Standard Intelligence Limited ("Standard Intelligence", "we", "us") provides an AI governance platform for organisations subject to the EU AI Act. This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and what rights you have. It applies to our website, to our platform when you use it, and to any communication you have with us.
1. Who is the controller
The controller for personal data we process about website visitors, business contacts and prospects, and users of our platform is Standard Intelligence Limited, a company registered in England and Wales under number 16737890. Our registered office is 128 City Road, London EC1V 2NX.
For content that customers put into the platform, such as AI-system descriptions, evidence and any personal data in them, the customer is the controller and we are its processor. The terms of that relationship are set out in our Data Processing Agreement with each customer. We are the controller of your platform account and sign-in data.
You can contact us at:
- Data-protection requests, complaints and general enquiries: privacy@standardintelligence.com
- Our Data Protection Officer: dpo@standardintelligence.com
2. What personal data we collect
We collect the minimum data needed for each purpose. To create an account, you need to give your name and email address; without them we cannot provide the platform. Our forms mark the fields they need, and everything else is optional. The categories are:
- Business contact data. Your name, work email, company, role and country, what you tell us in our forms, the scope checker or a LinkedIn lead form, and the campaign that brought you to us (campaign tags in the web address). We keep a record of any objection you make to marketing. We may add public business information, such as Companies House records, about the organisation you contact us from. This may include the names and roles of that organisation's officers and of the people with significant control of it, as published by Companies House.
- Communications. Anything you send us by email, contact forms or chat. If you agree, we also record when you open our emails and which links in them you click. This is off unless you agree, and you can withdraw your agreement at any time.
- Sales calls. If you book a call with us, we record and transcribe it, and AI note-taking summarises it. We keep the recording, transcript and call notes with your contact record. We tell you this when you book and in your confirmation. If you ask us not to record when you book, we do not record, transcribe or summarise the call. If you object during the call, we stop. If you object at any time, we delete the recordings, transcripts and notes we hold of you.
- Job candidates. If you register your interest in working for us on our careers page, we collect your name, your email address, the area you would like to work in, and any link and note you add. We use them only to consider you for roles. We never use them for marketing or lead scoring. They are held by our CRM supplier, and our team receives a copy of your registration by email.
- Website and request data. Pages viewed and request details, such as your browser type and IP address. We use your IP address to deliver pages, count visits without identifying you, monitor the site's speed and errors, and protect our services from abuse. It is kept only in short-lived hosting and security logs, and briefly by our rate-limiting service to block repeated attempts.
When you use our platform, we also collect:
- Account data. Your name, email address and an account identifier when you sign up. Your workplace and role only if you choose to give them.
- Authentication data. Session cookies, sign-in events, and your multi-factor settings if you turn them on.
- Usage data. Features used and error reports. We do not record keystrokes. If you allow error recordings, when an error occurs our error-tracking supplier keeps a short recording of the page activity leading up to it, so that we can fix the fault. All text and form inputs are masked, and images and media are blocked. Error recordings are off unless you turn them on, and you can turn them off in settings. If no error occurs, nothing is sent to our supplier or kept.
- Customer compliance content. AI-system descriptions, evidence files, classification decisions and the audit trail of actions in your account. This is content you create deliberately to use the service. We treat it as confidential and do not use it to train models.
- Billing data. Our payment supplier collects and holds your card details, billing address and tax identifiers. We hold only the references we need to reconcile invoices.
We do not knowingly collect special categories of personal data, such as data about health, biometrics or political opinions. Please do not upload such data into customer compliance content. Our services are not directed at children.
