Legal
Last updated: 28 October 2026
Hyphosxai Ltd (trading as HyphosXAI) respects your privacy. This Privacy Policy explains how we collect, use, store, and share personal data when you visit https://hyphosxai.com or use our services.
This policy is written for a UK marketing site and related AI service offerings. It is intended as clear operational information for visitors and clients. It is not a substitute for formal legal advice.
Controller: Hyphosxai Ltd (trading as HyphosXAI)
Companies House number: 17216294
SIC: 62012 (Business and domestic software development)
Incorporated: 13 May 2026
Registered office: The Grain Barn West, Lordship Farm, Church Lane, Ware, United Kingdom, SG12 0NS
Website: https://hyphosxai.com
Telephone: +44 7415 166681
Privacy / data-protection email: legal@hyphosxai.com
For data-protection enquiries and to exercise your rights, please contact us by telephone on +44 7415 166681 or email legal@hyphosxai.com.
We are the controller of personal data processed in connection with our website and the services we provide, except where we act as a processor on a client’s documented instructions (for example under a separate data processing agreement for enterprise engagements).
This policy covers:
It does not replace any separate contract, statement of work, or data processing agreement we may enter into with a business client.
Depending on how you interact with us, we may process:
When you use our enquiry form we collect your name, work email address, the service you are enquiring about and your message. Our system also records the page you sent it from and the time it was sent. If you contact us by email or phone, we collect the details and content you share. We use a hidden field and automated checks to filter spam. A message that fails these checks may be discarded without being delivered or kept. If you have not heard back from us, please email us. Our web server also keeps a keyed one-way hash of your IP address (not the IP address itself) together with the times of recent submissions. These records are used only to count submissions made in the last hour, and they are deleted within 2 hours.
Confirmation email. When you submit the enquiry form and it passes our spam checks, our web server automatically sends an email from support@hyphosxai.com to the address you entered, confirming that we have received your enquiry, the topic you chose and when we received it. We do not send a confirmation email for a message that our checks flag as possible spam. The email does not repeat your message. This email is sent through our website host, IONOS, and relates only to your enquiry. We do not use it for marketing, and submitting the form does not add you to any mailing list. To stop the confirmation email being misused to send unwanted email, our web server keeps salted one-way hashes (not the actual values) of the email address you entered, its email domain and your IP address, together with the times of recent submissions, for no more than 24 hours and then deletes them.
Account identifiers, configuration preferences, workspace or project details you supply, and records needed to deliver the service.
Billing contact details, company details for invoices, payment status, and transaction metadata. Card payments (when live) are processed by Stripe; we do not store full card numbers on our systems.
Prompts, instructions, uploaded files, and outputs generated in the course of using our AI operating desks (for example Founder Desk, Pipeline Desk, Books Copilot, Content Desk, Sprint Pilot) and related website packages.
Where you authorise connectors (for example email, calendar, Slack, CRM, Xero, Stripe, or other tools), we may process OAuth tokens, scopes you grant, and technical metadata needed to maintain the connection. You control which tools you connect and the permissions you approve.
IP address, device/browser type, approximate location derived from IP, pages viewed, timestamps, error logs, and similar technical data needed for security, performance, and troubleshooting.
Newsletter or marketing opt-in status and related preference records, only where you have chosen to receive them.
Information collected via cookies and similar technologies, as described in our Cookies Policy and summarised in section 11 below.
If we contact you about our services at work, we use your name, job title, business email address, company name and where we found your details (for example your company's website or Companies House). We may also record your work phone number and notes of our dealings with you, and we keep these records in our customer relationship management (CRM) system (see section 6). You can object at any time and we will stop; we keep a short do-not-contact record so that we do not contact you again.
If you apply for a role with us by emailing careers@hyphosxai.com, we collect what you send us. This is usually your name, contact details, CV, cover letter, employment and education history, and anything else you choose to include. We may also keep notes from any interviews or conversations with you about the role.
We use this information only to assess your application, communicate with you about it, and make a recruitment decision. Our lawful basis is legitimate interests (our interest in recruiting suitable people) and, where you apply for a role, taking steps at your request before entering into a contract.
Applications arrive in our careers mailbox, which is hosted on Google Workspace. Our website does not store CVs or application details.
Use of AI. We may use AI tools to help us read, summarise and compare applications. The AI provider processes your application only to produce that output for us (see section 6). A person always reviews your application and makes every recruitment decision, including whether to shortlist or interview you. We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you (UK GDPR Article 22). You can ask for a person to review your application without relying on any AI output, question how your application was assessed, or object to us using AI tools on your application, by emailing legal@hyphosxai.com. If you object, we will assess your application without AI tools, and doing so will not count against you.
