Privacy Notice

Thank you for reading this privacy notice. It explains how Locai Labs Limited handles personal data when you use our website, contact us, reserve or buy a product, or use certain hosted services such as GB1.

This notice covers three different situations:

• Website, sales and support — browsing locailabs.com, booking a demo, placing a Locai One reservation, or emailing us.
• Locai One (on-prem appliance) — AI that runs on hardware you own inside your network. Locai Labs is not the controller of prompts, documents or inference outputs processed on your appliance.
• GB1 and other hosted chatbots — consumer or hosted assistants we operate, where we may process data you choose to provide.

It is important that you read this notice carefully. If you have questions, contact us using the details below.

PLEASE NOTE: Except where we say otherwise (for example GB1), this notice deals with the position where Locai Labs is the controller of your information for website, sales and customer-relationship purposes. Our personnel do not have access to prompts or documents processed on a customer's Locai One appliance in normal operation.

1. Important Information and Who We Are

Locai Labs Limited is the controller of personal data that you provide to us through our website, sales channels and hosted services (where we operate them), which means that we are responsible for that personal data, including what it is used for and how it is used and protected.

We have appointed someone to be specifically responsible for how personal data is used within the business. At the moment, that is our CEO and co-founder, James Drayson. If you have any questions about this privacy notice or our data protection practices, please contact James using the details below.

2. Website, Sales and Customer Relationships

When you browse our website, request a briefing, place a reservation, buy hardware or software, or otherwise contact us, we may process:

• Identity and contact data — name, email, phone, organisation, role
• Transaction and reservation data — products reserved or purchased, deposit and order status (card payments are handled by Stripe; we do not store full payment card numbers)
• Technical data — IP address, browser and device information, approximate location derived from IP, and similar analytics where permitted
• Marketing and communications preferences
• Voice recording data — if you call our offices, calls may be recorded or transcribed with a warning, as described below

We use this data to respond to enquiries, fulfil reservations and orders, provide support, improve the website, and (where allowed) send relevant product information. Lawful bases include performance of a contract, legitimate interests, and legal obligations, as set out in the table in section 6.

3. Locai One and On-Prem Deployments

Locai One is an on-premise AI appliance. Inference, chat, uploads and retrieval indexes on the appliance are processed and stored on the customer's own hardware under the customer's control.

• Locai Labs does not receive prompts, documents or model outputs from your appliance in normal use.
• The customer (or their organisation) is typically the controller of personal data processed on the appliance.
• Optional remote diagnostics or support, if enabled by your administrator, may involve limited technical information shared with Locai Labs under a separate support arrangement; that is off by default.
• When you reserve or purchase an appliance, we process your account and payment-related data as described in section 2; that is separate from data processed on the appliance.

4. GB1 and Hosted Chatbots

GB1 is a UK-oriented hosted AI assistant operated by Locai Labs (and related brands). While we do not intend to retain information used to prompt GB1 beyond what is needed to provide the service, you should still be careful not to input sensitive personal information, or information which might be commercially or personally damaging if disclosed.

Some information you choose to provide when configuring or using a hosted chatbot may be collected, stored and processed in accordance with this notice. Old conversations may be saved in chat history if the product offers that feature. Data input into a hosted chatbot may be subject to automated and human review for safety and terms compliance. We will not use personal data from hosted chat to train or refine models except where you have specifically agreed that we may do so. Once material is used for training, it may not be possible to extract it later from the model.

5. The Data We Collect About You

If we have access to information which would allow us to identify you (either on its own, or when combined with other information) or which tells us anything about your individual activities or characteristics, that is "personal data". Personal data does not include data which cannot be connected to an identifiable individual (anonymous data).

Types of personal data we may collect (depending on how you interact with us) include:

• Identity Data — name, title, similar identifiers
• Contact Data — address, email, telephone numbers
• Financial Data — limited payment-related metadata; card details are handled by Stripe
• Transaction Data — details about payments and products or services purchased
• Technical Data — IP address, browser type and version, time zone, device and similar information
• Profile Data — preferences, feedback, survey responses, account details where you create one
• Voice Recording Data — transcripts of office calls where recording is used
• Marketing and Communications Data — your preferences

We do not knowingly collect Special Categories of Personal Data about you. Please do not input that data into a hosted chatbot or during onboarding.

6. If You Fail to Provide Personal Data

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract (for example, to complete a reservation or deliver a product). We will notify you if that is the case at the time, if we can.

7. How We Collect Your Personal Data

We use different methods to collect data from and about you including through:

• Direct interactions. Forms, email, phone, Stripe checkout, and similar channels when you ask about products, reserve or buy, request marketing, or give feedback.
• Automated technologies or interactions. Website logs and analytics where permitted; if you call our offices, your voice may be recorded or transcribed by a provider or conversational AI tool, with a warning.
• Generated data. Records of transactions, support tickets and communications.
• Hosted chat (GB1 and similar). Content you choose to type into a hosted assistant, and any chat history the product stores.

8. How We Use Your Personal Data

PLEASE NOTE: WE WILL NOT COLLECT PERSONAL DATA ABOUT OUR USERS FOR THE PURPOSES OF TRAINING FUTURE MODELS OR REFINING CURRENT ONES EXCEPT WHERE YOU HAVE SPECIFICALLY AGREED TO ALLOW US TO DO SO.

We will only use your personal data for the purpose for which we collected it, which includes the following:

9. How We Share Your Personal Data

We may share your personal data with the parties set out below for the purposes set out in the table above.

• Payment and checkout providers, including Stripe, for reservations and purchases.
• CRM, including monday.com, to manage sales enquiries submitted through our website forms.
• Hosting, analytics and communications providers that help us run the website and customer communications.
• For GB1 / hosted chat, processors that host or support the conversational tools and associated databases used to provide that service.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

10. International Transfers

We do not currently intend to store your personal data outside the United Kingdom. Our handling of personal data, wherever it is submitted from, is undertaken in accordance with the requirements of UK data protection law (including the UK GDPR and Data Protection Act 2018). It is your responsibility to ensure that any use you make of our system is lawful under the laws of the country in which you are located (where this is not the UK). If, at any time, we do make a transfer of your personal data to, and/or otherwise cause there to be processing of your personal data by, a recipient in another country, we will ensure that the recipient is:

• either located in a country in relation to which the relevant UK Secretary of State (for the purposes of the UK GDPR and the Data Protection Act 2018) has made a finding of adequacy which is either unconditional, or conditional on other factors which we are satisfied have been complied with; or
• where no finding of adequacy has been made in relation to that country, subject to adequate safeguards which will be documented in a data sharing agreement using the model clauses approved by the UK Government and the Information Commissioner's Office in relation to such international data transfers.

Some of our third-party processors or sub-processors may be located outside of the UK, and if so, we will enter into agreements with them to ensure that their handling of your personal data is undertaken in a compliant manner, consistently with the commitments given above.

11. Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

12. Data Retention

We will only keep your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances we will anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

For hosted chatbots, retention of prompts and chat history follows the product behaviour described in section 4. Personal data that becomes incorporated into a training corpus (only where you have agreed to that use) may not be erasable from the model.

13. Your Legal Rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data including the right to receive a copy of the personal data we hold about you and the right to make a complaint at any time to the Information Commissioner's Office, the UK supervisory authority for data protection issues (www.ico.org.uk). These rights include the right to:

• Request access to your personal data (commonly known as a "data subject access request").
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data, where there is no good reason for us continuing to process it (subject to legal exceptions).
• Object to processing where we are relying on a legitimate interest, or where we process for direct marketing.
• Rights in respect of automated processing — we do not use automated technologies to make decisions which produce legal or similarly significant effects about you without human involvement.
• Request restriction of processing in the scenarios set out in UK GDPR.
• Request the transfer of your personal data to you or to a third party, where the right applies.
• Withdraw consent at any time where we are relying on consent.

These rights apply to personal data Locai Labs controls (website, sales, hosted services). For data processed solely on your Locai One appliance, please exercise rights through your organisation's own policies; Locai Labs typically cannot access that data.

NO FEE USUALLY REQUIRED: You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

WHAT WE MAY NEED FROM YOU: We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

TIME LIMIT TO RESPOND: We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.