Privacy Policy &
Data Protection.

1. Who we are and how to reach us

Depending on your location and the contracting entity, the data controller for the personal data described in sections 4 to 6 is:

• Discovery AI Limited, incorporated in England and Wales (Company No. 17032815), 167-169 Great Portland Street, London, England, W1W 5PF, United Kingdom.
• ReDscvry Technology Private Limited, incorporated in India (CIN U63111TS2024PTC183007), SY:11 WeWork Krishe Emerald, Kondapur Main Road, Laxmi Cyber City, Whitefields, Serilingampally Mandal, Ranga Reddy District, Hyderabad, Telangana 500081, India.

When we process your organisation’s data under a contract (an MSA, DPA or statement of work), we act as your data processor and the contract governs that processing.

• Privacy contact: privacy@dscvryai.com, for every privacy question and data subject request.
• Data Protection Officer: Sharad Bapat, reachable at the same address.
• EU representative (GDPR Article 27): James Stevenson, EU Managing Director, reachable at the same address.

2. Zero Model Training Guarantee

We never train foundation or public models on customer data. Any documents, source code, financial records, engineering telemetry, or prompts processed through Structurify, Clarify, Grid, or our domain models are strictly isolated to your designated tenant or on-premise boundary. Your intellectual property and confidential operational records are never pooled or used to improve global multi-tenant weights.

3. Compliance with International Privacy Regulations

Our operational procedures and systems are built around these frameworks:

• General Data Protection Regulation (EU GDPR) and UK Data Protection Act 2018 (UK GDPR): Lawful processing under Article 6 and Article 28 (Data Processor), with standard contractual clauses (SCCs) governing cross-border transfers. Independently assessed against the EU GDPR in 2026.
• Digital Personal Data Protection Act 2023 (India DPDP): Rigorous consent frameworks, purpose limitation, and sovereign data localization support.
• SOC 2 Type II & ISO/IEC 27001:2022: A SOC 2 Type II report from an independent auditor covers the Security, Availability and Confidentiality trust service criteria, and our information security management system is certified to ISO/IEC 27001:2022. Certificates and audit reports are available on request, under NDA. Our Data Processing Agreement sets out the terms that apply when we process personal data for a customer.

4. What we collect through this website, and why

The contact form. Your name, email address, topic and message, and your company if you give it. We also record the page you sent it from. We use this to read your message and reply. Basis: our legitimate interest in answering people who write to us (UK and EU GDPR Article 6(1)(f)), or steps you asked us to take before a contract (Article 6(1)(b)) when you are asking about working with us.

The Resolve evaluation form. Your name, work email, company, role, country, deployment target, which Resolve offer you are interested in, the decisions you would like to evaluate, and whether you ticked “Send me occasional product updates”. We use this to review your request and reply. Basis: steps you asked us to take before entering into an agreement (Article 6(1)(b)). Product updates are sent only with your consent (Article 6(1)(a)), which you can withdraw at any time.

Recorded automatically when you send either form.

• A salted hash of your IP address, used to limit how many messages one network can send. We never store the IP address itself.
• Your browser’s user agent, cut to 512 characters, and the date and time of the request.
• Location and network details that Cloudflare attaches to every request: country, region, city, continent, time zone, network operator and number, the Cloudflare data centre that served you, the HTTP protocol and TLS version, and whether the country is in the EU. We do not store postal code, latitude, longitude or metro area.
• Whether your email address is on a public webmail domain. We flag these; we do not block them.

Basis: our legitimate interest in keeping the forms secure and free of abuse (Article 6(1)(f)). For the Resolve form we also use the country and network details to plan support and deployment regions, on the same basis.

The bot check. Both forms use Cloudflare Turnstile to tell people from automated scripts. Turnstile processes signals from your browser and device, described in Cloudflare’s Turnstile privacy addendum. We receive only a pass or fail result.

Reading pages. Cloudflare, which hosts this website, processes standard request data (such as IP address and user agent) to deliver pages and defend them against attacks. We do not use that data for profiling.

Page views. To see which pages are read, each page sends one request to an analytics service we run, with the page title, its address and any section after the # sign. The service saves that with the standard details Cloudflare supplies with every request, such as your IP address, browser, country and city, and the time, in a spreadsheet in Google Workspace. It sets no cookie and stores nothing in your browser. Cloudflare Web Analytics, provided by our hosting provider, also measures page views and page speed without cookies, and we see only the aggregated results. Basis: our legitimate interest in understanding how the website is used (Article 6(1)(f)); you can object (section 11), and blocking these requests in your browser does not affect the site.

