How we handle your data

INTELLIKON AI LTD (Company No. 16713444) Ebenezer House, 41 Clarence Street, Southend-On-Sea, England, SS1 1BH is the Data Controller for personal data processed through intellikon.ai and studio.intellikon.ai. INTELLIKON AI LTD is registered with the UK Information Commissioner's Office under registration number ZC064584.

INTELLIKON AI LLC (Company No. 10527367) 8 The Green, STE A, Dover, Delaware 19901 is our US contracting entity. Where you contract with INTELLIKON AI LLC, your personal data is shared with INTELLIKON AI LTD and processed as described in this policy.

Data Protection & Privacy Contact: info@intellikon.ai

A. Information You Provide Directly

• Contact & Communication Data: Name, business email address, job title, company name, phone number, and any details submitted via contact forms, product enquiries, or waitlist requests.
• Account & Profile Data: Login credentials, hashed passwords, multi-factor authentication settings, role-based access information, and settings used to access Intellikon AI Studio.
• Transaction Data: Details required to process paid services, billing addresses, payment methods, and transaction histories.
• Customer Content & AI Model Inputs: Technical data, schematics, prompt parameters, and inputs provided to our AI platforms, workflow components (e.g. NUCLEUS, AEGIS, VERA, PULSE, LEXIS, PRISM), or extraction pipelines.
• Google User Data (Gmail): If you choose to connect a Gmail account to Pulse, we access your Gmail only as described in Section 13.

B. Information Automatically Collected

• Device & Usage Technical Data: IP address, browser type, operating system, unique device identifiers, referrer URLs, session interaction metrics, and logs.
• Cookies & Similar Technologies: Strictly necessary session cookies used to secure logins and preserve platform state, and cookieless website analytics. See Section 9.

C. Data We Do Not Seek

We do not seek to collect special category data — data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation — nor data relating to criminal convictions or offences. Please do not submit such data into our platforms unless agreed with us in writing in advance.

Under the UK / EU GDPR, we rely on the following legal bases:

Where we rely on legitimate interests, we have assessed whether those interests are overridden by your rights, and you may object at any time. Where we rely on consent, you may withdraw it at any time without affecting processing already carried out.

We do not sell, rent, or trade your personal information. We share data only in the following circumstances:

• Authorised Technology Partners: Where a customer requests integrated third-party services, the account and registration data necessary to provision those services may be shared with the relevant provider.
• Third-Party Cloud, Infrastructure & AI Providers: We use a defined set of sub-processors under data processing agreements — Website hosting: Framer; Application hosting: Vercel and Railway; AI providers: Anthropic, OpenAI and Google; Translation: Emotii; Transactional email: Resend. A current sub-processor list is available on request at info@intellikon.ai. Data received from your Gmail account is shared with these providers only as described in Section 13.
• Professional Advisers: Accountants, auditors, legal advisers, insurers and bankers, under duties of confidentiality.
• Legal Requirements: Where required to comply with law enforcement requests, court orders or regulatory obligations, or to protect the rights, property and safety of Intellikon AI or others.
• Corporate Transactions: In the event of a merger, acquisition, reorganisation or sale of assets, data may transfer as part of standard business assets under confidentiality agreements.

Intellikon AI employs technical and organisational security controls appropriate to the risk:

• Encryption: Data in transit is encrypted using modern TLS protocols (HTTPS); data at rest is secured with industry-standard AES-256 encryption.
• Access Controls: Role-Based Access Control (RBAC), multi-factor authentication (MFA), tenant isolation enforced at the database layer, and least-privilege staff access.
• Governance: Platform prompt management and quality gating (via NUCLEUS) to safeguard operational workflows.

No system is completely secure and we cannot guarantee the security of data transmitted over the internet. Where a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours as required, and notify affected individuals where the risk is high.

As a dual-entity UK and US company, personal data may be accessed or processed across jurisdictions. When transferring personal data outside the UK or the European Economic Area, we apply compliant safeguards:

• Standard Contractual Clauses (SCCs) approved by the European Commission.
• UK International Data Transfer Agreements (IDTA) or the UK Addendum, supported by a transfer risk assessment.
• Enterprise deployment options such as isolated region cloud hosting or local infrastructure.

You may request details of the safeguards applied to a specific transfer using the contact details below.

