Privacy Notice

1.Who we are

Platform 5 Ltd operates the IntegrityAI platform. In most cases, the customer is the data controller of personal data contained in uploaded client documents, and Platform 5 Ltd acts as processor on the customer’s behalf. In relation to the customer’s own business contact details, account data and billing information, Platform 5 Ltd acts as controller.

2.Personal data we process

• Business contact details
• User account data
• Usage logs
• Uploaded client documents
• Compliance outputs and audit trails
• Technical data, such as IP address
• A record of email addresses that have been used to start a free trial

3.Lawful basis for processing

Where Platform 5 Ltd acts as controller (business contact details, account data, billing information, usage logs, technical data), we process this data:

• to perform our contract with the customer (providing access to the platform, billing, support);
• where necessary for our legitimate interests in operating, securing and improving the platform, provided these interests are not overridden by the individual’s rights; and
• to comply with our legal obligations, including tax and accounting requirements.

We also keep a register of email addresses that have been used to start a free trial, held in a one-way hashed form rather than as readable addresses. The purpose is to enforce our limit of one free trial per email address, and the lawful basis is our legitimate interests in preventing repeated free use of a paid service. An entry records only that an address has been used for a trial; it holds no name, firm, review or document content.

Where Platform 5 Ltd acts as processor (personal data contained in uploaded client documents), the lawful basis for that processing is determined by the customer as controller, and is set out in the data processing agreement between Platform 5 Ltd and the customer.

4.AI processing

Frank uses AI to analyse uploaded documents and generate outputs. Uploaded document content is processed by Anthropic’s Claude models hosted on Amazon Bedrock, within the AWS Europe (London) region (eu-west-2). It is not used to train, fine-tune or improve any AI model, and is not retained beyond the time needed to process the request. Frank’s outputs are designed to inform human review and do not constitute fully automated decisions: every review requires sign-off by a named person at the customer firm before it is treated as complete.

5.Hosting, sub-processors and data residency

The platform is hosted exclusively within the United Kingdom, in the AWS Europe (London) region (eu-west-2). All client data, including uploaded documents, generated reports, and review logs, is stored and processed within this region.

We use the following sub-processors to provide the service:

We keep this list under review and will notify customers of any new sub-processor that will process their client data before it goes live, in line with the data processing agreement.

Where a sub-processor is located outside the UK or processes data outside the UK, we ensure an appropriate transfer mechanism is in place (such as the UK’s International Data Transfer Addendum to the EU Standard Contractual Clauses) before any transfer occurs.

6.Retention

• Uploaded documents: encrypted at rest and in transit, and automatically deleted from the platform once the review is complete and the report has been generated. They are not retained.
• Completed review reports and audit logs: retained for operational, regulatory, and legal purposes and remain accessible to your firm through the platform for the duration of your agreement, and for a reasonable period afterward to meet regulatory record-keeping obligations.
• Account and billing data: retained for the duration of the customer relationship and for up to 7 years afterward to meet accounting and tax obligations.
• Usage logs and technical data: retained for up to 12 months for security and operational purposes, unless a longer period is required to investigate a specific incident.
• Free trial accounts that are not taken forward: where a free trial ends and no subscription is taken out, the account is deactivated 90 days later. Deactivation deletes nothing. The completed reviews and audit logs on the account are retained on the same basis as any other customer’s, so they can be restored if the firm returns, and are deleted on request.
• Register of email addresses used for a free trial: retained indefinitely, in hashed form. A retention period would defeat its purpose, which is to establish that an address has already had a free trial. It is kept after an account is deactivated or deleted.

7.Sharing personal data

We share personal data with the sub-processors listed in section 5 to the extent necessary to provide the service. We do not sell personal data, and we do not share uploaded client document content with any third party other than the sub-processors listed above.

8.Individual rights

Individuals may have rights including access, correction, deletion and objection under UK GDPR. Requests relating to personal data in client files should generally be directed to the customer as controller, since Platform 5 Ltd processes that data only on the customer’s instructions. Requests relating to your own account or business contact data held by us as controller should be sent to the contact below.

9.Data processing agreement

Customers acting as data controller are provided with a data processing agreement (DPA) governing Platform 5 Ltd’s processing of personal data in uploaded client documents, in line with UK GDPR Article 28. A copy is available on request or on execution of a subscription agreement.

10.Contact and complaints

Our privacy contact is Simon Owen, Director. For any privacy query, including individual rights requests relating to data we hold as controller, contact:

Simon Owen, Director
Email: info@integrityai.uk

Complaints can also be made to the Information Commissioner’s Office (ico.org.uk).