Privacy Policy

Summary

This summary is not a substitute for the full policy below, but it covers the points people ask about most.

• Cloei builds AI systems that talk to customers on behalf of businesses. Most of the time we are handling data for one of those businesses, not for ourselves. If you received a message from a Cloei-powered assistant, the business named in that message is normally the one responsible for your data.
• You will always be told when you are speaking to an AI. Our assistants identify themselves as automated at the start of a conversation and will not claim to be human if asked.
• Client data processed solely on a business’s instructions is protected by our customer agreements. Separately, Cloei may use lawfully acquired datasets, including call recordings, for machine learning and may sell or license eligible data to AI and LLM developers for their own model training. These uses remain subject to data protection law and the applicable acquisition rights. Sections 9 and 9A explain the distinction.
• You can ask us to stop marketing to you at any time, and you have rights over the data we hold about you as a controller — set out in section 21.
• Questions or complaints: support@cloei.ai. We will acknowledge any data protection complaint within 30 days.

1. About this policy

CLOEI AI LIMITED (“Cloei”, “we”, “us”, “our”) provides AI-powered conversational technology that businesses use to communicate with their customers and prospective customers.

This policy explains how we handle personal data when you:

• visit cloei.ai;
• contact us, request a demonstration, or deal with us as a customer, supplier or partner;
• interact with an AI assistant powered by Cloei on behalf of another business; or
• are included in data one of our business customers provides to us.
• are included in a dataset Cloei separately purchases, acquires or licenses, including historical call recordings and related records.

Because Cloei sits between businesses and their customers, our role changes depending on the situation. Sometimes we decide how personal data is used (controller); more often, we act on a business customer’s instructions (processor). Section 4 explains which applies when, and why it matters to you.

This policy is governed by the UK GDPR, the Data Protection Act 2018 as amended by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR).

2. Who we are

CLOEI AI LIMITED

We have not appointed a statutory Data Protection Officer, as we are not required to under Article 37 UK GDPR. Responsibility for data protection sits with our directors, and privacy queries are handled through the contact address above.

Cloei’s services are provided in the United Kingdom and we have not appointed a representative under Article 27 UK GDPR.

3. What Cloei does

Cloei provides AI systems that hold natural-language conversations with customers on behalf of businesses, across channels including WhatsApp, SMS and RCS, web chat, social messaging and email.

Depending on how a business configures Cloei, our technology may:

• answer enquiries and understand what a customer is asking for;
• collect information a customer chooses to provide;
• qualify enquiries and assess whether a customer is likely to be eligible for a product or service;
• provide information, options, quotes or recommendations;
• arrange appointments or callbacks;
• help customers through an application or enquiry process;
• follow up on incomplete journeys;
• hand the conversation to a human agent; and
• pass conversation outcomes and information back to the business’s own systems.

We work with businesses in regulated and enquiry-led sectors, including motor finance, insurance and warranties, travel, and lead generation. What we process, and why, therefore varies significantly between one deployment and the next.

4. Controller or processor

When we are the controller

We decide how personal data is used — and this policy applies in full — when you:

• visit cloei.ai or contact us through it;
• submit an enquiry or request a demonstration;
• deal with our sales, support or delivery teams;
• are a contact at a customer, supplier, partner or prospective customer;
• subscribe to our marketing; or
• are recorded in our own business contact records.

We also act as controller for security, fraud prevention, legal compliance, and defending legal claims.

We also act as controller when we determine the use of separately acquired datasets and call recordings for our own machine learning, AI development or commercial supply to AI developers, as described in section 9A. These activities are distinct from processing a business customer’s database on its instructions.

When we are the processor

When a business uses Cloei to communicate with its own customers, that business decides what data we receive, what we do with it, which communications happen, and how long the data is kept. In that situation the business is the controller and we act on its documented instructions under a written contract that meets Article 28 UK GDPR.

What this means for you: if you received a message from a Cloei-powered assistant and want to know why you were contacted, ask to be removed, or exercise your data protection rights, the fastest route is normally the business named in that message. You can still contact us at support@cloei.ai — we will either help directly or pass your request to the relevant business and support them in responding.

