Back to Home
Legal Document

Privacy Policy

Last updated: 28 March 2026

This policy applies to all visitors and users of the SME AI Consultancy website and digital discoverability audit platform at smeaiconsultancy.com.

1. Who We Are

SME AI Consultancy Ltd ("we", "us", "our") is a company registered in England & Wales. We operate the website and digital discoverability audit platform available at smeaiconsultancy.com (the "Service").

We are the data controller for personal data collected through this Service. If you have any questions about how we handle your personal data, you can contact our data controller at: [email protected].

2. What This Policy Covers

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and what your rights are under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It applies to all visitors to our website and users of our Service.

3. Data We Collect and Why

We collect personal data in the following circumstances:

3.1 Website Audit Submissions

When you submit a URL for a free discoverability audit, we collect the website URL you provide and, if you choose to enter it, your email address. We use this information to run the audit, generate your report, and (where you have consented) send you a copy of the report by email. Our lawful basis is legitimate interests (to provide the service you have requested) and, for email communications, consent.

3.2 Contact Form Submissions

When you complete our contact form, we collect your name, email address, company name, phone number (optional), and the message you send. We use this to respond to your enquiry. Our lawful basis is legitimate interests.

3.3 Portal Account Registration and Login

If you create a client portal account, we collect your name, email address, and a hashed password (we never store your password in plain text). We use this to authenticate you, provide access to your audit history and dashboard, and manage your subscription. If you use our "Forgot Password" feature, we generate a time-limited secure reset token associated with your email address. Lawful basis: performance of a contract.

3.4 Payment Information

Payments are processed by Stripe, Inc., a third-party payment processor. We do not store your full card number, CVV, or card expiry date on our servers. We receive and store a Stripe customer ID and subscription reference for the purpose of managing your subscription and billing history. Lawful basis: performance of a contract and legal obligation (financial record-keeping).

3.5 Outreach Tool — Email and WhatsApp

Our audit results page includes an optional outreach tool that scans publicly available information on a prospect's website (such as mailto: links, tel: links, and structured data) to identify publicly listed contact details. This tool is used by our team to send personalised audit reports. We do not store scraped contact details beyond the duration of the audit session. Any outreach sent via email uses our Resend integration; any WhatsApp outreach is initiated via a wa.me deep link opened on your device and is not processed by our servers. Lawful basis: legitimate interests.

3.6 Usage and Technical Data

We automatically collect certain technical data when you visit our website, including your IP address, browser type and version, operating system, referring URL, pages visited, and time spent on pages. This data is used for website analytics, security monitoring, and improving our Service. Lawful basis: legitimate interests.

3.7 Blog and Content Interactions

When you visit our blog, we may collect anonymised analytics data (page views, scroll depth, time on page) to understand which content is most useful. We do not collect personally identifiable information through blog interactions unless you submit a contact form or subscribe to updates. Lawful basis: legitimate interests.

4. Cookies and Tracking Technologies

We use cookies and similar technologies on our website. A cookie is a small text file placed on your device. You can control cookies through your browser settings and our cookie consent banner. The cookies we use are described below.

Cookie Name / TypePurposeDurationBasis
Session cookie (auth)Maintains your login session in the client portalSession / 7 daysNecessary
Cookie consentRemembers your cookie preferences12 monthsNecessary
Analytics (anonymised)Measures page views and engagement (no personal identifiers)Up to 2 yearsConsent
Stripe (_stripe_*)Fraud prevention and payment processingSession / variesNecessary

You may withdraw consent for non-essential cookies at any time by clearing your browser cookies or adjusting your preferences via our cookie banner. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal.

5. How We Share Your Data

We do not sell your personal data. We share data only with the following categories of recipients, and only to the extent necessary:

RecipientPurposeLocation
Stripe, Inc.Payment processing and subscription managementUSA (SCCs in place)
Resend, Inc.Transactional email delivery (audit reports, portal emails, welcome emails)USA (SCCs in place)
Manus AI PlatformHosting, authentication infrastructure, and LLM processing for audit generationCloud (EU/USA)
Our teamClient account management, support, and service deliveryUK

Where we transfer data outside the UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner's Office (ICO).

6. How Long We Keep Your Data

Data CategoryRetention PeriodReason
Audit results (free)24 months from submissionAllow users to access historical results
Portal account dataDuration of account + 12 months after deletion requestContract performance
Payment records7 years from transactionLegal obligation (HMRC)
Contact form submissions24 months from submissionLegitimate interests (enquiry follow-up)
Server logs / IP addresses90 daysSecurity monitoring
Password reset tokens24 hours from generationSecurity (tokens expire automatically)

After the applicable retention period, data is securely deleted or anonymised. You may request earlier deletion — see Section 7 for your rights.

7. Legal Bases Summary

Processing ActivityLawful Basis
Running free auditsLegitimate interests
Sending audit report emailsConsent
Portal account managementPerformance of a contract
Payment processingPerformance of a contract + legal obligation
Responding to contact form enquiriesLegitimate interests
Website analyticsLegitimate interests (anonymised)
Outreach tool (email/WhatsApp)Legitimate interests
Financial record-keepingLegal obligation

8. Your Rights Under UK GDPR

As a data subject, you have the following rights. To exercise any of them, please email [email protected]. We will respond within one calendar month.

RightWhat It Means
Right of accessRequest a copy of the personal data we hold about you (Subject Access Request).
Right to rectificationAsk us to correct inaccurate or incomplete personal data.
Right to erasureRequest deletion of your personal data where there is no overriding legal basis to retain it.
Right to restrict processingAsk us to limit how we use your data in certain circumstances.
Right to data portabilityReceive your data in a structured, machine-readable format (where processing is automated and based on consent or contract).
Right to objectObject to processing based on legitimate interests. We will cease processing unless we can demonstrate compelling legitimate grounds.
Right to withdraw consentWithdraw consent at any time where processing is based on consent (e.g. marketing emails). Withdrawal does not affect prior processing.
Rights related to automated decisionsNot to be subject to solely automated decisions that produce significant legal or similarly significant effects.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113. We would, however, appreciate the opportunity to address your concerns before you contact the ICO.

9. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, alteration, or disclosure. These include:

  • Encrypted connections (HTTPS/TLS 1.2+) for all data in transit
  • Bcrypt hashing for all stored passwords (never stored in plain text)
  • Time-limited, single-use password reset tokens (expire after 24 hours)
  • Access controls limiting data access to authorised personnel only
  • Regular security reviews and dependency updates

However, no method of transmission over the internet is completely secure. In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and affected individuals without undue delay, as required by UK GDPR Article 33.

10. Children's Privacy

Our Service is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at [email protected] and we will delete it promptly.

10. Links to Third-Party Websites

Our website may contain links to third-party websites (including competitor websites analysed in audit reports). We are not responsible for the privacy practices of those websites. We encourage you to read their privacy policies before providing any personal data to them.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify registered users by email. We encourage you to review this policy periodically. Your continued use of the Service after any changes constitutes your acknowledgement of the updated policy.

12. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

SME AI Consultancy Ltd

Registered in England & Wales

Email: [email protected]

ICO Registration: Pending / applied for

Read our Terms of Service →← Back to Home

We use cookies to improve your experience and analyse website traffic. By continuing to use this site, you agree to our use of cookies. Learn more