Email you send us. If you write to one of our addresses, we keep the message and our reply so we can follow up. Basis: legitimate interest (Article 6(1)(f)).

We do not sell personal data. We do not make decisions about you by automated means that have legal or similarly significant effects: a person on our team reads every message and request.

5. Cookies and similar technologies

This website does not use advertising, marketing or cross-site tracking cookies, and does not load third-party trackers. It counts page views with a cookie-free request to our own analytics service (section 4). We do not show a cookie banner because we set nothing that needs consent.

• Strictly necessary, set by our site: your browser keeps two small items for the site to work. One remembers that you closed the announcement bar, so it does not reappear (local storage, until you clear it). The other lets a menu link open the right tab on the page you arrive at (session storage, cleared when you close the tab). Neither is sent to us.
• Strictly necessary, set by our hosting provider: Cloudflare may set security cookies or use similar storage to protect the site and to run the Turnstile bot check on our forms.

You can block or delete cookies and site storage in your browser settings; the site works without them. If we ever add analytics cookies or other optional technologies, we will ask for your consent first and update this section. See our Cookie Policy for the full list.

6. Customer data

Documents, text, datasets and configuration you process through our products and engagements are handled under your contract, in your environment or tenant, with access limited to the people working on your engagement. They are not used to train models for anyone else (section 2). When your engagement ends, we return or delete them as the contract provides.

7. Who we share personal data with

• Cloudflare hosts this website, stores the contact and Resolve form records in its D1 database (jurisdiction: European Union), and runs the Turnstile bot check. Cloudflare acts as our processor.
• Microsoft (Microsoft 365) delivers each form message to our own mailboxes and hosts our email. Microsoft acts as our processor.
• Google (Google Workspace) hosts the spreadsheet that holds the page-view log. Google acts as our processor.
• Group companies. Discovery AI Limited and ReDscvry Technology Private Limited share the data above to answer you and run engagements.
• Professional advisers and authorities, only where the law requires it or to establish, exercise or defend legal claims.

We do not share personal data for advertising.

8. International transfers

We are based in the United Kingdom and India, and our providers run global networks, so personal data may be processed outside the country where you are. Form records are stored in the European Union. Where UK or EU personal data is transferred to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses (Commission Implementing Decision 2021/914), the UK International Data Transfer Addendum, or an adequacy decision or framework (such as the EU-US Data Privacy Framework) in our providers’ data processing terms.

9. How long we keep it

• Contact messages and Resolve requests: 730 days (two years) from the day you sent them, then deleted automatically. Copies in our mailboxes are deleted by hand at the same time.
• Declined or spam requests: the user agent and request details are removed after 30 days; the rest is deleted at 730 days.
• Product update consent: until you withdraw it.
• Page-view records: 6 months from the visit, then deleted.
• Customer data: as your contract provides.

We keep records longer only where the law requires it or to deal with a legal claim.

10. Security

Our information security management system is certified to ISO/IEC 27001:2022 and independently audited to SOC 2 Type II. Data is encrypted in transit with TLS, form records are stored in a database with restricted access, IP addresses on form records are kept only as salted hashes, and access to the mailboxes that receive form messages is limited to the people who answer them. See Security & trust.

11. Your rights and how to use them

Depending on where you live, you can ask us to:

• give you a copy of the personal data we hold about you;
• correct it, or delete it;
• restrict how we use it, or object to use based on our legitimate interests;
• give it to you in a portable format;
• stop sending product updates, and withdraw any consent you gave, at any time. Withdrawing does not affect what we did before.

Write to privacy@dscvryai.com. We acknowledge a request within five business days and answer within one month. You can also complain to your data protection authority: in the UK, the Information Commissioner’s Office (ico.org.uk); in the EU, the authority in your country; in India, the Data Protection Board of India. We would welcome the chance to put things right first.

12. Children

Our website and products are for businesses and are not directed at children. We do not knowingly collect personal data from anyone under 16.

13. Changes to this policy

We will change the effective date above when we update this policy. If a change materially affects how we use personal data you already gave us, we will tell you by email.