Marketing and referral relationships

When our AI Sales Agent supports a business’s customer communications, marketing or referrals, that business is the data controller and we act as its data processor. We process contact details, conversations and communication preferences on the business’s documented instructions.

Where a customer chooses to proceed with a referral, a receiving provider that handles applications or claims for its own purposes acts as an independent data controller. Such providers are not our sub-processors. Where consent is required, it must be obtained and recorded before the referral proceeds. The provider and its privacy notice are identified before the customer proceeds.

The relationship table below identifies the organisations involved, their roles and the relevant privacy notices. For questions about a business’s use of your data or to exercise your rights, contact the business named in your conversation. You can also contact us using the details in this policy and we will assist the responsible business.

5. Talking to a Cloei AI assistant

Because this is central to what we do, we set it out separately.

• Disclosure. Cloei assistants identify themselves as automated at the outset of a conversation. If you ask whether you are speaking to a person, the assistant will tell you it is an AI. We require this of every deployment as a condition of using our platform.
• Human handover. You can ask to speak to a human at any point. Where the business has enabled it, the conversation will be transferred; where it has not, you will be told how to reach a person.
• Recording and retention. Conversations are recorded and stored so the business can service your enquiry, meet its own regulatory record-keeping obligations, and check the quality of the service. Recordings made through a business’s deployment may also be de-identified for platform improvement as described in section 9. They are not part of the acquired datasets described in section 9A unless separately and lawfully acquired under that section.
• What you should not send. Please do not send payment card details, passwords, or sensitive information that has not been asked for. If a service genuinely needs sensitive information, you will be told why.
• Accuracy. AI systems can occasionally produce inaccurate or incomplete responses. Nothing an assistant tells you overrides the terms, quotes or decisions issued by the business you are dealing with.

6. Information we may process

Identity and contact. Name, title, date of birth where a service requires it, customer or account reference, email address, phone number, postal address, messaging account identifier, and communication preferences.

Business contact. Where you deal with us professionally: employer, job title, business contact details, department, your requirements, and our correspondence and commercial history with you.

Conversation data. Messages sent and received, questions and answers, conversation history and context, timestamps, channel, AI-generated responses, human agent responses, expressed preferences, outcomes, and callback or appointment requests.

Data supplied by our business customers. Customer and prospect records, contact details, account identifiers, prior enquiry history, products held, application data, lead source, and previous communications.

Technical data. IP address, browser and device type, operating system, approximate location derived from IP, system and access logs, security events, and diagnostic and performance data.

Acquired audio and datasets. Historical call recordings, voices, transcripts, customer and agent dialogue, questions and responses, enquiry and application details, timestamps, outcomes, annotations and related metadata, to the extent included in a lawfully acquired dataset and necessary for the purposes in section 9A.

7. Where we get personal data

Directly from you; from your use of cloei.ai; from conversations with our assistants; from businesses using the Cloei platform; from integrations with our customers’ CRM, telephony and marketing systems; from messaging and telecommunications providers; from our own suppliers acting on our behalf; and, for business-to-business purposes only, from publicly available sources such as company websites, Companies House and professional networks.

Where a business supplies personal data to us, that business is responsible for having a lawful basis to do so and for telling the people concerned. Where we obtain business contact data indirectly and act as controller, we provide the information required by Article 14 UK GDPR at or before the point we first contact you.

Separately acquired datasets may come from original recording businesses, data owners, authorised licensors or sellers, including lawful business or asset acquisitions. We check provenance and permitted use, and provide the required Article 14 information as described in section 9A. The seller’s obligations do not replace Cloei’s own controller responsibilities.

8. How we use personal data

To deliver our services — operating the platform, running conversations, understanding intent, generating responses, collecting information, qualifying enquiries, arranging callbacks, transferring to human agents, maintaining conversation context, integrating with client systems, and recording outcomes.

To run our business — responding to enquiries, arranging demonstrations, providing support, administering accounts and contracts, managing suppliers, invoicing, and keeping business records.

