Privacy notice
This Privacy Policy covers Instructed Intelligence Ltd as a controller of the personal data of the people who deal with us — account holders, website visitors, prospects and support contacts. It is separate from the DPA, which covers II as a processor of the content customers put into the Services. When a customer's staff use the Services, the customer is the controller of that content — see the DPA.
1. Who we are
Instructed Intelligence Ltd ("II", "we"), company no. 17335392, is the controller of the personal data described here. Questions about this policy or your data: privacy@instructedintelligence.com.
2. The personal data we collect (as controller)
| Category | Examples | Source |
|---|---|---|
| Account data | Name, work email, company, role, industry, password (hashed), tier | You, at sign-up |
| Deployment-preference data | SaaS/on-prem choice, AI tools you use | You, at sign-up |
| Billing data | Billing contact, payment reference (card data handled by our payment provider) | You / payment provider |
| Usage analytics | Sign-in events and feature use, collected via our own self-hosted analytics — you can opt out. We do not collect licence/health phone-home data (licence checks are offline). | Automatically |
| Support & comms | Messages, tickets, and — if you opt in — marketing preferences | You |
| Website data | Page views and a few page events, counted by our own self-hosted analytics with no cookies and no personal data; anything you type into the contact form, which is emailed to us; anything you enter on our booking page, which is run by Google Calendar | Automatically / you |
This does not include your Customer Data — the knowledge and content you put into the Services — which we process as your processor under the DPA, not as controller.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Create and run your account; provide the Services | Contract |
| Bill you; keep records | Contract / legal obligation |
| Secure the Services, prevent abuse, licence enforcement | Legitimate interests (running a secure service) |
| Improve the Services (aggregated/telemetry) | Legitimate interests (we do not use your Customer Data to train models — see the DPA) |
| Support you | Contract / legitimate interests |
| Marketing to business contacts | Legitimate interests / consent where required; opt-out always available |
| Comply with law | Legal obligation |
4. Who we share it with
- Processors acting for us — hosting (OVH, UK), encrypted backups (Google Cloud Storage, II-owned project, UK), key/secret custody (1Password, EU), plus email delivery for enquiries (Resend) and appointment booking (Google Calendar). Analytics is self-hosted — there is no third-party analytics processor. They act on our instructions under contract.
- Professional advisers (legal, accounting) and authorities where legally required.
- On a corporate transaction (sale/merger), subject to confidentiality.
We do not sell personal data.
5. International transfers
Where we transfer this personal data outside the UK/EEA, we use an appropriate safeguard — adequacy, the UK IDTA/Addendum, or the EU SCCs — as set out for our processors. See DPA Annex 4.
6. How long we keep it
We keep account and billing data for the life of the account plus 6 years for legal and tax purposes; usage analytics for 24 months; and marketing data until you opt out. We delete or anonymise personal data when it is no longer needed.
7. Your rights
You have the rights to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent where we rely on it. Contact privacy@instructedintelligence.com. You can complain to the ICO (ico.org.uk) or your local supervisory authority — though we'd like the chance to help first.
8. Cookies and analytics
Our website sets no cookies. Traffic is measured by analytics we host ourselves, which records no personal data, sets nothing on your device and sends nothing to a third party; we do not run session recording or heatmaps. Product usage analytics inside the Services is likewise self-hosted and configured to minimise personal data; you can opt out.
9. Security and changes
We protect personal data with appropriate technical and organisational measures (see DPA Annex 2). We may update this policy and will post the new version with its effective date; material changes will be notified where appropriate.