Legal
Audr AI Limited. UK Company No. 17147583.
Audr AI Limited ("Audr", "we", "us", "our") is a company registered in England and Wales under company number 17147583, with its registered office at [registered office address]. We provide an AI transformation platform for organisations.
This policy explains how we handle personal data. For questions or to exercise your rights, contact us at [privacy contact email, for example privacy@audr.com]. General support enquiries go to support@audr.com. [If you have appointed a Data Protection Officer or UK representative, add their details here.] [If you are registered with the Information Commissioner's Office, add your ICO registration number here.]
This policy covers personal data we handle as a controller, meaning where we decide how and why it is processed. That includes visitors to our website, prospective customers, and the account and profile data of the people who use the Audr Platform.
Separately, when a Customer organisation uses the Platform to collect information about its own people, for example through Clarity questionnaires or Academy activity, Audr acts as a processor on that organisation's behalf. In that case the Customer is the controller and its own privacy notice governs that data. Our handling of it is set out in our data processing terms with the Customer. If you are an employee of a Customer and have questions about how your data is used, please contact your employer.
Depending on how you interact with us, we may collect the following categories of personal data.
Identity and account data: full name, work email, password, job title, department, and an optional profile photo, collected at registration.
Questionnaire (Clarity) data: your closed-question responses, and, where the voice interview phase is enabled, spoken responses converted to a transcript with adaptive follow-up content [confirm live status of the voice interview phase before publishing; it is architecturally planned but not yet confirmed built].
Your assigned Audr role result from Clarity (one of four categories describing how you engage with AI adoption at your organisation).
AI Level data: points, tier, stage history, and, if you opt in, visibility on a company leaderboard.
Academy data: course progress, quiz scores, and ratings you submit, plus, where you use the "Ask Joy" course chat, a text transcript of that conversation, which is attached to your course completion email even though the in-app view is session-only.
Sandbox conversations: private AI chat sessions. These are not visible to your organisation or to Audr, and are cleared when you sign out. We do not retain or review Sandbox content.
People and Compliance module data: for Admins and Owners, data about your organisation's people (name, department, role type, AI Level, questionnaire and Academy status) and your organisation's self-declared compliance profile (jurisdiction, industry, headcount, AI tools in use, and whether your organisation handles employee, customer, health, or financial data categories).
Communications with us: support requests and other correspondence.
Billing data, handled by our payment processor; we do not store full card details [confirm processor before publishing].
Technical and usage data: IP address, device and browser information, and similar.
We do not seek to collect special category data. Please do not submit sensitive personal data through the Service except where expressly agreed and lawfully permitted. One feature under review, peer nomination (sometimes called sociometric mapping) inside Clarity, would involve people describing their working relationships with colleagues. Audr has not enabled this feature for live use pending its own GDPR assessment, and this policy will be updated with specific detail before it is offered to any Customer.
We use personal data to: provide, secure, and support the Service (lawful basis: performance of a contract, or our legitimate interests in running our business); manage accounts and authenticate users (contract; legitimate interests); process payments and manage subscriptions (contract; legal obligation); provide AI features such as Joy (contract; legitimate interests); communicate with you about the Service (contract; legitimate interests) and, where required, send marketing only with your consent, which you can withdraw at any time; improve and develop the Service, using aggregated or de-identified data where practical (legitimate interests); and comply with legal obligations and protect our rights (legal obligation; legitimate interests).
Where we rely on legitimate interests, we balance those interests against your rights, and you can object as described below.
Some features use artificial intelligence models [confirm the current model or gateway before publishing; the Platform specification states Joy is powered by Claude Sonnet via the Anthropic API, or an equivalent model]. AI behaviour differs by feature, and it is important to be precise rather than treat all AI interactions the same way.
Sandbox is private. Conversations are not visible to your organisation or to Audr, and are cleared on sign-out. We do not retain or review this content.
Academy "Ask Joy" course conversations are session-only in the app, but a text transcript is attached to your course completion email if a conversation took place. That transcript is then retained as part of your email record, even though the live chat is not persisted for later in-app review.
Clarity's AI-led voice interview, where enabled, generates a transcript that is stored as part of your questionnaire response and is visible to your organisation's Admins and Owners as part of the Clarity report, in the same way your written questionnaire answers are.
We instruct our AI provider not to use content submitted through the Service to train their general models, to the extent their terms allow [confirm this against your current AI provider's actual terms before publishing]. AI output can be inaccurate and is not professional advice, as explained in our Terms of Service.
We share personal data with service providers who process it on our behalf under contract, and only as needed to run the Service. Our sub-processor list is being confirmed against the live production build (as distinct from the Lovable demo environment used during development) and will be published here once confirmed. [Do not publish specific sub-processor names, such as a particular database, hosting, email, or analytics provider, until Aviv has confirmed the real production stack. Placeholder rows below should stay bracketed until then.]
| Sub-processor | Purpose | Location |
|---|---|---|
| [Database, authentication, and file storage provider] | Core Platform functionality | [region] |
| [AI model provider] | Joy AI features | [region] |
| [Payment processor] | Payment processing and subscription management | [region] |
| [Email provider] | Transactional email | [region] |
| [Website hosting provider] | Audr website hosting | [region] |
| [Voice/conversation vendor, if Clarity's voice phase goes live] | AI-led voice interview | [region] |
We may also share personal data with professional advisers, and with authorities or others where required by law, or in connection with a merger, acquisition, or sale of our business, subject to appropriate protections.
We and some of our providers may process personal data outside the United Kingdom. Where we transfer personal data outside the UK, we use appropriate safeguards, such as the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or transfers to countries the UK considers adequate. [Confirm your actual data residency position once the production hosting is finalised.] You can ask us for more information using the contact details above.
We keep personal data for as long as needed to provide the Service and for legitimate business or legal purposes, then delete or anonymise it. When a Customer requests deletion of its company account, we process that deletion within five business days. Short of full account deletion, some administrative actions retain data rather than deleting it by default: archiving an individual user, or removing a user's access, both retain that person's data rather than erasing it immediately. Where we process data on behalf of a Customer, retention otherwise follows our agreement with that Customer.
Subject to conditions and exemptions under UK data protection law, you have the right to: access the personal data we hold about you; ask us to correct inaccurate data; ask us to erase data; restrict or object to processing; request portability of certain data; and withdraw consent where we rely on it. To exercise a right, contact us at [privacy contact email]. If your data is processed by Audr on behalf of your employer, we will direct your request to them where appropriate.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk, although we would welcome the chance to address your concerns first.
We use technical and organisational measures to protect personal data appropriate to the Service, including access controls scoped by role (Owner, Admin, Employee, and a separately access-controlled SuperAdmin system for Audr staff), encryption in transit, and logical separation of each Customer's data. No system is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to respond appropriately to any incident. [Confirm encryption-at-rest, backup, and any uptime commitment against the live production build before publishing; these are not yet documented.]
Our website uses cookies and similar technologies to operate the Service, remember preferences, and understand usage. Full detail on the categories we use and how to manage your choices is in our Cookie Policy.
The Service is not intended for children. We do not knowingly collect personal data from anyone under 18 in a personal capacity. [Confirm this B2B-only assumption holds before publishing.]
We may update this policy from time to time. We will post the updated version with a new effective date and, where changes are significant, provide additional notice. Please review it periodically.
To contact us about this policy or your personal data, email [privacy contact email] or write to Audr AI Limited at [registered office address]. You can also contact the ICO at ico.org.uk.