Please do not include sensitive information (for example about your health, ethnicity, religion or sexual orientation) unless we ask for it. If we make you an offer, we will tell you about any further checks at that stage (such as the right-to-work check required by law) and how we handle that information.
If you are not successful, we keep your application for 6 months after we tell you our decision and then delete it. We keep it longer only if you ask us to keep it on file for future roles, or if we need it to establish, exercise or defend a legal claim. If you join us, your application becomes part of your employment record. You can ask us to delete your application sooner by emailing legal@hyphosxai.com.
We do not intentionally collect special category data unless you choose to include it in content you send us. Please avoid sending unnecessary sensitive personal data.
| Purpose | Examples | Lawful basis |
|---|---|---|
| Respond to enquiries | Quote requests, demos, support | Legitimate interests (responding to business enquiries); contract where steps are taken at your request |
| Recruitment | Assessing job applications sent to careers@, interviews, recruitment decisions | Legitimate interests (recruiting suitable people); steps at your request before entering into a contract |
| Provide services | Operate AI desks, Sprint Pilot, website packages | Contract |
| Billing and accounting | Invoices, Stripe payments, records | Contract; legal obligation |
| Improve and secure services | Logs, abuse prevention, reliability | Legitimate interests (security and service integrity) |
| AI processing to deliver outputs | Prompts/outputs via AI providers (e.g. xAI/Grok) | Contract; legitimate interests in delivering the service |
| Marketing | Newsletters, product updates, and emails to business contacts about our services | Emails to individuals and sole traders: consent (or an existing customer relationship where the law allows). Emails to business contacts at companies and LLPs: legitimate interests. You can opt out at any time. |
| Cookies (non-essential) | Analytics cookies that count visits, only if you opt in. We do not use marketing cookies. | Consent |
| Legal compliance | Responding to lawful requests, defending claims | Legal obligation; legitimate interests |
Where we rely on legitimate interests, we balance those interests against your rights and freedoms. You may object to processing based on legitimate interests (see section 10).
Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
Our services use AI systems (including models provided by third parties such as xAI / Grok) to help draft, summarise, research, and automate workflows.
Please note:
Further detail on use of the services appears in our Terms of Use.
We share personal data only where needed for the purposes above, including with:
IONOS Cloud Ltd handles personal data on our behalf to provide these services, under its standard business terms. Google handles personal data on our behalf under data processing terms. HubSpot, Inc. handles business contact and prospect records on our behalf as our CRM processor, under data processing terms; any transfers to the United States are protected by its certification under the UK Extension to the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses and the UK Addendum as a fallback. AI model providers process prompts and outputs for us under their business terms. Stripe, connector providers you authorise, professional advisers and authorities are not our processors. They handle personal data under their own terms, professional duties or legal powers, and are responsible for it themselves.
We do not sell your personal data.
Our company books and banking stack may use Xero and Tide. Clients may use their own tools; any client-side connections remain under the client’s authorisation and account policies.
Some providers (including certain AI and cloud services) may process data outside the United Kingdom.
Where personal data is transferred internationally, we use appropriate safeguards permitted under UK data protection law, which may include:
We keep transfer arrangements under review as our provider stack evolves. Enterprise clients may receive further detail under a separate data processing agreement.
We retain personal data only as long as reasonably necessary for the purposes set out in this policy, including:
Exact periods may vary by record type. When data is no longer needed, we delete or anonymise it where practicable.
We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. Measures may include access controls, encryption in transit where appropriate, least-privilege practices, and staff awareness.
No method of transmission or storage is completely secure. We do not claim absolute security. Please use strong credentials for any accounts and notify us promptly of suspected unauthorised access.
Under UK GDPR, you have rights in relation to your personal data, including:
ICO contact: https://ico.org.uk | Telephone: 0303 123 1113
To exercise your rights, contact us by telephone on +44 7415 166681 (or email legal@hyphosxai.com). We may need to verify your identity before responding. We aim to respond within one month, subject to UK GDPR rules.
Some rights are not absolute (for example where we must keep records for legal obligations or to establish/defend legal claims).
We use cookies and similar technologies as described in our dedicated Cookies Policy.
In short:
Please read the Cookies Policy for what we store, why, how long it lasts, and which third parties (if any) are involved.
Our website and services are aimed at businesses and adults. They are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.
We may update this Privacy Policy from time to time. The “Last updated” date at the top will change when we do. Material changes may be highlighted on the website or notified to clients where appropriate. Please check this page periodically.
Hyphosxai Ltd
The Grain Barn West, Lordship Farm, Church Lane, Ware, United Kingdom, SG12 0NS
Telephone: +44 7415 166681
For privacy rights and data-protection questions, use the telephone number above or email legal@hyphosxai.com.