3. Why we use it (lawful basis)
The lawful bases below are those set out in Article 6 of the UK General Data Protection Regulation (UK GDPR).
| Purpose | Lawful basis |
|---|---|
| Purpose Providing the product to you as a user of your organisation's account | Lawful basis Legitimate interests (Art 6(1)(f)): providing the service your organisation has contracted for |
| Purpose Authenticating you and protecting against abuse | Lawful basis Legitimate interests (security) |
| Purpose Selling you a licence and taking payment | Lawful basis Contract (Art 6(1)(b)), where you buy for yourself. Legitimate interests (Art 6(1)(f)), where you buy for your organisation: selling our service to businesses |
| Purpose Keeping billing and tax records | Lawful basis Legal obligation (Art 6(1)(c)): UK tax law |
| Purpose Finding and fixing technical faults (error tracking, including the error recordings described in section 2) | Lawful basis Legitimate interests (Art 6(1)(f)): keeping the service working |
| Purpose Replying to your enquiry or scope-checker result, arranging any meeting you ask for, following up about Standard Intelligence, and deciding which enquiries to follow up first (lead scoring). | Lawful basis Legitimate interests (Art 6(1)(f)): responding to business enquiries and promoting our service to businesses. Meeting confirmations and reminders are not marketing. You can object at any time. |
| Purpose Researching the organisation of someone who has contacted us, using public records such as Companies House | Lawful basis Legitimate interests (Art 6(1)(f)): understanding a business that has approached us |
| Purpose Measuring our LinkedIn advertising, by sending LinkedIn a hashed form of your contact identifiers and whether you became a lead or customer, as described in section 5 | Lawful basis Legitimate interests (Art 6(1)(f)): measuring whether our advertising works. You can object at any time. |
| Purpose Recording and transcribing a sales call you book with us, as described in section 2 | Lawful basis Legitimate interests (Art 6(1)(f)): keeping an accurate record of the call for follow-up. You can ask us not to record it. |
| Purpose Considering you for roles, if you register your interest on our careers page | Lawful basis Consent (Art 6(1)(a)), given on the form. You can withdraw it at any time. |
| Purpose Our newsletter, if you sign up to it | Lawful basis Consent (Art 6(1)(a)) |
| Purpose Recording whether you open our emails and click their links, to tailor what we send you | Lawful basis Consent (Art 6(1)(a)), given when you sign up; off unless you agree |
| Purpose Marketing email to individual subscribers, such as sole traders | Lawful basis Consent (Art 6(1)(a)), or, if you are an existing customer, legitimate interests (Art 6(1)(f)) under the soft opt-in in regulation 22 of the Privacy and Electronic Communications Regulations. You can unsubscribe at any time. |
| Purpose Holding and contacting business contacts in the EU or EEA whom we have added with their agreement | Lawful basis Consent (Art 6(1)(a)) |
| Purpose Showing you our website | Lawful basis Legitimate interests (Art 6(1)(f)): running our website |
| Purpose Linking the pages of our website you visit to your contact record, so our team can prioritise and follow up on what interests you | Lawful basis Consent (Art 6(1)(a)), given in Cookie settings; off unless you turn it on |
We do not sell personal data, and we do no behavioural advertising.
If you turn on marketing cookies, we look at which pages of our website you visit, to understand your interests and tailor what we send you. This is off unless you choose it. The pages you visit may also inform which enquiries we follow up first. Your browsing only ever adds to a score, and refusing consent never lowers it. Some details you give us, such as a personal email address, can lower it. You can withdraw your consent at any time. We do not make decisions about you based solely on automated processing.
We do not use customer compliance content to train AI models. Model training is switched off for our use of every AI provider.
4. How long we keep it
In summary:
- Business contact data, including sales-call recordings, transcripts and notes, is kept until you object, or for 24 months after your last interaction with us, whichever is sooner. We keep a minimal record of objections so we can honour them.
- Public business information about an organisation, including the names and roles of its officers, is kept for 24 months after we stop dealing with that organisation.
- Job candidates' details are kept for 12 months and then deleted. Deleted records are removed permanently within a further 90 days. If you withdraw your consent, we delete them sooner.
