Privacy Policy

1. Who is responsible

IvyAI Ltd, company number 17388323, is the controller of account, website, support, security and business-contact information used to operate IvyAI. Our registered office is 34 Cedars Drive, Stone, Staffordshire, ST15 0BB. Contact support@ivyai.co.uk.

When a business uses IvyAI to collect and manage its customers' booking information, that business is normally the controller and IvyAI acts as its processor. Customers should first contact the business shown on the booking page about that booking data.

2. Information we process

• Account and business details, including name, email, business identity and authorised-user role.
• Booking data, including customer contact details, service, location, date, time, status and administrative messages.
• Technical and security data, including IP address where needed, device and browser information, authentication events, logs and error diagnostics.
• Support communications and records of legal acceptance.

Do not provide medical, clinical or other sensitive personal information. IvyAI V1 is not designed for clinical records.

3. Purposes and lawful bases

• Provide and administer accounts and the service: performance of our contract and legitimate interests.
• Secure, troubleshoot and prevent abuse: legitimate interests and legal obligations.
• Respond to support and rights requests: contract, legitimate interests and legal obligations.
• Send service and booking communications: contract and the business controller's instructions.
• Maintain legal, accounting and compliance records: legal obligations and legitimate interests.

Where consent is genuinely required, we request it separately and it can be withdrawn. We do not use consent as a blanket basis for core service processing.

4. Sharing and processors

We share information only as needed with authorised business users, service providers, professional advisers, regulators, law enforcement where legally required, and a buyer or successor in a legitimate corporate transaction. Current service providers are listed on our Subprocessors page. We do not sell personal information.

5. International transfers

Some providers may process information outside the United Kingdom. Where UK personal data is transferred internationally, we use an applicable adequacy decision, the UK International Data Transfer Agreement or Addendum, recognised standard contractual clauses, or another lawful safeguard. Provider and location details are published where confirmed.

6. Retention

• Customer and booking data: by default, 24 months after the last relevant activity, subject to the controller's instructions and available retention settings.
• Closed account data: normally read-only for up to 30 days, then deletion processing begins.
• Security and diagnostic logs: normally up to 90 days, unless needed for an active investigation.
• Support and complaint records: normally up to 24 months after closure.
• Legal, tax and contract records: up to 6 years where required or reasonably necessary.
• Backup copies are removed or overwritten through applicable provider backup and retention cycles. They are not ordinarily restored for normal business use after primary deletion unless required for security, disaster recovery or legal purposes.

We may retain specific records longer for a legal hold, dispute, fraud prevention or another legal obligation. Deletion is not currently fully automated.

7. Your rights

Depending on the circumstances, you may ask for access, correction, deletion, restriction, portability or objection, and may withdraw consent. Email support@ivyai.co.uk. We may need to verify identity. If the request concerns booking data controlled by an IvyAI business, we will direct it to or assist that business.

We will acknowledge privacy complaints within 30 days and handle rights requests without undue delay, normally within one month, subject to lawful extensions. You may complain to the UK Information Commissioner's Office at ico.org.uk.

8. Security and automated decisions

We use access controls, tenant separation, encryption in transit, monitoring and tested security controls appropriate to the risk. No system can be guaranteed completely secure. IvyAI V1 does not make solely automated decisions producing legal or similarly significant effects about booking customers.

9. Cookies and changes

With your consent, our marketing website uses Google Analytics 4, provided by Google, to measure page visits and website interactions using browser identifiers and technical data. Analytics is optional and is not used for advertising personalisation. You can withdraw consent using Cookie settings. Google may process this information outside the UK; see Google’s privacy policy.

See our Cookie and Storage Notice. We may update this policy when the service or law changes. Material changes will be communicated through the service or by email where appropriate, and the effective date will be updated.