To improve Cloei — analysing how the platform performs, developing features, testing and evaluating our AI systems, diagnosing errors, and improving reliability, conversation quality and security. Section 9 explains the use of data from client deployments. Section 9A separately covers machine learning and commercial licensing of Cloei’s acquired datasets.

To keep our systems secure and prevent fraud — authentication, monitoring, detecting suspicious activity, investigating incidents, and protecting our customers and users.

To meet legal and regulatory obligations — complying with law, responding to lawful requests, cooperating with regulators and law enforcement, keeping records, and establishing or defending legal claims.

To develop AI and supply training datasets — preparing and analysing our separately acquired recordings and records, training and improving Cloei’s systems, and selling or licensing eligible datasets to AI developers for their own model development, subject to section 9A.

9. AI models, providers and training

Our AI providers

We use third-party large language model providers, currently OpenAI and Anthropic, to power conversation understanding and response generation.

Training

• For personal data processed solely on a business customer’s behalf, we do not permit provider model training under our standard processing arrangements. Any different use requires a separate lawful arrangement and the necessary contractual changes. Separately acquired datasets may be supplied for provider training under section 9A.
• For identifiable personal data held solely as a processor, we train models only on the business customer’s specific written instruction for its own deployment. Cloei’s separately acquired datasets may be used for our own training under section 9A.
• We do use de-identified conversation data to improve the Cloei platform. Before conversation data is used for this purpose, it is processed so that individuals can no longer reasonably be identified. Once de-identified, it may be combined with data from other businesses using Cloei and used to improve conversation quality, accuracy and reliability across the platform.

How we de-identify

Direct identifiers such as names, contact details, account references and dates of birth are removed. Free-text content is scanned and redacted to remove identifying detail. The process is designed to be irreversible: we do not retain a key allowing de-identified records to be linked back to an individual.

De-identification takes place within 30 days of a conversation ending. After that point, only the de-identified version is retained for platform improvement.

This 30-day arrangement applies to client-deployment conversation data used for platform improvement. It does not set the retention period for Cloei’s separately acquired historical datasets, which are governed by sections 9A and 16.

Data minimisation

We limit what is sent to AI providers to what the relevant service needs, and we configure retention with those providers according to our contractual and data protection arrangements.

We may add or change AI providers as our technology develops. For client processing we apply equivalent protections and update section 13. Separately agreed training uses and controller-to-controller disclosures are governed by section 9A and the applicable agreements and privacy information.

9A Cloei acquired datasets and call recordings

Scope and controller responsibility

Cloei owns or holds contractual rights in separately acquired datasets, including an existing collection of call recordings and its own database. These datasets are separate from databases and communications we process solely on behalf of business customers. References to ownership concern our contractual, intellectual property or database rights; they do not remove the data protection rights of the people recorded.

Where we decide why and how personal data in these datasets is used, CLOEI AI LIMITED acts as controller and is responsible for the lawfulness, fairness and transparency of that use. Data from a customer deployment is not automatically part of our acquired datasets. Any acquisition from a customer requires a separate written agreement and a lawful transfer; a processor appointment or access to a client database is not sufficient.

Machine learning and data preparation

Where lawful and within our acquisition rights, we may store, retrieve, listen to, transcribe, label, annotate, redact, structure, analyse and combine recordings and related information. We may create training and evaluation datasets and use them to develop, pre-train, train, fine-tune, test, benchmark and improve machine learning systems, speech technologies and large language models, including Cloei’s own products and services.

Depending on the permitted purpose, this may involve original audio, voices, transcripts, conversation content, agent responses, timestamps, contextual information and outcomes. The information may relate to callers, staff, agents and other people mentioned. We use identifiable information only where necessary and lawful, and use genuinely anonymous information where it can reasonably achieve the purpose.

Sale and licensing to AI developers

Where lawful and within our acquisition rights, we may sell, license, sublicense, transfer or otherwise make eligible datasets and permitted derivatives available to third-party AI developers and LLM companies. Such arrangements may be made for payment or other commercial consideration.

The agreed purposes may include developing, pre-training, training, fine-tuning, evaluating and improving the recipient’s own models, including general-purpose models and services supplied to other organisations. Eligible datasets may include personal data where the disclosure and recipient’s intended use are lawful.

