Privacy Policy

This Privacy Policy explains how Adept IT Consultants (UK) Ltd ("Adept", "adeptSuite", "we", "us" or "our") collects, uses and protects personal data when you visit adeptsuite.ai, register your interest, hold an account on the adeptSuite platform, or when your data is processed through adeptSuite by a business that uses our services.

We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read this Policy together with our Terms of Service.

1. Who we are

The data controller responsible for the personal data described in this Policy is:

2. Our two roles: controller and processor

adeptSuite is a business-to-business platform. Whether we are the "controller" or the "processor" of personal data depends on whose data it is and why it is being processed.

Where we are the controller

We are the controller of personal data relating to the businesses that use adeptSuite and the people who act for them — for example account holders, billing and support contacts, and visitors who contact us through adeptsuite.ai. We decide how and why that data is processed for account management, billing, support, security and running our business, and this Policy governs it.

Where we are the processor

When a business uses adeptSuite to manage its own customers' data — for example a merchant's customer contact list used for email or advertising — that business is the controller of its customers' personal data and Adept is the processor, acting only on the business's instructions. In that case the business's own privacy notice governs how that data is used, and we process it under a data processing agreement that forms part of our Terms of Service.

3. Personal data we collect

3.1 Visitors to adeptsuite.ai

If you submit our register-interest form, we collect:

• your name (optional) and company (optional);
• your email address;
• your IP address and country, derived from your connection, which we use only to prevent abuse of the form (rate-limiting and bot protection).

We use this to contact you about adeptSuite and to let you know when it is available. See also Section 7 (Cookies) for the analytics data we collect only if you opt in.

3.2 Account holders

When you register for an adeptSuite account, we collect:

• your email address and display name, provided by your sign-in provider (Google, Microsoft or Facebook);
• the sign-in provider you used and your unique identifier with them. We do not ask you to create or store a password — sign-in is handled by your provider;
• records of the versions of our Terms and this Policy you accept, and when;
• onboarding and product-activation information (entry channel, plan selected, which products you have activated and when);
• subscription and billing details (plan, status, billing dates) and a ledger of AI-credit usage.

3.3 Content you manage in the platform

• Listing and product data — titles, descriptions, variants, pricing, images and related content. This is generally business data, but where a sole trader's personal details appear in it, that content may be personal data.
• Marketplace and channel connections — for example your store domain and the access tokens that let us sync on your behalf. Access tokens are encrypted at rest (see Section 13).
• AI job and suggestion records — the original content, the AI-generated suggestion, quality scores, and whether you accepted or dismissed it.

3.4 Customer data processed on a business's behalf

Where a business uses adeptSuite's audience and messaging features, we process the contact data that business provides about its own customers — such as contact identifiers, consent records, and suppression (opt-out) records. We process this only on that business's instructions, as its processor (see Section 2). Contact identifiers used for audience matching and advertising are stored in hashed form.

3.5 Operational data

• Audit logs of changes made in the platform. Personal data is masked before it is written to these logs.
• Service health and error data used to keep the platform running. Personal data is scrubbed from error logs before analysis.

4. How and why we use it

We process personal data for the purposes below. For each, we rely on a lawful basis under Article 6(1) of the UK GDPR.

Where we rely on legitimate interests, we have considered your rights and only proceed where they are not overridden. You can object to processing based on legitimate interests at any time (see Section 11).

5. Marketing, consent and suppression

adeptSuite lets a business send marketing to its own customers across email and advertising channels. For that activity the business is the controller: it is responsible for having a lawful basis, and it confirms to us that each contact it markets to has valid consent to the UK GDPR and PECR standard — freely given, specific, informed and unambiguous, and granular to the channel and purpose. We provide the machinery; we do not decide who a business markets to.

How the machinery works:

• Consent is recorded per purpose and per channel. Marketing purposes are kept separate from service and transactional messaging, so a consent given for one does not authorise the other.
• Opting out is honoured through suppression. When a contact unsubscribes or is erased, a suppression record is kept so they are not messaged again on that channel. Every marketing message includes a way to unsubscribe.
• Suppression survives erasure. If a contact is erased, we retain only a hashed identifier — enough to recognise them and keep them suppressed on re-import, and no message content or address beyond that hash — so that an erased contact is not silently re-added and re-marketed.

Where a business has already shared a contact with an external advertising platform, removing that contact from the external platform depends on that platform's own tools and is not something we can guarantee on the business's behalf.

