Privacy Policy

Last updated 22 October 2026

This policy explains how we handle personal data about you and your Users, visitors to our websites and people who contact us. Where you feed us other people's personal data (your customers, suppliers, staff or contacts), you are the controller and we are your processor — see the DPA.

1. Who we are

DigitAIse is operated by AIME TECH UK LIMITED, a company registered in England & Wales (company number 16819323; registered office 42 Beaufort Court, Admirals Way, London E14 9XL). We are registered with the Information Commissioner's Office (ICO) as a data controller, registration number ZC169006. We are the data controller for account, billing, usage and website data. Contact / data requests: privacy@digitaise.co.uk, or write to our registered office. When we host a website for one of our customers (Webdesigner), that business is the controller for the personal data its visitors send through the site (enquiries, booking requests and website chat) and we are its processor: the site's own privacy page explains how that business uses it, so please contact that business first.

2. What we collect, why, and our lawful basis

Account: name, email, business name, role, hashed password, two-factor and sign-in settings — Create and run your account, authenticate, send service emails, support — Contract (for Users you invite: our legitimate interests in running the account you set up)
Billing: billing name, address, email and VAT number, invoices and payment status (card handled by Stripe — we do not store card numbers) — Take payment, issue invoices, keep accounts — Contract; legal obligation (tax and accounting records)
Content you upload or connect: documents (from which we extract transactions, suppliers, line-items and detect/flag personal data such as emails, phone numbers, IBANs), emails, calendar, reviews, social mentions, chat and voice content — To deliver the features you turn on — Contract; for other people's data in it, we act as your processor (see the DPA)
Connected-account tokens (Google/Microsoft/Xero/QuickBooks/FreeAgent/your bank via TrueLayer/social), stored encrypted — To act on the sources you authorise — Contract
Email you connect directly: instead of forwarding to Nova's address (optional), Nova reads new mail and sends the replies you approve, through Gmail or Outlook via Composio or other providers with an app password, stored encrypted — To read new mail and send the replies you approve; Nova changes nothing else in your mailbox — Contract; for other people's data in it, we act as your processor (see the DPA)
Calendar you connect (optional): your Google or Outlook calendar, via Composio — To see when you are busy when Nova suggests meeting times in email drafts, show its events on your Calendar page, and add a meeting you agree in a reply you approve; Nova changes nothing else in your calendar — Contract; for other people's data in it, we act as your processor (see the DPA)
Get Paid (if you turn it on): your customers' contact details and invoice/payment status, from your connected accounting software or what you upload — To draft and send payment-chase emails and texts for your own unpaid invoices, for your approval — Contract; for your customers' data, we act as your processor (see the DPA)
Phone numbers of your customers (for bookings and Get Paid) and the texts we send them: recipient number, message text, delivery status, cost and opt-out choice — To send booking reminders and confirmations, and payment chases, by text for you; to show what was sent, honour opt-outs and bill usage — Contract; for your customers' data, we act as your processor (see the DPA)
Bank feed (if you link a bank account): the linked account's name, masked account number and sort code, balance, and incoming payments (date, amount, payer name and payment reference) — we do not store your outgoing payments. Read through TrueLayer, with the consent you give at your bank, renewed every 90 days — To see which of your invoices have been paid so Get Paid stops chasing them — Contract; for your customers' data in those payments, we act as your processor (see the DPA)
Usage & technical: logs, IP address, device and browser, security events, AI-usage metering, error reports — Run, secure and bill the Service; prevent abuse and fraud; fix faults — Legitimate interests; legal obligation where it applies
Service records & support: sign-ins, features used, AI usage, billing and email-delivery status, support conversations — Help you when you ask, keep the Service running, bill correctly, prevent abuse and improve the Service — Legitimate interests
Domain registration: if you buy a domain through us, your business's registrant details (business name, contact name, address, email and phone number) — Register and renew the domain in your business's name with Cloudflare Registrar and the registry for that domain ending; some registries publish limited registration details as their rules require — Contract
Abuse reports: if you report a website we host, your name and email (if you give them), the web address and your report — Investigate and act on the report, contact you about it and keep a record of what we did — Legitimate interests (keeping the websites we host lawful and safe); legal obligation where it applies
Website analytics: pages visited on our public sites, device and browser type, approximate location (country/city), via Google Analytics cookies — Count visits and see which pages lead to sign-ups — Consent (only if you accept analytics cookies)
Advertising measurement: whether a visit to our public sites came from one of our Facebook or Instagram ads and whether it led to a sign-up, with the page address, device and browser details and IP address, via the Meta Pixel cookie — Measure which of our ads work — Consent (only if you press Accept all in the cookie choice)

You need to give us your account and billing details to use the Service; without them we cannot provide it.

3. Staff access to service records

Only authorised AIME TECH staff can view these service records, through admin tools that require single sign-on and log every sign-in. They use them to support you, keep the Service running and secure, bill correctly and understand how features are used so we can improve them. Staff look at account-level activity (such as sign-ins, features turned on, usage, billing and delivery status), not the content of your documents or emails, unless you ask us to as part of a support request — and then only as far as that request needs.

4. AI processing

To generate Nova's work, relevant content is sent to our AI provider (Anthropic) for that request; Anthropic processes it as our sub-processor and, under its commercial terms, does not use it to train its models. Document search uses embeddings generated on our own servers. We do not sell your data or use your Customer Data to train AI models. Nova drafts; a person on your account approves before drafts are sent. Website chat, booking chats and Phone answer people automatically once you turn them on, and AI-generated content is marked/disclosed. We do not make decisions about you that have legal or similarly significant effects solely by automated means.

