Legal
Privacy notice
Last updated: 2 November 2026
This notice explains what personal information Making AI Work collects, why, what we do with it, who we share it with, how long we keep it, and your rights. We've written it in plain English. If anything is unclear, email us at hello@makingaiwork.ai.
1. Who we are
Making AI Work Limited ("Making AI Work", "we", "us") is the controller of the personal information described in this notice.
- Registered in England and Wales, company number 13935854
- Registered address: Proxima, 1 Grenfell Road, Maidenhead SL6 1HN
- Registered with the Information Commissioner's Office (ICO), registration number [ICO number to follow]
- Contact for anything about your data: hello@makingaiwork.ai, or write to the address above
We don't have a data protection officer, as the law doesn't require one for a business of our size. A director deals with every data protection request personally.
2. Who this notice covers
- Website visitors: anyone who visits makingaiwork.ai.
- People who contact us: anyone who sends an enquiry, takes the sales check, books a call or emails us.
- Business prospects: people at companies we think could benefit from our services, whom we may contact about our work.
- Clients and their staff: people at companies we work for, including those we interview during a 555 Diagnostic.
- Suppliers and partners: people at companies we buy from or work alongside.
- Job applicants: anyone who sends us a CV.
3. What we collect and why
Website visitors
- What: technical information your browser sends when you visit, such as your IP address, browser type, the pages you view and the time of your visit.
- Why: to run the website, keep it secure and fix problems.
- Lawful basis: our legitimate interests in running a working, secure website.
We also count visits with Vercel Web Analytics. It shows which pages are viewed and roughly where visitors come from. It doesn't use cookies or store anything on your device, and it doesn't identify you.
With your consent only, we also use:
- Analytics (Google Analytics): how visitors use the site, so we can improve it.
- Company identification (Snitcher): identifies the company a visit comes from, using the visit's IP address. For example: "someone from a software firm in Reading looked at the 555 Diagnostic page". It's designed to identify organisations, not individuals. Where it does link a visit to a named business contact, we treat that as business prospect data (see below).
You choose whether to allow these in the cookie banner, and you can change your mind at any time. See our cookie policy.
People who contact us
- What: the details you give us, such as your name, work email, company, job title, phone number, team size and your message. If you take the sales check, we also keep your 25 answers and whether you'd like a call. If you book a call, we keep the booking details.
- Why:
- to reply to you, send what you asked for and prepare for any call;
- to keep a record of our conversations in our customer relationship system;
- to tell you about our services if you've shown an interest.
- Lawful basis: taking steps at your request before a possible contract, and our legitimate interests in responding to enquiries and developing our business.
Calls. Our calls take place on Microsoft Teams. We may record and transcribe them so we can focus on the conversation and keep an accurate record. We'll tell you at the start of the call. If you'd rather not be recorded, say so and we'll switch it off.
Business prospects
- What: business contact information. That means your name, job title, employer, work email address, work phone number, business location and professional profile. It also includes information about your company, such as size, sector, news, hiring and public announcements.
- Where we get it (if you haven't given it to us yourself):
- business data providers (such as Apollo.io);
- Companies House;
- your company's website and public news;
- public business directories and maps listings;
- public professional profiles;
- our website's company identification tool, where you've consented.
- Why: to identify companies we may be able to help, and to contact the right person there by email or professional networks about our services.
- Lawful basis: our legitimate interests in promoting our services to businesses. We've balanced this against your interests:
- we only contact people in roles relevant to what we offer;
- we keep messages relevant and infrequent;
- every email tells you how to opt out, and opting out is immediate.
Our email rules. We only send unsolicited marketing emails to corporate addresses, as the Privacy and Electronic Communications Regulations allow. We don't send them to sole traders or partnerships without consent. If you ask us to stop, we will. We'll keep your email address on a "do not contact" list so you're never contacted again.
Clients and their staff
What:
- contact details;
- contract and billing information;
- what you share with us while we work together.
During a 555 Diagnostic this includes interview recordings, transcripts and notes, plus the sales information your company provides, such as CRM exports. This may also include financial information your company chooses to share with us, such as management accounts or a sales analysis.
