Icon
Back to home

Privacy Policy

Updated date: 3 August 2026

This notice explains how IOTA AI LABS LTD, a private company limited by shares registered in England and Wales under company number 17319470, whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom (“iotalabs”, “we”, “us”) collects and uses personal data. We are the data controller for the personal data described below.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data we collect

a. Information you give us

  • Name and job title
  • Email address and telephone number
  • Company name
  • The content of your enquiry, including any attachments
  • Anything else you choose to tell us in correspondence

Our contact form asks for your name, email address, company, the challenge you are facing and your message. Our newsletter form asks only for your email address. Submissions are delivered to us as an email and are not written to any separate marketing database.

b. Information collected automatically

  • IP address, browser type and device information
  • Pages viewed, referring page and time spent on the site
  • Analytics identifiers set by cookies, where you have consented

We do not collect special category data, and we do not ask for it. Please do not send us health data, biometric data or details of criminal convictions through our forms.

c. Our AI assistant

This website offers an AI assistant. It is software, not a person, and it says so. What you type into it is sent to our server and then on to our AI provider so a reply can be generated. Please treat it like any other public web form: do not enter passwords, payment details, identity documents, health information or anything confidential. The assistant is instructed never to ask you for those.

  • The messages you type, and the assistant's replies.
  • A random session identifier generated in your browser so a single conversation holds together. It is not linked to your name or email, and it is not a cookie.
  • Only if you choose to submit the enquiry form inside the assistant: your name, email address, project summary, and the optional company, tools and timeline fields.

Conversations stay in your browser tab for the duration of your visit and are cleared when you close it or select “New chat”. We keep no server-side copy of your conversation and we do not use it to train any AI model. The only part that reaches us is what you deliberately submit through the enquiry form, together with the recent chat messages shown to you at the point you consent to send them.

The assistant makes no decision about you. It cannot approve, price, reject or commit to anything, so there is no automated decision-making producing legal or similarly significant effects under Article 22 of the UK GDPR.

2. Why we use it, and our lawful basis

Under the UK GDPR we must have a lawful basis for each use of your personal data.

  • Responding to your enquiry. Legitimate interests, or performance of a contract where you are already a client.
  • Delivering a project we have been engaged for. Performance of a contract.
  • Sending our newsletter. Consent. Every email carries an unsubscribe link.
  • Running the AI assistant and answering what you ask it. Legitimate interests, namely helping visitors work out whether we can help them. You are never required to use it, and you can use the contact form or email us instead.
  • Website analytics. Consent, given through our cookie banner. See our Cookie Policy.
  • Keeping accounting and tax records. Legal obligation.
  • Security and preventing misuse of the site. Legitimate interests.

3. How long we keep it

  • Enquiries that do not become projects: 12 months from last contact.
  • Client records and project files: 7 years after the engagement ends, to meet our tax and accounting obligations.
  • Newsletter subscribers: until you unsubscribe, then we keep a suppression record so we do not email you again by mistake.
  • AI assistant conversations: held in your browser tab only, and cleared when you close it or start a new chat. We keep no server-side copy. Where you submit an enquiry from the assistant, the resulting email is kept on the same basis as any other enquiry above. Our AI provider processes messages only to generate a reply, and we do not permit it to retain them for model training.
  • Analytics data: 14 months.

4. Who we share it with

We do not sell personal data and we do not share it for advertising. We use a small number of service providers who process data on our instructions:

  • Vercel Inc. — hosting for this website and its form endpoints.
  • Resend (Plus Five Five, Inc.) — email delivery. When you submit our contact form or subscribe to our newsletter, the details you entered are passed to Resend so the resulting notification can be delivered to us. Resend processes that data only to send the message on our instructions.
  • Groq, Inc. — the AI model behind our website assistant. Messages you type into the assistant are sent to Groq so a reply can be generated, together with approved extracts of our own website content. Groq processes those messages on our instructions to return a response. We do not permit our providers to use your messages to train their models; Groq’s own terms govern how it handles data on its side.
  • Google Analytics — website measurement, where you have consented.
  • Our accountants, and our professional advisers where we need advice.

We may also disclose data where we are required to by law.

5. Transfers outside the UK

Some of our providers process data outside the UK, including in the United States. Vercel, Resend and Groq are all United States companies, so form submissions, the emails they generate, and anything you type into our AI assistant, are processed there. Where that happens we rely on UK adequacy regulations or on the International Data Transfer Addendum to the EU Standard Contractual Clauses, so your data keeps an equivalent level of protection.

6. Your rights

You have the right to:

  • Be told what personal data we hold about you, and get a copy of it
  • Have inaccurate data corrected
  • Have your data erased, where we have no continuing reason to keep it
  • Restrict or object to how we use it, including objecting to legitimate interests
  • Receive your data in a portable format
  • Withdraw consent at any time, where consent is the basis we rely on

To exercise any of these, email hello@iotalabs.ai. We will respond within one month. There is no charge.

7. Complaints

If you are unhappy with how we have handled your data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113.

8. Security

We use encryption in transit, access controls and multi-factor authentication on the systems that hold personal data. No system is perfectly secure, but we take this seriously and we will tell you and the ICO about a breach where the law requires it.

9. Children

Our services are sold to businesses and are not directed at children. We do not knowingly collect data from anyone under 16.

10. Changes to this notice

If we change how we use personal data we will update this page and revise the date at the top. Where the change is significant we will tell subscribers and active clients directly.

11. Contact

Email: hello@iotalabs.ai
Telephone: +44 333 054 0670
Post: IOTA AI LABS LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom