Privacy Policy

This Privacy Policy explains how Adept IT Consultants (UK) Ltd ("Adept", "adeptSuite", "we", "us" or "our") collects, uses and protects personal data when you visit adeptsuite.ai, register your interest, hold an account on the adeptSuite platform, or when your data is processed through adeptSuite by a business that uses our services.

We handle personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Please read this Policy together with our Terms of Service.

1. Who we are

The data controller responsible for the personal data described in this Policy is:

2. Our two roles: controller and processor

adeptSuite is used by businesses and by individuals who hold an account in their own name. Whether we are the "controller" or the "processor" of personal data depends on whose data it is and why it is being processed.

Where we are the controller

We are the controller of personal data relating to the people who hold an account with us, whether as an individual or for a business, and to the people who act for a business that uses adeptSuite — for example account holders, billing and support contacts, and visitors who contact us through adeptsuite.ai. We decide how and why that data is processed for account management, billing, support, security and running our business, and this Policy governs it.

Where we are the processor

When a business uses adeptSuite to manage its own customers' data — for example a merchant's customer contact list used for email or advertising — that business is the controller of its customers' personal data and Adept is the processor, acting only on the business's instructions. In that case the business's own privacy notice governs how that data is used, and we process it under a data processing agreement that forms part of our Terms of Service.

3. Personal data we collect

3.1 Visitors to adeptsuite.ai

If you submit our register-interest form, we collect:

• your name (optional) and company (optional);
• your email address;
• your IP address and country, derived from your connection, which we use to prevent abuse of the form (rate-limiting and bot protection) and keep with your registration.

We use this to contact you about adeptSuite and to let you know when it is available. See also Section 7 (Cookies) for the analytics data we collect only if you opt in.

3.2 Account holders

When you register for an adeptSuite account, whether as an individual or for a business, we collect:

• your email address and display name, provided by your sign-in provider. You can sign in with Google. Sign-in with Microsoft is offered where we have enabled it, and sign-in with Facebook is coming soon; we use a provider only once we have enabled it;
• the sign-in provider you used and your unique identifier with them. We do not ask you to create or store a password — sign-in is handled by your provider;
• records of the versions of our Terms and this Policy you accept, and when;
• onboarding and product-activation information (entry channel, plan selected, which products you have activated and when);
• subscription and billing details (plan, status, billing dates) and a ledger of AI-credit usage.

3.3 Content you manage in the platform

• Listing and product data — titles, descriptions, variants, pricing, images and related content. This is generally business data, but where a sole trader's personal details appear in it, that content may be personal data.
• Marketplace and channel connections — for example your store domain and the access tokens that let us sync on your behalf. Access tokens are encrypted at rest (see Section 13).
• AI job and suggestion records — the original content, the AI-generated suggestion, quality scores, and whether you accepted or dismissed it.

3.4 Customer data processed on a business's behalf

Where a business uses adeptSuite's audience and messaging features, we process the contact data that business provides about its own customers — such as contact identifiers, consent records, and suppression (opt-out) records. We process this only on that business's instructions, as its processor (see Section 2). Contact identifiers used for audience matching and advertising are stored in hashed form. A hash is still personal data, because it can be matched against an email address or phone number that someone already holds. Section 5 explains what we keep after an erasure.

3.5 Operational data

• Audit logs of changes made in the platform. Personal data is masked before it is written to these logs.
• Service health and error data used to keep the platform running. Personal data is scrubbed from error logs before analysis.

4. How and why we use it

We process personal data for the purposes below. For each, we rely on a lawful basis under Article 6(1) of the UK GDPR.

Where we rely on legitimate interests, we have considered your rights and only proceed where they are not overridden. You can object to processing based on legitimate interests at any time (see Section 11).

5. Marketing, consent and suppression

adeptSuite lets a business send marketing to its own customers across email and advertising channels. For that activity the business is the controller: it is responsible for having a lawful basis, and it confirms to us that each contact it markets to has valid consent to the UK GDPR and PECR standard — freely given, specific, informed and unambiguous, and granular to the channel and purpose. We provide the machinery; we do not decide who a business markets to.