Why: to deliver the work we've agreed, invoice for it, and keep proper records.
Lawful basis: performing our contract with your company; our legitimate interests in delivering the work well; and our legal obligations, such as tax records.
When we handle your company's own data on its behalf, such as its CRM records, we act as your company's processor under a data processing agreement. Your company's privacy notice then applies to that data.
Suppliers and partners
- What: business contact details and our correspondence.
- Why: to manage our relationship.
- Lawful basis: our legitimate interests.
Job applicants
- What: your CV, covering letter and our notes.
- Why: to consider your application.
- Lawful basis: steps before a possible contract, and our legitimate interests in recruiting.
4. How we use AI
We use AI tools in our own work. For example, an AI model helps us:
- summarise an enquiry;
- prepare a brief before a call;
- draft parts of a report, which a person always checks before it goes to anyone.
The AI providers we use process this information on our behalf. They don't use it to train their models.
We don't make decisions about you based solely on automated processing that have legal or similarly significant effects on you.
5. Who we share it with
We never sell your personal information.
We share it only with service providers who help us run the business. They act on our instructions under contracts that require them to protect it.
| What they do | Provider |
|---|---|
| Website hosting and visit counting | Vercel |
| Customer relationship records | HubSpot (EU data centre) |
| Our internal system and database | Supabase |
| Email and calls | Microsoft 365 and Teams |
| Automated emails and alerts | Resend |
| Call booking | Calendly |
| Call recording and transcription | Fireflies.ai |
| AI processing | Anthropic |
| Prospect research and email checks | Apollo.io, MillionVerifier, Outscraper |
| Sending business emails | Instantly |
| Website analytics (with consent) | Google Analytics |
| Company identification (with consent) | Snitcher |
| Accounts | Xero |
We may also share information:
- with our professional advisers, such as accountants and lawyers;
- if the law requires it;
- with a buyer or investor if our business is sold or restructured, under strict confidentiality.
6. International transfers
Some of these providers are based in, or process data in, the United States or the European Union.
- EU: transfers are covered by the UK's adequacy regulations for the EU.
- United States: transfers rely on the UK–US Data Bridge, where the provider is certified. Otherwise they rely on the UK's International Data Transfer Agreement or the UK Addendum to the EU's standard contractual clauses.
Email us if you'd like more detail.
7. How long we keep it
| Information | How long |
|---|---|
| Enquiries and sales check results where we don't go on to work together | 2 years after our last contact |
| Business prospect records where you don't reply | 12 months after our last contact, then deleted |
| "Do not contact" list | Indefinitely, keeping only what we need to honour your request |
| Call recordings and transcripts (before any contract) | 12 months |
| Client records, contracts and invoices | 6 years after the work ends (for tax and legal reasons) |
| 555 Diagnostic interview recordings and transcripts | Deleted 12 months after the Diagnostic is delivered, unless your company asks us to keep them longer under its contract |
| Website analytics | 14 months |
| Job applications | 6 months after the role is filled, unless you agree we can keep your CV longer |
8. Your rights
You have the right to:
- access the personal information we hold about you;
- correct it if it's wrong;
- delete it, in some circumstances;
- restrict how we use it, in some circumstances;
- object to how we use it. You can always object to direct marketing, and we'll stop straight away;
- move information you gave us to another organisation, in some circumstances;
- withdraw your consent at any time, where we rely on it, for example for cookies.
To use any of these rights, email hello@makingaiwork.ai. We'll reply within one month. We may need to confirm who you are first. There's normally no charge.
9. Complaints
If you're unhappy with how we've handled your information, please tell us first. You can email hello@makingaiwork.ai or write to the address above. We'll acknowledge your complaint within 30 days, look into it properly, keep you updated, and tell you the outcome without undue delay.
You can also complain to the Information Commissioner's Office:
- Website: ico.org.uk
- Helpline: 0303 123 1113
10. Changes to this notice
We'll update this notice when our practices change. The date at the top shows when it was last updated.