Privacy policy

Who we are

AIson Ltd ("AIson", "we") runs this website, aison.co.uk. We are a company registered in England and Wales, company number 17197989, with our registered office at 58 Kinson Road, Bournemouth, BH10 4AN. We are the controller of the personal data described on this page.

For questions about your data, or to use any of your rights, email privacy@aison.co.uk.

What this policy covers

This policy covers our website, its early-access form, and our investor data room at room.aison.co.uk with its form to request access.

The AIson service itself is not open yet. Before it opens, we will update this policy to cover the data the service uses, such as the Google and Meta accounts a business connects to it.

No cookies, no tracking

Our website sets no cookies. It has no analytics, no advertising trackers and no third-party scripts, fonts or embeds: every page and file comes from our own server.

The early-access form

What we collect. Your name, your email address, whether you are a business owner or something else, your type of business, your city and, if you write one, your message. We also record when your request arrived and when it was passed to our team. We do not store your IP address with your request.

Why. To contact you about early access to AIson, which is what you asked for. We will not add you to a newsletter or send you marketing emails unless you separately agree to that.

Lawful basis. Our legitimate interest in replying to people who ask us about early access (UK GDPR, Article 6(1)(f)). Giving us these details is your choice; without them we cannot contact you.

How we handle it. Your request is stored in a database on our own server in Germany and emailed to our team mailbox. We do not use a third-party form service. We may copy requests into our own working files to keep track of early-access conversations.

How long we keep it. We delete each request automatically 365 days after it arrives. Our encrypted backups are deleted after 30 days, so no copy of a request stays in our systems for longer than these two periods together. We delete copies in our mailbox and working files by hand on the same schedule.

Keeping the website safe: logs and limits

Like every website, ours records technical information about requests, to keep the site working and secure:

• Access logs: the time, the page requested, the result, the browser type (User-Agent) and a shortened IP address. For IPv4 the last part is removed; for IPv6 only the first 48 bits are kept. They hold no cookies, no query strings and no referring page, and form submissions are not logged. Access logs are kept for 14 days and are not backed up.
• Spam protection: to limit repeated form submissions, our server holds your IP address in memory for up to 10 minutes. It is never written to disk.
• Error logs: when a request fails at the server, an error log can record a full IP address. These logs are overwritten as they fill up rather than on a fixed date, which normally takes no more than a few months.
• System logs: our server's system logs record what our administrators do and are kept for at most 3 months.

Lawful basis. Our legitimate interest in running a secure, working website (Article 6(1)(f)).

The investor data room

room.aison.co.uk is our investor data room. Its front page is public: it shows our one-pager and has a form to request access (see the next section). Everything else in the room is password-protected, for investors we have invited. The room sets no cookies and uses no analytics, and its public page runs no scripts and loads nothing from other websites.

What we keep. For each investor with access: a login, name, firm, email address, access level, status, and the dates access was given, changed or withdrawn, together with a one-way (bcrypt) hash of the password. The password itself is never stored on our server. Some documents are personal copies marked with the investor's name, firm and the date. Pages and files opened in the room are written to the same access log as the website, with the login used, and a weekly report shows, per login, the last visit and the documents opened.

Why. To give invited investors access to confidential documents, and to know who has seen which documents.

Lawful basis. Our legitimate interest in sharing confidential information with prospective investors in a controlled way (Article 6(1)(f)).

How long we keep it. The investor list is kept until 12 months after our funding round closes, then deleted. Access log lines are kept for 14 days. When we withdraw access, we delete that login's password hash and personal document copies from the server as the room is next updated.

For questions about the data room, email v.presnov@aison.co.uk.

Requests for access to the data room

What we collect. If you use the form on the data room's public page, we keep your full name, your company or fund and your work email address. We also record when your request arrived, a reference number for it, and our decision: whether we approved or declined it, when, and, if we approved it, the login we gave you. We do not accept personal email addresses, such as Gmail, Outlook or iCloud: a request made with one is refused and not stored.

Why. To reply to your request and, if we approve it, to manage your access to the data room.

How we handle it. Your request is stored as a file on our own server in Germany, where only the service that receives the form and our administrators can read it. It is not included in our backups, and our server sends no email about it. We read requests on screen and do not copy them into other files.

If we approve your request. We create a login for you and email you your name, your login, your password and the link to the data room. We send this email ourselves, from our Microsoft 365 email. It stays in our mailbox and in yours until it is deleted; we delete our copies once you have signed in. From then on, your name, company, email address, access level and the dates of your access are part of our investor list, described in the previous section.

How long we keep it. A request we do not approve is deleted 90 days after it arrives. An approved request is deleted 7 days after we approve it; our investor list is kept until 12 months after our funding round closes.

Logs and limits. Sending the form, and the page shown after it, leave no line in our access logs. Other visits to the public page are logged in the same way as visits to our website (see the section on logs above). To limit repeated requests, our server holds your IP address in memory for up to a day; it is never written to your request, to a file or to a log. The service that receives the form keeps its own log of when each request arrived, its reference number and the outcome, with no names, email addresses or IP addresses.

Your rights. You have the rights described under Your rights below. If you ask us to delete your request, we delete its file from our server.

Who receives your data

We use these service providers, who process data only on our instructions:

• Hetzner Online GmbH, Germany: our server and our encrypted backups, in data centres in Nuremberg and Falkenstein.
• Microsoft (Microsoft 365): our email, including the team mailbox that receives early-access requests and the emails we send to give investors access to the data room. Our Microsoft 365 data is stored in data centres in the European Union.
• Google (Google Workspace): working files where we may keep track of early-access conversations.

Our code hosting (GitHub) and our uptime monitoring (Healthchecks.io) receive no personal data from the website. We do not sell personal data or share it for advertising.

Where your data is stored

Our server and backups are in Germany, in the European Economic Area, which the UK recognises as providing adequate protection for personal data. Microsoft stores our data in the European Union. Google may process data outside the UK and the European Economic Area. Where it does, the transfer is protected by the UK Extension to the EU–US Data Privacy Framework or by standard contractual clauses with the UK addendum.

Your rights

Under UK data protection law you can ask us:

• for a copy of your data;
• to correct it or delete it;
• to restrict or object to how we use it;
• to receive it in a portable format.

Email privacy@aison.co.uk. We reply no later than one month after we receive your request. To have your data deleted, see our Data deletion page.

You can also complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113). We would appreciate the chance to deal with your concern first.

Automated decisions

We make no decisions about you by automated means alone.

Changes to this policy

We will update this page when what we do with personal data changes, including before the AIson service opens. The date at the top shows the current version.