1.Who we are
This policy explains how Customiser AI Ltd, a company registered in England and Wales under company number 16814294, with its registered office at 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom ("Customiser", "we", "us"), handles personal data when you use our website (customiser.ai), our estimating and quoting software (app.customiser.ai, the "Service"), or contact us.
- We are the controller of personal data about our users, website visitors and business contacts: account details, billing, support and usage.
- We are a processor for personal data that our customers put into the Service as part of their content, such as contact details of their own customers or names printed on drawings. We process it only on our customer's instructions. If your data is in a customer's account, please contact that customer first.
Contact for anything in this policy: team@customiser.ai.
2.What we collect
- Account details: your name, email address, organisation name, role and sign-in information. We store your password only as a secure one-way hash, so no one at Customiser can read it.
- Your content: the documents you upload (drawings, bills of materials, specifications, requests for quotation, emails) and what the Service produces from them. This includes customer and supplier records you create, which can contain names, job titles, email addresses and phone numbers.
- Billing information: credit purchases, invoices and receipts. Card details are collected and held by our payment processor, not by us.
- Usage and credits: which features you use, the pages read and AI processing performed for each job, and the credits used.
- Support and feedback: messages you send us and, to help us answer, the page, job and app version you were on when you sent them.
- Technical data: IP address, browser and device information, logs and error reports, used to run and secure the website and the Service.
- Demo bookings: if you book a demo through the calendar on customiser.ai, your name, position, company, company email, country, phone number, industry, message and time zone, and any guests you add. The calendar is run by Cal.com, which passes the booking to us.
- Website forms: what you send through the forms on customiser.ai. That is your name, role, company, work email, country, phone number, industry and message if you request a demo; and, if you introduce a company through our referral programme, your name and email and the name, role, phone number and company of the person you introduce.
3.How we use it and our legal bases
- To provide the Service, run your account and process purchases (performance of our contract with you or your organisation).
- To keep the Service secure, prevent abuse and fix errors (our legitimate interests in running a safe, reliable service).
- To answer support requests and send service messages, such as receipts, security notices and notices of changes to our terms (contract and legitimate interests).
- To answer enquiries and demo requests sent through our website, to schedule and hold the demo calls you book, and to run our referral programme (our legitimate interests in responding to and building business relationships).
- To understand how the Service is used and improve it, using aggregated measurements that do not reveal your content (legitimate interests).
- To send product news, only where you have agreed or where the law otherwise allows; you can unsubscribe at any time (consent or legitimate interests).
- To meet our legal obligations, such as tax records and responding to lawful requests (legal obligation).
We do not sell personal data. We do not use your content for advertising, and we do not use your content to train artificial intelligence models.
If you introduce someone through our referral programme, please make sure they are happy for us to contact them. When we first get in touch, we tell them how we got their details.
4.How AI features handle your data
- When a task needs AI, we send the parts of your documents that the task requires (extracted text, and for scanned pages, page images) to our AI provider, Anthropic, and receive the result.
- Anthropic does not use this data to train its models, and handles it under its commercial terms.
- We keep a record of each AI step (the request, the result and a summary of the reasoning) for 90 days, so the Service can show why it suggested something and we can fix problems. The resulting suggestions and decisions stay with the job until the job is deleted.
- Our staff only look at these records to support you when you ask or allow us to, or where needed for security.
- Documents carrying export-control markings are held back from AI processing until an owner of the organisation reviews them.
6.International transfers
Our providers store and process data mainly in the United States. When we transfer personal data from the United Kingdom or the European Economic Area, we rely on the UK International Data Transfer Addendum and the European Commission's Standard Contractual Clauses, or on the provider's certification under the Data Privacy Framework, where applicable.
7.How long we keep data
- Your content and jobs: until you delete the job or your organisation's account. Owners can also set a shorter retention period for documents in Settings.
- When an organisation's account is closed: we keep its data for 30 days in case the closure was a mistake, then permanently delete its database records and files.
- AI step records: 90 days.
- Account details: while the account is active, then deleted with the organisation.
- Audit logs of important actions (for example who approved a quote): kept for security and accountability. Customer and company names in them are stored only as irreversible codes.
- Billing records: for as long as tax law requires (currently six years in the UK).
- Support messages: 24 months.
- Website enquiries, demo bookings and referrals: 24 months from our last contact, unless they lead to a customer relationship.
- Technical logs and error reports: up to 90 days.
- Backups: deleted data can remain in our providers' backups for up to 30 days before it is overwritten.
8.Security
- Data is encrypted in transit (TLS) and encrypted at rest by our hosting providers.
- Each organisation's data is separated by access rules enforced in the database itself, so one organisation cannot read another's data even if an application query is wrong.
- Access is limited by role, and important actions are recorded in an audit log.
No system is completely secure. If a breach affects your personal data, we will notify you and the relevant authorities as the law requires.
9.Your rights
Depending on where you live, you may have the right to access your personal data, correct it, delete it, restrict or object to our use of it, receive a copy in a portable format, and withdraw consent at any time. California residents have the right to know what we collect, to delete it, and not to be discriminated against for using these rights; we do not sell or share personal data for cross-context behavioural advertising.
To use your rights, email team@customiser.ai. We will reply within 30 days. For personal data in a customer's account (where we are a processor), we will pass your request to that customer and help them answer it.
11.Children
The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children.
12.Changes to this policy
We will post any changes on this page and update the date above. If a change is significant, we will also tell organisation owners by email or in the Service.
13.Contact and complaints
Email team@customiser.ai, or write to Customiser AI Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom. If you are not satisfied with our answer, you can complain to your data protection authority. In the UK, that is the Information Commissioner's Office (ico.org.uk).
