Our retention periods are as follows:

• Account data: Kept for as long as you have an account. When you delete your account, your account and business data — including chatbots, conversations, leads, clients, bookings, messages and uploaded files — are deleted straight away and cannot be recovered, so please download anything you need first. A few records are kept: invoices and payment records held by our payment provider, Stripe; billing and account-security audit entries, which are no longer linked to your account but can contain payment references (and your email address if we deleted the account at your request); a record of which version of our Terms and Data Processing Agreement you accepted, and when, which we keep as evidence of our contract; messages you sent us through our website contact form; and our service providers’ own operational logs (such as email-delivery and error logs), which they keep for limited periods. Copies may also remain in our database provider’s encrypted daily backups for up to 7 days until they are overwritten.
• Payment and transaction records: Retained for 7 years as required by UK tax law (HMRC requirements).
• Service usage data: Retained for up to 24 months for analytics and service improvement, then anonymised or deleted.
• Email communication logs: Retained for 12 months for delivery tracking and troubleshooting.
• Support correspondence: Retained for 3 years after your last interaction.
• Security and access logs: Sign-in session records are retained for 90 days for security monitoring and incident investigation.
• Chat messages: Retained for 365 days, then automatically deleted.
• Webhook delivery attempts: Retained for 90 days for billing-integrity troubleshooting.

When personal data is no longer required, it is securely deleted or anonymised in accordance with our data disposal procedures.

7. Security Measures

We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including:

7.1 Technical Measures

• Encryption at Rest: All personal data stored in our database is encrypted at rest using AES-256 encryption.
• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2 or higher.
• Access Controls: Role-based access controls (RBAC) limit access to personal data to authorised personnel only.
• Row-Level Security: Database-level security ensures that users can only access their own data.
• Secure Authentication: Passwords are hashed using bcrypt. Multi-factor authentication is available for all accounts.
• PCI DSS Compliance: Payment processing is handled by Stripe, which is certified PCI DSS Level 1.

7.2 Organisational Measures

• Administrative access is limited to the founder and protected by two-step verification
• Changes to user roles and billing are logged
• Security reviews are carried out before major releases
• Incident response steps are documented, and payment-related errors raise an immediate alert
• Sub-processor security practices are reviewed as part of our due diligence process

8. Data Breach Notification

In the event of a personal data breach, we will follow the notification requirements set out in Articles 33 and 34 of the UK GDPR:

8.1 Notification to the ICO

Where a personal data breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, in accordance with Article 33 of the UK GDPR. The notification will include:

• The nature of the breach, including the categories and approximate number of individuals affected
• The name and contact details of our Data Protection Contact (info@aiassistsmes.co.uk)
• A description of the likely consequences of the breach
• A description of the measures taken or proposed to address the breach

8.2 Notification to Affected Individuals

Where a breach is likely to result in a high risk to the rights and freedoms of individuals, we will notify the affected individuals without undue delay, providing clear information about the breach and the steps they can take to protect themselves.

9. Data Subject Rights

This section applies to personal data for which we are the controller. If you are a visitor or contact of one of our customers, please contact that business first: they control your data, and we will help them respond.

We support the exercise of data subject rights as set out in the UK GDPR. Individuals whose personal data we control have the right to:

• Access their personal data (Article 15)
• Rectify inaccurate or incomplete data (Article 16)
• Erase their personal data (Article 17)
• Restrict processing of their data (Article 18)
• Data portability — receive their data in a structured, machine-readable format (Article 20)
• Object to processing based on legitimate interests or for direct marketing (Article 21)

To exercise any of these rights, please contact us at info@aiassistsmes.co.uk. We will respond within one month of receiving your request.

10. Changes to This Policy

We may update this Data Processing Policy from time to time to reflect changes in our processing activities, sub-processors, or applicable law. Material changes will be communicated by updating this page with a revised “Last updated” date. Where significant changes are made, we will also notify you by email.

11. Contact Us

For any questions about this Data Processing Policy or our data processing practices:

• Data Protection Contact: info@aiassistsmes.co.uk
• Address: AI ASSIST SMES LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
  Operational team based in Birmingham, UK

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.