Before a disclosure, we identify the recipient, define the permitted data and purposes, and agree security, confidentiality, onward-use, retention and rights-handling terms. A recipient deciding its own training purposes acts as a controller for that use; a recipient acting solely on documented instructions acts as a processor. We assess the actual arrangement, including any joint-controller responsibilities, rather than relying on contractual labels.

Lawful use and transparency

Purchase, ownership, a licence or publication of this policy is not by itself a lawful basis for processing personal data. Before using or disclosing acquired data for training, we check provenance, collection notices, permitted uses and restrictions, establish and document the relevant lawful basis, and assess whether the new use is compatible with the original collection purpose. We carry out a data protection impact assessment where required.

Where appropriate, we may rely on legitimate interests in developing AI and supplying lawfully sourced training data, only after assessing the purpose, necessity, reasonable expectations and impact on individuals. We rely on consent where appropriate or required, including where a proposed reuse requires new consent. We do not treat ordinary commercial AI training as automatically qualifying for a research exemption.

For indirectly obtained data, we provide the information required by Article 14 UK GDPR, including the source, categories, purposes, lawful basis and recipients, within the applicable timeframe: generally within one month, or earlier at first communication or first disclosure where required. We rely on an exception only where its conditions are met and documented. We provide required information about a new purpose before that use begins.

We do not include special-category data or criminal-offence information in training or sale datasets unless the additional applicable legal conditions are satisfied. We assess recordings for such content and remove or exclude it where those conditions are not met. A voice recording is not automatically special-category biometric data; processing it for unique identification requires the applicable additional safeguards.

We exclude recordings and records that we identify as relating to people under 18 from training and sale datasets.

Safeguards and individual rights

We minimise datasets, restrict access, use secure transfer methods and assess re-identification and model memorisation risks. Removing names alone does not make a recording or transcript anonymous: voices, events and contextual details may still identify people. Pseudonymised information remains personal data.

You may ask us about the source and recipients of your information and exercise your applicable rights under sections 21 and 22. You may object where we rely on legitimate interests and withdraw consent where we rely on consent. We assess requests and notify or coordinate with recipients where required by law. Training does not automatically extinguish rights over personal data in datasets or models, and we do not assume that a trained model is anonymous.

You can request the identity, privacy notice, retention arrangements and transfer safeguards of a recipient relevant to your data by emailing support@cloei.ai. Required recipient information will be provided proactively as part of our applicable privacy information, rather than only on request.

Opting out of training and sale. If you believe your voice or information may be in one of our acquired datasets, you can object to its use for machine learning, or to its sale or licensing, at any time by emailing support@cloei.ai with the subject “Dataset opt-out” or by using our data protection complaints form. Where we rely on legitimate interests, we will stop that use and exclude your data from future training and disclosures unless we have compelling legitimate grounds that override your interests, rights and freedoms. Objections received before a dataset is disclosed will be applied before that disclosure, and we will inform recipients where required.

10. Automated decision-making and profiling

Some Cloei deployments involve profiling — for example, assessing from a conversation whether an enquiry is likely to meet a business’s eligibility criteria, or prioritising enquiries for follow-up.

UK law changed on 5 February 2026. Articles 22A to 22D of the UK GDPR now permit solely automated decisions with legal or similarly significant effects in a wider range of circumstances than before, provided appropriate safeguards are in place. Stricter conditions continue to apply where such a decision is based, entirely or partly, on special category data.

Our position:

• Cloei is designed to inform decisions, not to make them alone. Where a Cloei conversation feeds into a significant decision — such as whether a finance or insurance application proceeds — that decision is normally taken by the business, with meaningful human involvement.
• Where a business configures Cloei so that a significant decision is made without meaningful human involvement, that business is responsible as controller for the safeguards required by Article 22C: telling you the decision was made, letting you make representations, providing human intervention on request, and letting you contest the outcome. Our contracts require customers to implement these.
• If you believe an automated decision has been made about you through a Cloei-powered service, contact the business concerned, or contact us at support@cloei.ai and we will identify the responsible business and pass your request on.

