Privacy Notice

Who is responsible

EXCENT RIT SERVICES LTD, company number 06455789, of 20-22 Wenlock Road, London N1 7GU, United Kingdom, is the data controller for the personal data described here. This notice covers both the website and the product.

For anything about your data, write to [email protected].

What we collect

Account data: your name and email address, the workspace you create, and how you signed in. If you sign in with Google we receive your name, email address and profile picture from Google, and never your password.

Content you provide: the documents, files, text and settings you upload to ground your agents, and the messages exchanged with them.

Usage data: which model calls your agents made, what they cost, and when: the record that produces your balance and your invoices. Plus ordinary server logs, including IP address, for security and diagnosis.

Billing data: your billing name, address, VAT number where you give one, and a record of what you bought. We do not see or store your card number. Payment is taken on the payment provider's own hosted page.

Channel data: if you connect WhatsApp, Telegram or text messaging, the messages sent to your agents through those channels and the sender's identifier on that platform. For WhatsApp, this includes the messages your agents send back and delivery status. Channel messages stay with the conversation for as long as the agent or account keeps it, and are deleted on an erasure request.

If you use the waitlist form on this website, the email address and any note you type into it. There is no analytics script, no advertising pixel and no third-party tracking tag on this website.

Why we use it, and our lawful basis

To provide the service you asked for, running your agents, storing your content, keeping your balance, because we need to in order to perform our contract with you. This includes processing messages through AI models to generate agent responses.

To take payment, issue invoices and keep accounting records, because we must perform the contract and because the law requires us to keep those records.

To keep the platform secure, prevent abuse, and diagnose faults, because we have a legitimate interest in a service that works and is not misused.

To tell you about something important (a security issue, a change to these terms, a problem with a payment), because we must perform the contract or comply with the law. We do not send marketing email unless you ask for it.

If you use WhatsApp to communicate with your agents, we process messages through Meta's WhatsApp platform and transmit the content to AI model providers (see the processors section below) to generate responses. Channel messages are kept for as long as needed to deliver them and while the conversation remains, and are deleted on an erasure request.

Who else processes it

We use third parties to run the service. They act on our instructions and may only use the data to provide their service to us:

Google Cloud: hosting, databases and file storage

Google: AI models, and sign-in if you use a Google account

Anthropic: AI models

OpenAI: AI models for document search and voice sessions

Groq and Perplexity: AI models and web search

Together AI: AI models, where enabled

Sarvam AI: speech recognition and synthesis for Indian languages

Serper: web search for fact-checking, where enabled

Cloudflare: storage for images and other media

Mailgun: sending and receiving email on behalf of your agents

Stripe and Revolut: payments and identity verification

Twilio: text messages, where you enable them

Meta (WhatsApp) and Telegram: messaging, where you connect those channels

Browserbase: browsing pages on your instruction, where you enable it

Your content and messages are sent to AI model providers so your agents can produce answers. Anthropic (Claude), Groq, and Perplexity, under the API terms we purchase, do not use customer content to train or improve their models. Google, OpenAI, and the other providers named in the processor list process your content under their own API terms. If an alternate provider is enabled, that provider's terms apply.

If you connect WhatsApp, messages sent by end-users to your agents flow through Meta's WhatsApp servers, which may retain metadata (sender identifier, timestamp, delivery status) for their own compliance purposes. The message content and metadata are transmitted to us and then to AI model providers to generate responses. Meta's privacy practices are governed by their own privacy policies. We recommend reviewing Meta's Business Tools Terms of Service and Privacy Policy to understand their data handling.

We do not sell personal data, and we do not share it for advertising.

Where your data is held

The platform runs on Google Cloud in the United States (region us-central1), so your account data and content are stored there. Some of the providers listed above also process data in the United States or elsewhere.

This means personal data leaves the United Kingdom. Where it does, we rely on the transfer safeguards the law provides: the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, or an adequacy regulation where one applies to the country concerned.

If where your data is held matters to you, because of a regulator, a client, or your own policy, tell us before you build anything on the platform, so we can be straight with you about what is possible.

How long we keep it

Content and account data for as long as your account is open. You can ask us to close your account and delete your data at any time by writing to us; deletion is handled on request rather than through a self-serve control, and we tell you when it is done. Billing records we must keep by law survive.

Messages sent through WhatsApp and other messaging channels stay with the conversation while the agent or account is active, and are deleted on an erasure request. Text-message delivery counters are kept for 30 days, and audit telemetry on the shared control plane for up to 90 days, then deleted automatically. Dedicated-database deployments run their own retention schedule.

Billing and tax records for six years after the end of the financial year they relate to, because UK tax law requires it. Usage records are kept for as long as they are needed to support an invoice.

Server logs for up to 30 days; security-mandated logs can persist for up to 400 days under our cloud provider's standard retention.

Responses produced by AI

Agents on this platform use artificial intelligence to generate responses. When you interact with an agent through WhatsApp, Telegram, text messaging, or web chat, your messages are processed by AI models operated by third parties listed above (Anthropic, Google, OpenAI, Groq, Perplexity, and others).

AI models are not perfect and may produce inaccurate, outdated, or misleading responses. You should not rely on agent responses as legal, medical, financial or other professional advice without verification. If you publish an agent that provides advice or information to the public, you are responsible for reviewing its responses and setting boundaries on what it can say.

End-users interacting with your agents through public channels (WhatsApp, Telegram, web) should understand they are communicating with an AI system, not a human. Where required by law or platform policy, agents will disclose their AI nature on first contact.

Your rights

You can ask for a copy of your personal data, ask us to correct it, ask us to delete it, ask us to restrict how we use it, object to processing we do on the basis of legitimate interests, and ask for your data in a portable form.

To exercise any of these, write to [email protected]. We respond within one month. We will not charge you, and we will not treat you differently for asking.

If you think we have handled your data badly, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk.

Cookies and what your browser stores

This website sets a small number of its own cookies, listed below. All of them are functional — none are used for advertising or tracking. Your theme preference is kept in your browser's own storage and is never sent to us.

There is no analytics script, no advertising pixel and no third-party tracking tag on this website — the cookie notice records a choice for analytics in case that ever changes, but nothing runs in that category today. You can revisit your choice from the "Cookie settings" link in the footer at any time.

Security

Customer data is logically isolated per account, and on some deployments each customer also has its own database. Visitor-facing telemetry lives in a shared control-plane store. Access to production systems is limited to the people who need it. Data is encrypted in transit and at rest.

No system is perfectly secure. If a breach affects your personal data and is likely to present a risk to you, we will tell you and the Information Commissioner's Office within the time the law requires.

Changes to this notice

If we change how we use personal data we will update this notice and change the date at the top. Where a change matters to you, we will tell you rather than rely on you noticing.