- Identity and account data is held while your account exists. If your account is deactivated, we delete it within 30 days. If your organisation leaves the service, it is kept with your organisation's data for the period described below.
- Customer compliance data (AI-system records, evidence, classification decisions, documents) is held while your organisation subscribes, and your organisation can export it at any time. When your organisation leaves, its account is closed but kept intact for 90 days, so that it can reactivate with everything as it was or download a full export. After 90 days we delete it. Your organisation can ask us to delete it sooner, and we do so within 30 days of the request.
- The customer audit trail is kept for up to ten years while your organisation subscribes. When it leaves, the audit trail is kept with its other data for the same 90 days, is included in the export, and is then deleted.
- Database backups are kept for 7 days on a rolling basis, and an encrypted copy, held in the UK or the EU, for 30 days. Deleted data therefore leaves our backups within 30 days of deletion.
- Billing records are kept for six years from the end of the accounting period they relate to, as UK tax law requires, and longer if HM Revenue & Customs (HMRC) opens an enquiry.
- Hosting request logs, which include IP addresses, are kept for 1 day. Rate-limiting entries expire within about 48 hours. Application logs, which contain no personal data by design, are kept for no more than 30 days. Error reports and the error recordings described in section 2 are kept for up to 90 days. Email delivery logs are kept for 28 days.
5. Who we share it with
We share personal data with the suppliers described below. Customers receive the named list of our sub-processors in our Data Processing Agreement. The categories are:
- Email and workplace tools: our workplace supplier, which holds the email you send us, with data stored in Europe. Our founders use AI tools to help them read and reply to email. These use Anthropic's Claude models through Amazon Web Services in the EU, which processes that email in the EU, does not keep it and does not use it to train models. If you would prefer your emails were not handled this way, tell us at privacy@standardintelligence.com.
- Customer relationship management (CRM): our CRM supplier, in the EU. It holds business contact data, never customer compliance content.
- Hosting, content and monitoring: our hosting, database and rate-limiting suppliers, in the UK; our error-tracking and performance-monitoring supplier, in the EU; our visit-counting service, in the EU; and our content management supplier, which delivers the website's text and images.
- Website films: when you press play on a film on our website, it streams from Mux, Inc. in the United States, which receives your IP address and device information to deliver it. This transfer is covered by the EU-US Data Privacy Framework and its UK Extension. No cookies are set when you play a film.
- Background jobs: our job-processing supplier, in the United States. It receives identifiers, such as account and record numbers. Everything else we send it is encrypted with a key only we hold, so it cannot read customer content.
- Sign-in and email delivery: our identity provider and our email delivery supplier, both in the EU.
- Advertising measurement: LinkedIn. If you are in the UK and reach us through a LinkedIn advert or lead form, we send LinkedIn a hashed (scrambled) form of your contact identifiers and the fact that you became a lead or customer, so that we can measure our advertising. LinkedIn and we are joint controllers for this measurement under LinkedIn's Joint Controller Addendum. In essence, we are responsible for having a lawful basis to share the data and for telling you about it, and LinkedIn is responsible for its own processing of it. You can exercise your rights with either of us.
- Payments: our payment supplier, for billing only. It may process your payment data outside the UK, including in the United States, under approved safeguards.
- AI services in the platform: our AI model providers, in the EU. They process the system descriptions and answers your organisation enters, to produce classifications and guidance. They do not train models on this data, and keep it for no more than 30 days, for abuse monitoring, where they keep it at all. We do not add your name, email address or other account details to what we send them, so please do not include personal data in your descriptions and answers.
We do not transfer customer compliance content outside the UK and the EU, other than in the encrypted form our job-processing supplier cannot read. Some suppliers process personal data outside the UK. Where they do, we rely on UK adequacy regulations. Where there are none, we rely on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with additional safeguards where needed. You can ask for a copy of the safeguard at privacy@standardintelligence.com.
We may disclose personal data to a regulator or court if the law requires it.