11. Lawful bases

Where we act as controller, we rely on:

You can ask us for our legitimate interests assessment for any of the purposes above by emailing support@cloei.ai.

Acquired datasets and training. For the purposes in section 9A, we may rely on legitimate interests only where a documented assessment supports the particular processing, or consent where appropriate or required. We establish the basis before processing and separately assess onward disclosure and any change of purpose. Purchasing data or having a commercial contract with its supplier does not itself establish an Article 6 basis for using individuals’ information.

Where we act as processor, the business customer determines the lawful basis, including for the de-identification we carry out on its instruction under section 9. Cloei determines and documents its own lawful basis for controller processing under section 9A. Data protection law ceases to apply only where information is genuinely anonymous; removing direct identifiers alone is insufficient.

12. Marketing

We may send you information about Cloei’s products, features, events, research and related services.

If you are a business contact, we generally rely on legitimate interests, and on the fact that PECR permits electronic marketing to certain corporate subscribers. If PECR requires your consent, we will obtain it before sending marketing by email, SMS or messaging app.

Soft opt-in. Where you have bought a service from us or negotiated to, and we obtained your details in that context, we may market our own similar products and services to you without fresh consent, provided we gave you a chance to opt out at the time and give you one in every message.

Opting out. You can stop marketing at any time by using the unsubscribe link or opt-out instruction in any message, replying STOP where the channel supports it, or emailing support@cloei.ai. We will keep a minimal suppression record so your preference continues to be honoured.

Opting out of marketing does not stop service, transactional, contractual or legally required communications.

13. Who we share personal data with

We may sell or license eligible datasets that we have separately and lawfully acquired to AI and LLM developers for the purposes described in section 9A. This does not authorise sale of personal data we hold solely as a processor for business customers.

The service-provider table below describes our customer platform arrangements. Separately, eligible acquired datasets may be supplied to AI model developers and their authorised service providers for section 9A purposes. Actual recipients and controller roles will be identified in the applicable privacy information before disclosure where required. They are not automatically sub-processors under customer DPAs.

We share personal data with the following recipients, under written contracts requiring appropriate security and confidentiality:

Client and referral relationships

We also use business tools such as internal messaging and knowledge management systems. Personal data processed on behalf of our business customers is not transferred into those systems.

For this website, we use Google to provide optional Google Analytics 4 measurement and Google Tag Manager, and to run reCAPTCHA security checks when you submit the complaint form. Google receives technical information such as your IP address and browser details when those services load. Analytics loads only with your consent. Section 17 explains your choices.

We also share personal data with:

• Our business customers, where you have communicated through Cloei on their behalf — conversation records and outcomes are provided to them.
• Professional advisers — lawyers, accountants, auditors, insurers and security advisers, where necessary.
• Regulators, courts, law enforcement and other authorities, where required by law or necessary to protect our rights.
• Prospective purchasers, investors or lenders, if Cloei or part of our business is sold, merged, financed or reorganised, subject to confidentiality protections.

Changes to our providers

Where we act as processor, we will give our business customers reasonable advance notice of new or replacement sub-processors so they can raise objections under their contract with us.

14. International transfers

The providers supporting our customer platform process personal data within the United Kingdom, the European Economic Area and the United States, depending on the provider and service used, as set out in Section 13. Our website's Google services may also process data elsewhere, as described in section 17. Transfers to the EEA are covered by UK adequacy regulations.

Separate dataset sale, licensing or training arrangements may involve processing outside the UK or EEA, including in the United States. The locations in the customer-platform table do not describe those separate arrangements. Before transfer, we confirm locations and put in place applicable adequacy coverage or appropriate safeguards, including the UK IDTA or UK Addendum and a transfer risk assessment where required.

If we introduce a provider that processes personal data in a country not covered by UK adequacy regulations, we will ensure an appropriate transfer mechanism is in place — the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism — together with a transfer risk assessment where required, and we will update this policy.

You can request details of the safeguards applying to a specific transfer by emailing support@cloei.ai.

15. Security and data breaches

We use technical and organisational measures appropriate to the risk, including: access controls and role-based permissions; multi-factor authentication; encryption in transit and at rest; secure cloud infrastructure; logging and monitoring; supplier due diligence; secure development practices; data minimisation; incident response procedures; and confidentiality obligations on staff and contractors.

