Privacy Policy

01Who we are

Aiconomy Ltd ("Aiconomy", "we", "us") is registered in England & Wales and is the data controller for the personal data described in this policy, unless stated otherwise. We provide AI "employee" agents (Ava, Leo, Maya, Zara, Sam and Dex) that automate marketing, customer service, finance, HR, payroll and IT-desk tasks for small and growing businesses across the UK, the European Union, and the Middle East.

Questions about this policy or your data can be sent to hello@aiconomy.uk.

02Data we collect

We collect data in three broad categories:

Data you give us directly

• Contact details — name, work email, phone number, company name — when you book an audit, start a trial, or contact us.
• Account and billing information when you subscribe to an agent.
• Content you or your team submit to an AI agent for processing (for example, customer emails routed to Leo, or invoices routed to Maya).

Data collected automatically

• Usage data — pages visited, features used, session length — collected through basic analytics.
• Technical data — IP address, browser type, device type — collected for security and performance.

Data from third parties

• When you connect an integration (for example, a mailbox, accounting package, or calendar) to an agent, we process the data that integration shares with us, strictly to perform the task you've configured.

03How we use it

• To provide, run and support the AI agent(s) you've subscribed to.
• To respond to enquiries, book audits, and manage your trial or subscription.
• To send you service communications (billing, security notices, material changes to this policy).
• With your consent, to send you product updates or marketing — you can opt out at any time.
• To monitor, secure and improve the platform, including detecting misuse.
• To meet legal and regulatory obligations, including tax, accounting and law-enforcement requests.

We do not sell personal data, and we do not use customer content submitted to an agent (emails, invoices, tickets, and similar) to train shared or third-party AI models.

04Our legal basis for processing

Where UK GDPR or EU GDPR applies, we rely on one or more of the following bases for each processing activity:

• Contract — processing needed to provide the agent(s) you've subscribed to.
• Legitimate interests — for security, fraud prevention, and improving the service, balanced against your rights.
• Consent — for marketing communications and non-essential cookies, which you can withdraw at any time.
• Legal obligation — where we must retain or disclose data to comply with the law.

Where the UAE PDPL or Saudi PDPL applies (see Compliance), the equivalent bases are explicit consent, contractual necessity, or legitimate interest narrowly construed — we do not rely on legitimate interest for discretionary profiling of UAE or Saudi residents.

05How your data reaches our AI agents

Each Aiconomy agent is built on large language model infrastructure provided by a third-party AI model provider, called through a secured API. Content you route to an agent (an email, a ticket, an invoice) is sent to that provider solely to generate the agent's response, and is not used by us or, per our agreement with that provider, by the provider to train their general-purpose models.

Consequential actions — sending an email, posting publicly, releasing a payment — are held for your approval by default rather than taken automatically, unless you've explicitly configured an agent to act autonomously within limits you've set.

06Who we share data with

We share data only where necessary, with:

• Infrastructure and hosting providers who store and process data on our behalf, under contract.
• The AI model provider powering agent responses, as above.
• Payment processing providers, to handle trial and subscription billing.
• Integrations you explicitly connect (your mailbox, accounting software, calendar, and similar).
• Professional advisers (accountants, auditors, lawyers) where necessary.
• Regulators or law enforcement, where we are legally required to.

07International transfers

Aiconomy is based in the UK. Where we transfer personal data outside the UK or EEA — including to service providers, or to fulfil a contract for a customer based in the Middle East — we rely on adequacy decisions where available, or appropriate safeguards such as Standard Contractual Clauses or the UK International Data Transfer Addendum. Where UAE or Saudi PDPL governs a transfer of local residents' data out of that jurisdiction, we apply the safeguards those laws require, including approved recipient-country status or contractual clauses.

08How long we keep data

We keep personal data only as long as needed for the purposes it was collected for: for the life of your subscription plus a limited period afterward to meet accounting, tax and legal obligations (typically up to 6 years for UK financial records), or until you ask us to delete it, whichever gives you the stronger protection. Content processed by an agent on your behalf is retained only as long as needed to deliver the service, per your account's configured retention settings.

09Your rights

Depending on where you're based, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Request deletion ("right to be forgotten").
• Object to or restrict certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.
• Lodge a complaint with your local data protection authority.

To exercise any of these, email hello@aiconomy.uk. We respond within 30 days, in line with UK/EU GDPR and UAE PDPL timelines.

10Cookies

We use strictly necessary cookies to run the site and, only with your consent, analytics cookies to understand how the site is used. You can withdraw cookie consent at any time through your browser settings or the site's cookie controls.

11Security

We apply technical and organisational measures appropriate to the sensitivity of the data we hold, including encryption in transit, access controls, and default human approval on consequential agent actions. No system is perfectly secure; if a breach is likely to put your rights at risk, we will notify affected customers and, where legally required, the relevant regulator (including within the 72-hour windows required by GDPR, the UAE PDPL and the Saudi PDPL) without undue delay.

12Children's data

Aiconomy is a business-to-business service and is not directed at, or knowingly used by, children. We do not knowingly collect personal data from anyone under 18.

13Changes to this policy

We'll update this page when our practices change and update the "last updated" date above. Material changes will be communicated to active subscribers by email.

14Contact & complaints

Aiconomy Ltd, registered in England & Wales.
Email: hello@aiconomy.uk

UK-based individuals can complain to the Information Commissioner's Office (ICO) at ico.org.uk. EU-based individuals can complain to their local supervisory authority. UAE and Saudi-based individuals can contact the UAE Data Office or the Saudi Data & AI Authority (SDAIA) respectively.