How the machinery works:

• Consent is recorded per purpose and per channel. Marketing purposes are kept separate from service and transactional messaging, so a consent given for one does not authorise the other.
• Opting out is honoured through suppression. When a contact unsubscribes or is erased, a suppression record is kept so they are not messaged again on that channel. Every marketing message includes a way to unsubscribe.
• Suppression survives erasure. If a contact is erased, we keep a hashed identifier — usually a one-way fingerprint of their email address — so that we can recognise them and keep them suppressed if the same address is imported again, and so that an erased contact is not silently re-added and re-marketed. Section 3.4 explains why a hash counts as personal data. Where we act as a business's processor, we keep the hash on that business's behalf, as part of its suppression list.
• Some audience records are not erased today. An audience list that a business built before an erasure can still hold a hashed email address, a hashed phone number, and the values the business chose to calculate for that contact when the list was built. We do not currently erase these. We are completing this in November 2026. Section 11 lists everything we keep after an erasure.

Where a business has already shared a contact with an external advertising platform, removing that contact from the external platform depends on that platform's own tools and is not something we can guarantee on the business's behalf.

6. AI-generated content

adeptSuite uses artificial intelligence to suggest product titles, descriptions and related content. AI processing is carried out via the Anthropic (Claude) API, and image generation is carried out via Microsoft Azure AI Services in the UK (UK South).

• We send the product and listing content to be worked on, along with relevant context such as tone preferences. We do not send your account sign-in credentials or billing details to the AI provider.
• AI suggestions are recommendations only. You review, edit, accept or dismiss each one — nothing is published automatically on your behalf.
• Under Anthropic's commercial API terms, data sent via the API is not used to train their models. Short-lived prompt caching may be used to reduce cost and is purged automatically.

7. Cookies and similar technologies

We keep cookies to a minimum on adeptsuite.ai.

• Essential — always on. A single first-party preference cookie (adept_consent) remembers whether you accepted or declined analytics, so we do not ask again on every visit.
• Analytics, only if you accept. If you accept, we load Google Analytics 4, which sets the cookies _ga and _ga_*. Google receives your page views, the pages you visit, your browser and device type, the page that referred you and an approximate location derived from your IP address, and gives us aggregate reports. Google acts for us under its data processing terms and may process this in the United States. We do not use it for advertising. You can withdraw at any time using Cookie settings in the footer; that stops collection and removes the cookies. We have set Google's retention for this data to 14 months and turned Google signals off.
• Page-performance measurement — no cookies. Our edge provider, Cloudflare, runs Cloudflare Web Analytics on the site. It measures page performance and aggregate visits and does not use cookies, so it is not affected by your analytics choice.
• Security. Our edge provider, Cloudflare, and the Turnstile bot-challenge on our form may set or read data needed to protect the site from abuse.

Changing or withdrawing your choice. Choose Cookie settings in the footer of any page to reopen the choice. Turning analytics off stops collection straight away and removes the Google Analytics cookies from your browser; turning it on again is just as easy. You do not need to clear your browser data.

Signed-in areas of the platform also use strictly-necessary cookies to keep you authenticated; these do not require consent.

8. Who we share data with

We do not sell or rent personal data. We share it only with service providers that process data on our behalf, or where a channel you use requires it. Our providers include:

Brevo and Amazon SES are already listed above. They start processing customer data for campaign email from 8 December 2026, which is 30 days after this version takes effect on 8 November 2026. We give notice of this by publishing this version and by asking you to accept it the next time you sign in. If you object on data-protection grounds, write to support@adeptsuite.ai within 14 days of 8 November 2026, that is by 22 November 2026. We will then talk it through with you for a further 14 days, that is until 6 December 2026; if we cannot agree you may end your agreement and we will refund any fees you prepaid for the period after it ends.