If a personal data breach occurs, we will notify the ICO within 72 hours where the law requires it, and notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms. Where we act as processor, we will notify the affected business customer without undue delay so it can meet its own obligations.

No internet-based service can be guaranteed absolutely secure. We review our controls as our platform develops.

16. How long we keep personal data

We keep personal data only as long as necessary. Where we act as processor, retention is set by the business customer’s instructions.

For separately acquired recordings and training datasets, retention is set for each dataset before use, taking account of recording age, source restrictions, the defined training purpose, necessity, rights requests and legal obligations. We document and review the period and delete or anonymise data when no longer necessary. We communicate the applicable period or meaningful criteria and any recipient retention arrangements in the relevant dataset privacy information. There is no automatic right to retain personal data indefinitely because we own a dataset.

Where we act as controller, our periods for other personal data are:

When we no longer need identifiable data, we delete it or render it genuinely anonymous. Anonymous and aggregated information may be retained for analytics and product development. This does not permit indefinite retention of identifiable or merely pseudonymised data.

17. Cookies and website analytics

We use optional Google Analytics 4 (GA4), delivered through Google Tag Manager, to understand which pages people visit and how they use our discovery-call, email, telephone and other calls to action. We also count complaint forms only after our service confirms receipt. Opening an email draft or clicking a telephone link does not tell us whether a message was sent or a call was completed.

Our cookie banner offers Accept all, Reject all and Manage cookies. Accept all and Reject all are equally prominent. Manage cookies lets you choose analytics and performance separately from marketing and advertising. Optional technologies remain blocked until you give the relevant consent. You can use the website and contact us without accepting either optional category.

• Strictly necessary — always active: storage that remembers your privacy choices and security checks that protect form submissions.
• Analytics and performance — optional: Google Analytics measures website visits and interactions. This requires your analytics consent.
• Marketing and advertising — optional: technologies that measure campaigns or support relevant advertising require your marketing consent. Google Ads, Meta Pixel and related Meta advertising technologies, and LinkedIn Insight Tag are planned providers. These advertising tags are not currently enabled by our website configuration and are not listed as active providers. We will update our cookie information when they are enabled and verified.

Google Tag Manager is used to deliver configured tags subject to our consent controls. We do not treat analytics consent as permission for advertising. Google signals and advertising personalisation within our Google Analytics configuration remain disabled.

• Privacy preference: cloei_cookie_consent is stored in your browser's local storage to remember your choice for 180 days. This is essential preference storage, not an analytics identifier. We ask again when the choice expires. The expired preference is removed when the website next runs or checks your choice.
• Analytics cookies: Google uses _ga and _ga_6TGYMNLPB3 to distinguish browsers and maintain session information. Our configuration limits these cookies to 180 days, with automatic expiry renewal disabled.
• Form security: Google reCAPTCHA loads when you submit a valid complaint form to help prevent spam and abuse. It may set its security cookie _GRECAPTCHA (up to six months) and process device and interaction information. This security check operates independently of your analytics choice. You can also contact us by email.

Analytics includes page paths, interaction categories, timestamps, browser and device information, and cookie identifiers. Our tracking does not send form answers, names, email addresses, phone numbers, complaint references, or URL query strings and fragments. Google receives your IP address when your browser connects to its services.

You can withdraw consent at any time using Cookie settings in the footer or below. Turning off a category stops its tags, removes its cookies that we can access on this website, and may reload the page. Reject all leaves only strictly necessary technologies active. Withdrawing consent does not delete information already received by a provider or cookies we cannot access on another domain; contact support@cloei.ai about your data rights. Browser controls can also clear cookies and local storage.

Google may process website service data outside the UK and EEA, including in the United States, under its applicable data processing and international transfer terms. See Google's Privacy Policy, how Google uses information from sites that use its services, and the Google Terms of Service for reCAPTCHA. Analytics event data is retained according to our GA4 property's retention settings. Aggregate reports may be retained longer.