6. Your rights
If we hold personal data about you, you have the right to:
- access the data we hold about you (Art 15);
- rectify inaccurate data (Art 16);
- erase your data (Art 17), subject to retention obligations we are legally required to meet;
- restrict processing in certain circumstances (Art 18);
- object to processing (Art 21), as set out below;
- receive a portable copy of data you provided to us, where we rely on your consent or a contract with you (Art 20);
- withdraw consent at any time where consent is the lawful basis.
Your right to object to processing based on legitimate interests. Where we rely on legitimate interests, you can object at any time, on grounds relating to your particular situation. We will then stop, unless we have compelling legitimate grounds that override your interests, rights and freedoms, or we need the data to establish, exercise or defend legal claims.
Your right to object to direct marketing. You can object at any time to our use of your details for marketing, including lead scoring, and you can withdraw your consent for us to link your website visits to your contact record at any time. We will stop straight away. Visits already linked stay with your contact record for the period in section 4, unless you ask us to delete them. Use the unsubscribe link in any of our marketing emails, or email privacy@standardintelligence.com.
To exercise any of these rights, email privacy@standardintelligence.com. We respond within one calendar month. If your request is complex, or you have sent us several, we may extend this by up to two further months. We will tell you within one month, with the reason. We may need to verify your identity before responding.
7. How to complain
If you are unhappy with how we have handled your personal data, please complain to us first at privacy@standardintelligence.com. We will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
You also have the right to complain to the UK Information Commissioner's Office (ico.org.uk) or to your local supervisory authority.
8. Security
We protect personal data with appropriate technical and organisational measures, including encryption in transit and at rest, strict access controls, multi-factor authentication for staff, and separation of each customer's data so that no customer can see another's.
If we discover a personal data breach, and the UK GDPR requires us to report it, we will report it to the Information Commissioner's Office within 72 hours of becoming aware of it. If the breach is likely to result in a high risk to your rights and freedoms, we will also tell you without undue delay.
9. Cookies and similar technologies
We use only the cookies and similar storage that the site or platform you are using needs to work, such as keeping you signed in and signing you out securely, or remembering a choice you make, such as your display settings. If you sign in on our website, it keeps a short session so that it can show your name and a link to the platform; it ends when you sign out or your sign-in expires. The law allows these without consent. Anything else, such as our customer relationship supplier's marketing cookies, is set only if you turn on marketing in the cookie banner. If you don't, nothing on our website tracks you or links your visits to you. Campaign tags in a web address are read only when you send us a form, and nothing is stored on your device. Our Cookie Policy lists each item with its purpose and how long it lasts, grouped by whether the law allows it without consent or it needs your consent.
Some services work without storing anything on your device. Before you make any choice, our website does the following:
- It loads its images from our content supplier's delivery network. It keeps an open connection to that network so that published changes appear without reloading.
- It counts visits without cookies and without identifying you. You can turn visit counting off at any time in Cookie settings on the website.
- It monitors its own speed and errors, including any content your browser blocks under our security policy.
Your browser's request, including your IP address, reaches those suppliers so that they can respond. We have set them not to keep your IP address where they offer that, and none of them sets a cookie.
A film on our website loads only when you press play. It plays in our own player and streams from Mux, Inc., as described in section 5. Your browser's request, including your IP address, then reaches Mux. No cookies are set when a film plays.
In the platform, if you allow error recordings, our error-tracking supplier keeps a short-lived marker in your browser's session storage so that, if an error occurs, the recording described in section 2 can be linked to it. It is set only with your permission and is deleted when you close the tab.
10. Changes to this policy
We will tell you in advance about any material change to this policy. We will do so in the platform, by email if you are a customer, or by a notice on our website. The version and date at the top show when it last changed.
11. Children
Standard Intelligence is a business-to-business service. We do not knowingly market to, or collect data from, anyone under 18. If you believe a child has provided us with personal data, contact us and we will delete it.