1. Who we are
BeUsefulAI Ltd ("BUAI", "we", "us"), company number 17297090, registered office Oxford Centre for Innovation, Blue Boar Court, 9 Alfred Street, Oxford, OX1 4EH, is the data controller for the personal data described in this notice, except where stated otherwise.
We have not appointed a Data Protection Officer — not required at our current size. Tim House, CEO, is the day-to-day contact for all data protection matters.
Contact: info@beusefulai.com
2. Who this notice covers
This notice applies to you if you are:
- a visitor to our website, or someone who contacts us directly;
- a named business contact we research on behalf of a client — including if we identified you from a public source and you have not contacted us directly (see section 4);
- an individual whose personal data a client shares with us while we deliver a Discover, Build or Run engagement;
- a prospective or current investor in BUAI; or
- a job applicant or contractor.
Section 3 explains what we collect and why for each of these groups.
3. The data we collect and why
| Who | What we collect | Why | Lawful basis |
|---|---|---|---|
| Website visitors and enquirers | Name, email, company, message content | To respond to your enquiry | Legitimate interests (Art 6(1)(f)) |
| Named business contacts we research (B2B outreach) | Name, job title, employer, business email/phone, professional profile | To identify and brief appropriate commercial contacts on behalf of our clients | Legitimate interests (Art 6(1)(f)) — see our Legitimate Interests Assessment |
| Client personnel/business contacts, shared with us during a Discover, Build or Run engagement | Varies by engagement — may include names, roles, contact details, business records | To deliver the contracted service | Performance of a contract — we act as processor on the client's instructions (see our Data Processing Agreement) |
| Prospective investors | Name, contact details, investment interest notes | To run our fundraising process | Legitimate interests pre-investment; contract post-investment |
| Job applicants and contractors | Name, CV, right-to-work status, bank details | To assess and manage engagements | Contract necessity; legal obligation (tax/employment law) |
4. Where your data comes from
Directly from you (enquiries, applications); from our clients, as part of delivering a contracted service; and, for named business contacts, from publicly available sources including LinkedIn, company websites, procurement portals and Companies House.
5. How we use AI in processing your data
We use AI tools, including models from Anthropic, to help research, organise and draft information as part of delivering our services. We are moving this processing to AWS Bedrock in the eu-west-2 (London) region, which is designed to provide UK data residency and Zero Data Retention (no prompt or output data retained by AWS or Anthropic after each processing session, and no client or business-contact data used to train any AI model). This migration is in progress and not yet complete; we will update this notice when it is.
A person always reviews AI-assisted output before we act on it or share it — see section 11 (Automated decision-making).
6. Who we share it with
Named business contact data is shared only with the specific client for whom the research was conducted, under a data-sharing clause requiring confidential, purpose-limited use. Client engagement data is shared only with BUAI staff and the named sub-processors necessary to deliver the service: Amazon Web Services and Anthropic. We are moving our AI processing to AWS Bedrock in the UK to strengthen data residency assurances (see section 5). We do not sell personal data, and we do not share it with any party outside the UK/EEA except as described in section 7.
7. International transfers
Some of our service providers — for example, our website host and typeface provider — may process personal information outside the UK. Where UK data protection law requires it, we rely on an adequacy regulation or appropriate contractual and organisational safeguards, such as the UK International Data Transfer Addendum. You can ask us for more information about the safeguard used for a particular transfer.
Client and business-contact data processed through our AI systems is intended to stay within the UK, via AWS Bedrock eu-west-2 (London), once that migration is complete — see section 5.
8. Cookies and website services
This website does not use analytics, advertising trackers or other non-essential cookies. The site is hosted by Netlify, whose systems may process basic technical and security logs when a page is requested. The site also loads typefaces from Google Fonts, so your browser may send technical information, including your IP address, to Google when requesting those files.
If we later add analytics, embedded services or non-essential cookies, we will update this notice and, where required, ask for your consent before they are used.
9. How long we keep it
| Data type | Retention |
|---|---|
| Named business contact data | 12 months from the close of the relevant client engagement, then deleted or anonymised |
| Client engagement data | For the duration of the client contract, plus a period set out in the client Data Processing Agreement to meet legal, contractual or accounting obligations (normally no longer than 6 years) |
| Website enquiry data | 12 months, if no ongoing relationship develops |
| Investor data | For as long as we are in an active fundraising or investor relationship, and for 6 years afterwards to meet company law and tax obligations |
| HR/contractor/financial records | 6 years post-engagement (statutory) |
10. Your rights
Under UK GDPR you have the following rights, which apply to differing degrees depending on the lawful basis we rely on for a particular use of your data:
- Access — ask us for a copy of your personal data and related information.
- Rectification — ask us to correct inaccurate or incomplete data.
- Erasure — ask us to delete your data in certain circumstances.
- Restriction — ask us to limit how we use your data.
- Objection — object to processing based on our legitimate interests, including the research we carry out on named business contacts; we will stop unless we have compelling grounds to continue.
- Portability — ask us to transfer data you gave us to another organisation, where we process it by consent or contract and by automated means.
- Withdraw consent — where we rely on consent (for example, for some recruitment processing), withdraw it at any time without affecting processing already carried out.
These rights are not absolute, and some do not apply to processing carried out under a contract with us or under legitimate interests — for example, portability does not apply to legitimate-interest processing.
To exercise any of these rights, contact us at info@beusefulai.com. We will respond within one month.
11. Automated decision-making
We do not make any decision about you based solely on automated processing without meaningful human involvement. Where our AI systems produce an output — for example, a business contact briefing — a person always reviews it and decides whether and how to act before any contact is made.
12. How to complain
If you have concerns about how we use your personal data, please contact us first at info@beusefulai.com so we can try to resolve it.
You also have the right to complain to the UK's data protection regulator:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
13. Changes to this notice
This notice is reviewed annually or when our processing changes materially. Last updated: 30 July 2026.