The providers shown above as planned (BrickLink, BrickOwl, Rebrickable and WhatsApp) are not in use yet. We list them now so that you have notice of them. They are planned to start no earlier than 8 December 2026, 30 days after this version takes effect on 8 November 2026. The Brick part and set services would receive part and set numbers only.

Marketplace and advertising providers process personal data only when you connect that service and use the relevant feature. We also use third-party catalogue databases to enrich product reference data (such as part names and images); no personal data is shared with those catalogue services.

We may also disclose personal data where we are required to by law, or to protect our rights, our users, or the public, or in connection with a business sale or reorganisation (in which case this Policy continues to apply).

9. International transfers

Our primary hosting is in the United Kingdom (Microsoft Azure UK South). Some of the providers listed above are located in the United States or operate globally. Where personal data is transferred outside the UK, we put appropriate safeguards in place as required by Chapter V of the UK GDPR — in particular the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

10. How long we keep data

We keep personal data only for as long as necessary for the purpose it was collected for, or as required by law. In particular:

• Interest registrations — we keep your email address, optional name and company, and the IP address and country saved with your registration for 6 months after we have emailed you about launch, or until you ask us to remove you, whichever comes first. If you then create an account, Section 3.2 applies.
• Account and platform data — for as long as your account is open. After you close it, we delete the data held in its subscription 30 days after the closure, and we delete your account profile (your name, email address and sign-in link) 12 months after the closure. The records listed below that we keep for six years are the exception.
• Records of what you agreed to. We keep the record of the terms and policies you accepted, and your consent choices, for six years after your account closes, so that we can show what was agreed.
• Billing and tax records — typically six years, to meet UK statutory record-keeping requirements.
• Payment provider reference and contract record — we keep the customer reference our payment provider gave us, and the record of your subscription contract, for six years after the last payment, in line with our tax records.
• Records of erasure requests — when you ask us to erase your data, we keep a record that the request was made and carried out. It holds identifiers and counts and no personal details. We keep it for six years from the request, so that we can show we carried it out and defend any claim.
• Account export snapshots — when a subscription ends we save a snapshot of its plan and history, so that we can answer billing questions and disputes. We keep it for six years after the subscription ends, in line with our billing records, and we delete it earlier if you ask us to erase your data. Erasure of snapshots is being completed in November 2026; until then, a snapshot may survive an erasure request, and we will tell you if yours does.
• Onboarding progress, product activations, and roles and memberships — we hold these while your account is open. Erasure of your onboarding progress, product activations, and roles and memberships is being completed in November 2026; until then they may survive an erasure request, and we will tell you if yours do.
• Data we process on a business's behalf — for the duration of that business's use of the service; on termination we return or delete it within the agreed export window, or within 30 days if none is agreed.
• Audit logs — retained for 30 days in the live system and then archived. The exception is the entry that records that an erasure request was carried out: we keep that entry in our live system and do not archive it, for six years from the request.

Data we have deleted can remain in our backups for up to 30 days.

Suppression (opt-out) records are kept as a lasting record that a person asked not to be contacted, as described in Section 5.

11. Your rights

Under the UK GDPR you have the right to:

• access a copy of your personal data;
• rectification of inaccurate or incomplete data;
• erasure of your data, subject to our legal obligations;
• restriction of processing in certain circumstances;
• data portability — to receive your data in a structured, machine-readable format;
• object to processing based on legitimate interests;
• object to direct marketing at any time. This right is absolute: email support@adeptsuite.ai and we will stop marketing you;
• withdraw your consent at any time where we rely on it, including consent to marketing, by emailing support@adeptsuite.ai. Withdrawing does not affect what we did before you withdrew.

For data where we are the controller, email support@adeptsuite.ai and we will respond within one month of confirming your identity, or within three months for a complex request, and we will tell you if we need the extra time. For data processed on a business's behalf, please contact that business (see Section 2); if you contact us, we will acknowledge and forward your request and assist that business in responding.