6. AI-generated content

adeptSuite uses artificial intelligence to suggest product titles, descriptions and related content. AI processing is carried out via the Anthropic (Claude) API.

• We send the product and listing content to be worked on, along with relevant context such as tone preferences. We do not send your account sign-in credentials or billing details to the AI provider.
• AI suggestions are recommendations only. You review, edit, accept or dismiss each one — nothing is published automatically on your behalf.
• Under Anthropic's commercial API terms, data sent via the API is not used to train their models. Short-lived prompt caching may be used to reduce cost and is purged automatically.

7. Cookies and similar technologies

We keep cookies to a minimum on adeptsuite.ai.

• Essential — always on. A single first-party preference cookie (adept_consent) remembers whether you accepted or declined analytics, so we do not ask again on every visit.
• Analytics — only if you accept. If you opt in, we load Google Analytics 4 (_ga, _ga_*) to measure aggregate, de-identified usage. It is not loaded at all unless you accept, and you can decline. We do not use advertising or cross-site tracking cookies on the site.
• Security. Our edge provider, Cloudflare, and the Turnstile bot-challenge on our form may set or read data needed to protect the site from abuse.

Signed-in areas of the platform also use strictly-necessary cookies to keep you authenticated; these do not require consent.

8. Who we share data with

We do not sell or rent personal data. We share it only with service providers that process data on our behalf, or where a channel you use requires it. Our providers include:

Marketplace and advertising providers process personal data only when you connect that service and use the relevant feature. We also use third-party catalogue databases to enrich product reference data (such as part names and images); no personal data is shared with those catalogue services.

We may also disclose personal data where we are required to by law, or to protect our rights, our users, or the public, or in connection with a business sale or reorganisation (in which case this Policy continues to apply).

9. International transfers

Our primary hosting is in the United Kingdom (Microsoft Azure UK South). Some of the providers listed above are located in the United States or operate globally. Where personal data is transferred outside the UK, we put appropriate safeguards in place as required by Chapter V of the UK GDPR — in particular the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

10. How long we keep data

We keep personal data only for as long as necessary for the purpose it was collected for, or as required by law. In particular:

• Interest registrations — until adeptSuite launches and we have contacted you, or until you ask us to remove you, whichever comes first.
• Account and platform data — for as long as your account is active and for a reasonable period afterwards to handle post-termination queries.
• Records proving consent — for the life of the account and up to six years after it closes, so we can demonstrate consent if required.
• Billing and tax records — typically six years, to meet UK statutory record-keeping requirements.
• Data we process on a business's behalf — for the duration of that business's use of the service; on termination we return or delete it within the agreed export window, or within 30 days if none is agreed.
• Audit logs — retained for 30 days in the live system and then archived.

Suppression (opt-out) records are kept as a lasting record that a person asked not to be contacted, as described in Section 5.

11. Your rights

Under the UK GDPR you have the right to:

• access a copy of your personal data;
• rectification of inaccurate or incomplete data;
• erasure of your data, subject to our legal obligations;
• restriction of processing in certain circumstances;
• data portability — to receive your data in a structured, machine-readable format;
• object to processing based on legitimate interests.

For data where we are the controller, email hello@adeptsuite.ai and we will respond within one calendar month. For data processed on a business's behalf, please contact that business (see Section 2); if you contact us, we will acknowledge and forward your request and assist that business in responding.

12. Automated decision-making

We do not make decisions with legal or similarly significant effects about you by solely automated means. Our AI features produce suggestions that a person reviews and decides whether to use.

13. Data security

We use appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit — traffic between your browser and our services uses HTTPS (TLS).
• Encrypted access tokens — marketplace and channel access tokens are encrypted at rest using AES-256-GCM.
• Tenant isolation and access control — each business's data is isolated, and access is scoped so users reach only their own data.
• Log minimisation — personal data is masked in audit logs and scrubbed from error logs.
• Restricted access — access to production systems is limited to authorised personnel.

14. Children

adeptSuite is a business-to-business service and is not directed at children. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it promptly.

15. Changes to this Policy

We may update this Policy from time to time. We will change the version and effective date above, and for material changes we will give reasonable notice — for example by email or an in-app notice.

16. How to complain

If you are unhappy with how we have handled your personal data, please contact us first at hello@adeptsuite.ai. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

17. Contact us