5. Where your data is hosted

Your data is hosted in the United Kingdom (data centre in London). Each customer's data lives in an isolated per-tenant database schema, with sensitive fields encrypted using a per-tenant key. Backups are encrypted before they leave our servers and are stored with Google Cloud in London. Traffic is protected in transit (TLS) and routed via Cloudflare.

6. Who we share data with

We use the following providers to deliver the Service:

OVHcloud — Hosting of the Service and of our operations system (UK, London)
Google Cloud — Encrypted backups (UK, London)
Cloudflare — Edge network, DDoS protection and routing; hosting of websites we host for our customers (Webdesigner) and registration of domains you buy through us
Anthropic — AI models (generating Nova's work)
Stripe — Payments, card processing and invoices
Brevo (Sendinblue) — Transactional & agent email delivery
TrueLayer — Open Banking access to the bank account you link (accounts, balances and incoming payments, with your consent), when enabled
Zernio — Social account connections & posting (Instagram, Facebook, LinkedIn, Google Business, WhatsApp), when enabled
Twilio — Voice (phone) telephony and text messages (SMS) sent on your behalf (recipient phone numbers and message text), when enabled
Meta — WhatsApp messaging, when enabled
Composio — Connects your Gmail or Outlook mailbox, and your Google or Outlook calendar, so Nova can read new mail, send the replies you approve, see when you are busy and add meetings you agree (only if you connect them). Handles mailbox and calendar access and their content in transit (USA).
Google (Google Analytics) — Website analytics on our public pages, only with your consent; never inside your workspace
Meta Platforms Ireland Ltd (Meta Pixel) — Measuring our Facebook and Instagram ads on our public pages, only if you press Accept all; never inside your workspace. Meta uses this data as a separate company under its own privacy policy, including for its own advertising.
Brave — Web search for Opportunities (search terms only)

Our own internal systems also hold some data: support requests you escalate through Chat to us are logged in our operations system (the AIME Control Tower, hosted by OVHcloud in the UK), and billing records (business name, billing email, invoice lines) are kept in our customer and finance system (the AIME CRM, hosted by Hetzner in Finland, EU) and our accounting software (Xero). We also keep technical error reports from the web app (the page route, the error message and your browser family) for up to 90 days to help us find and fix bugs, under our legitimate interest in keeping the Service reliable; these stay in our own systems and are never shared with third parties. Services you choose to connect, such as Xero, Google or Microsoft, process data under your own agreement with them. We may also share data with our professional advisers, with a buyer if the business is sold, or where the law requires it.

7. International transfers

Our main hosting is in the UK. Some providers (for example Anthropic, Stripe, Cloudflare, Twilio, Meta, Composio and Google) are based in, or may process data in, the USA or other countries outside the UK. Where they do, we rely on UK adequacy regulations (for example for the EU/EEA), the UK-US data bridge for US companies certified to it, or otherwise the ICO's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU standard contractual clauses. You can ask us for details at privacy@digitaise.co.uk.

8. Retention

We keep your documents, emails and activity records for 3 years (6 years for financial records such as invoices), then delete them automatically. Account details and settings are kept while your account is open. If you close your account, we keep your data for 30 days so you can reactivate, then permanently delete your tenant's data and its uploaded files. You can export your data from "My data" at any time, including before you close your account. Deleted data can remain in our encrypted backups for up to about 6 months, until those backups expire. Billing records are kept for 6 years to meet tax and accounting law, and some limited records (e.g. audit and security logs) may be kept longer where the law requires it. Abuse reports and what we did about them are kept for 3 years. If you disconnect a linked bank account, we delete its incoming payments that were not matched to one of your invoices; matched ones are kept with that invoice's financial records. To keep the free trial to one per business, when a free trial starts we keep a one-way hash (a scrambled code that can't be turned back into the original) of the account email address and of the card fingerprint Stripe gives us (never the card number). We keep these for 3 years from the start of the trial, including after the account is closed and its data deleted, and use them only to check whether a new sign-up has already had a free trial (our legitimate interest in preventing free-trial abuse).

9. Your rights

Under UK GDPR you have the right to access, rectify, erase, restrict, object to (including to processing based on our legitimate interests), and port your personal data, and to withdraw consent at any time (for analytics or ad measurement, through cookie settings) without affecting what happened before. You can review and export much of your data from the in-app My data ledger, or contact privacy@digitaise.co.uk. We reply within one month. If your data was put into DigitAIse by a business you deal with, please contact that business first; we will help them respond. You can also complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

10. Security

We use per-tenant isolation, encryption of sensitive data at rest and in transit, access controls, uploaded-file scanning, and audit logging. No system is perfectly secure, but we design for breach resistance and will notify you of a personal data breach as required by law.

11. Cookies

We use strictly-necessary cookies to keep you signed in and secure and to remember your cookie choice. With your consent only, we use Google Analytics (provided by Google Ireland Limited and Google LLC) as an analytics processor to count visits to our public pages. Only if you press Accept all, we also use the Meta Pixel (provided by Meta Platforms Ireland Ltd) to measure our Facebook and Instagram ads. Neither runs inside your workspace. The full list and how to change your choice are on our Cookies page.

12. Children

The Service is for business use and not directed at anyone under 18.

13. Changes & contact

We may update this policy and will post the new version here with its date; for material changes we will also tell you by email or in the app. Questions or requests: privacy@digitaise.co.uk.

← Back to home Terms DPA