When you ask us to erase your data

When you ask us to erase your data and we have confirmed your identity, we delete or anonymise the personal data we hold about you across our systems, in steps. We tell you in writing which steps are finished and which are not. We will not tell you that all your data has been erased unless every step has been completed and recorded.

What we keep, and why

Some records survive an erasure. We tell you about each one:

• Invoices and billing records. We keep invoices, including the invoice number, the amounts and the business details on them, for six years, because UK tax law requires it.
• Your payment provider reference and the record of your contract. We keep the reference our payment provider gave us, and the record of your contract, for six years after the last payment, in line with our tax records, so that we can match refunds, disputes and tax records to a payment.
• A record that the erasure happened. We keep an audit entry that holds identifiers and counts and no personal details, as evidence that we carried out your request. We keep it for six years from the request, so that we can show we carried it out and defend any claim.
• Records of what you agreed to. We keep the record of the terms and policies you accepted, and your consent choices, for six years after your account closes, so that we can show what was agreed.
• Onboarding progress, product activations, and roles and memberships. Erasure of your onboarding progress, product activations, and roles and memberships is being completed in November 2026; until then they may survive an erasure request, and we will tell you if yours do.
• A hashed identifier, for suppression. If you were in a business's audience list, we keep a hashed identifier, usually a one-way fingerprint (a hash) of your email address and not the address itself, so that if the same business imports your details again we recognise you and keep you suppressed. Section 3.4 explains why a hash counts as personal data. Where we act as a business's processor, we keep the hash on that business's behalf, as part of its suppression list.
• Some audience records. An audience list built before your erasure can still hold a hashed email address, a hashed phone number, and the values the business chose to calculate for you when the list was built. We do not currently erase these. We are completing this in November 2026.
• The customer number a sales channel gave you. If a business connected a sales channel to adeptSuite, such as an online shop, we keep the number that channel gave you, for no more than six years, so that we can recognise a request we have already carried out. The channel holds the link between that number and you.
• Account export snapshots. When a subscription ends we save a snapshot of its plan and history, so that we can answer billing questions and disputes. We keep it for six years after the subscription ends, in line with our billing records, and we delete it earlier if you ask us to erase your data. Erasure of snapshots is being completed in November 2026; until then, a snapshot may survive an erasure request, and we will tell you if yours does.

Data held by others. We instruct the service providers that process data for us (see Section 8) to erase what they hold about you. Some of them are required by law to keep certain records, such as payment records kept for fraud prevention and tax, and we tell you which when we confirm your erasure. Businesses that use adeptSuite are separate controllers of their own customers' data. If your data is held by a business that uses our services, ask that business (see Section 2); we help them respond.

12. Automated decision-making

We do not make decisions with legal or similarly significant effects about you by solely automated means. Our AI features produce suggestions that a person reviews and decides whether to use.

13. Data security

We use appropriate technical and organisational measures to protect personal data, including:

• Encryption in transit — traffic between your browser and our services uses HTTPS (TLS).
• Encrypted access tokens — marketplace and channel access tokens are encrypted at rest using AES-256-GCM.
• Tenant isolation and access control — each business's data is isolated, and access is scoped so users reach only their own data.
• Log minimisation — personal data is masked in audit logs and scrubbed from error logs.
• Restricted access — access to production systems is limited to authorised personnel.

14. Children

adeptSuite is not for anyone under 18 and is not directed at children. We do not knowingly collect personal data from anyone under 18. If we learn that we have, we will delete it promptly.

15. Changes to this Policy

We may update this Policy from time to time. We will change the version and effective date above, and for material changes we will give reasonable notice — for example by email or an in-app notice.

16. How to complain

If you have a complaint about how we handle your personal data, email support@adeptsuite.ai. We will acknowledge your complaint within 30 days of receiving it, look into it without undue delay, keep you updated, and tell you the outcome. You can also complain to the Information Commissioner's Office (ICO).

Contact details for the ICO:

• Website: ico.org.uk
• Helpline: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

17. Contact us