For questions about our current retention periods or international transfer safeguards, contact support@cloei.ai.

18. Sensitive information and customers in vulnerable circumstances

Some sectors we work in — motor finance, insurance and warranties among them — involve customers who may be in financially difficult circumstances, and conversations in which people sometimes volunteer sensitive information such as health or financial hardship details.

• We seek to minimise the processing of special category data and expect customers to configure their deployments so that it is not collected unnecessarily.
• Where special category data is processed, the relevant controller must identify both an Article 6 lawful basis and an Article 9 condition.
• For client-deployment data, our de-identification process in section 9 is designed to remove sensitive detail before platform improvement. For acquired datasets, the additional requirements in section 9A apply before training or disclosure.
• Our contracts require business customers operating in regulated sectors to configure their services consistently with their own regulatory obligations, including the FCA’s Consumer Duty and its expectations around customers with characteristics of vulnerability. Where a conversation indicates possible vulnerability, deployments should be configured to route the customer to appropriate human support.

19. Children

Our website and our direct services are aimed at businesses and are not intended for children. We do not knowingly collect children’s data through cloei.ai for marketing purposes. Section 9A explains how we treat information about people under 18 in our acquired datasets.

Where a business customer’s own service involves people under 18, that customer is responsible for the lawful basis, the age assurance approach and the safeguards, including the data protection by design expectations for children’s services introduced by the Data (Use and Access) Act 2025. We process such data only on that customer’s documented instructions.

20. Third-party websites

Our website and communications may link to third-party sites and services. We are not responsible for their privacy practices. Review their own privacy information before providing personal data to them.

21. Your rights

Where we are the controller, you may have the right to:

• Access — obtain confirmation that we process your data and a copy of it.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — have data deleted where there is no lawful reason to continue processing it.
• Restriction — limit how we use your data in certain circumstances.
• Objection — object to processing based on legitimate interests. You have an absolute right to object to direct marketing.
• Portability — receive data you provided to us in a structured, commonly used, machine-readable format, or have it sent to another organisation.
• Withdraw consent — at any time, where we rely on consent. This does not affect processing carried out before withdrawal.
• Rights relating to automated decisions — see section 10.

These rights are subject to legal exemptions. They do not extend to de-identified data, which can no longer be linked to you.

These rights also apply, subject to their legal conditions, to personal data in acquired recordings, training datasets and models. Inclusion in training does not automatically remove rights. We coordinate with recipients where required and explain any applicable limitations in responding to a request.

22. How to exercise your rights

Email support@cloei.ai with enough detail for us to identify you and understand what you are asking for. We may need to verify your identity.

Timescales. We respond within one month. Under Article 12A UK GDPR, that period does not begin until we have the information we reasonably need to identify you and to clarify the request, and it can be extended by up to two further months for complex or numerous requests — we will tell you if that happens. We conduct a reasonable and proportionate search for the data you have asked for.

If your request relates to data we process for a business customer, we will tell you and either refer you to that business or assist it in responding.

There is normally no charge, though we may charge a reasonable fee or refuse to act where a request is manifestly unfounded or excessive.

23. Complaints

Complain to us first. Section 164A of the Data Protection Act 2018 requires us to make it straightforward to complain about how we handle personal data, and to deal with complaints properly.

• Use our data protection complaints form at cloei.ai/legal/data-complaint, or email support@cloei.ai.
• We will acknowledge your complaint within 30 days of receiving it.
• We will take appropriate steps to respond without undue delay, keep you updated on progress, and tell you the outcome.

Complain to the regulator. If you remain dissatisfied, you can complain to the Information Commissioner’s Office:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113 · ico.org.uk

Our ICO registration number is ZC240937.

24. Changes to this policy

We will update this policy as our services, channels, providers and legal obligations change. The current version is always published at cloei.ai. Where a change materially affects how we use personal data, we will take appropriate steps to bring it to the attention of affected individuals.

25. Contact us

CLOEI AI LIMITED

Reedham House, 31 King Street West, Manchester, M3 2PJ, United Kingdom

Email: support@cloei.ai

Company number: 16688827

ICO registration: ZC240937

Website: cloei.ai