We retain personal data only as long as necessary for the purposes it was collected for, including satisfying legal, accounting or reporting requirements:

• Account Data: Retained for the active duration of your contract or account, then deleted or anonymised within 90 days of termination.
• Transaction & Licensing Records: Retained for up to 7 years in compliance with UK and US tax and corporate regulations.
• Technical Logs & Security Audits: Retained typically between 30 and 180 days before automated deletion or aggregation.
• Contact Form, Waitlist & Enquiry Data: Retained for 24 months from last contact.
• Marketing Contact Data: Retained until you unsubscribe, or after 24 months of no engagement.
• Gmail Data: Access tokens, and the mailbox observations and cached translations stored from your mailbox, are deleted when you disconnect Gmail. Reply text saved on a campaign remains part of that campaign until your workspace deletes it or you ask us to delete it. See Section 13.
• Backups: Deleted data may persist in encrypted backups for up to 30 days before rotating out.

Where applicable data protection law grants them, you have the following rights over your personal data:

• Right to Access / Know: Request a copy of the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal data, subject to legal retention obligations.
• Right to Restrict or Object: Object to our reliance on legitimate interests, or request restriction of processing.
• Right to Data Portability: Request transfer of your data to another controller in a structured, machine-readable format.
• Right to Opt Out of Direct Marketing: Unsubscribe at any time using the link in our communications or by contacting us.
• Right to Withdraw Consent: Where we rely on your consent, you may withdraw it at any time without affecting processing already carried out. You can withdraw access to your Gmail account at any time by disconnecting it in Pulse, or by removing Intellikon AI's access in your Google Account (see Section 13).

To exercise any of these rights, contact info@intellikon.ai. We will respond within one month. We may extend this by up to two further months for complex requests. We may need to verify your identity before acting. There is no fee unless a request is manifestly unfounded or excessive.

We use only cookies that are strictly necessary to deliver our services. These keep you signed in to Intellikon AI Studio, preserve your workspace state, and protect against cross-site request forgery. They are set without consent because the service cannot function without them, and they are not used to profile you or track you across other websites.

Our website analytics are provided by Framer, which does not set cookies or create persistent identifiers. Framer measures visits by hashing IP address and browser user agent against a secret that rotates and is deleted daily.

We do not use advertising, marketing or cross-site tracking cookies. Because of this, we do not currently operate a cookie consent banner. If we later introduce cookies that require consent, we will deploy a banner that blocks them until you opt in, and we will update this policy first. Full detail is in our Cookie Policy.

Our website may contain references and links to third-party platforms. We are not responsible for the privacy practices or content of third-party websites. We encourage you to review their respective privacy statements when leaving our platform.

Our services are business tools and are not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact info@intellikon.ai and we will delete it.

We may update this Privacy Policy periodically to reflect technological changes, product updates, or legal amendments. Updates will be published on this page with a revised "Last Updated" date. Where a change is significant, we will notify account holders by email or through the services before it takes effect.

This section applies if you connect a Google account to Pulse, our outreach tool in Intellikon AI Studio. Connecting is optional and is done by you, from your own account.

What we access

• Sending (gmail.send): requested when you connect Gmail. It lets Pulse send the emails you write — campaign messages, one-to-one drafts, replies written in the Pulse Inbox, and the follow-up steps of sequences you set up — from your own Gmail address, so that they appear in your Sent folder and your conversation threads. We also receive your Google account email address (openid and userinfo.email) to identify the connection.
• Reply detection (gmail.readonly): optional, and requested separately when you click Enable reply detection. It lets Pulse read the conversation threads of campaign emails it sent in the last 14 days to detect replies, and read the sender, recipients, subject and a short snippet of new messages in your mailbox so that mail to or from your CRM contacts can be shown to you. We keep only mail to or from your contacts.

What we store

Your Google account email address; encrypted access and refresh tokens; the text of the newest reply to a campaign email we sent (up to 5,000 characters); and, for mail to or from your contacts, the sender, recipients, subject, a snippet of up to 200 characters, and message identifiers. We do not store attachments, and we do not modify, delete or move any message in your mailbox.

How we use it

Only to provide the features described above that you can see in Pulse: sending the emails you write, and showing you replies to your campaigns. We do not use Gmail data for advertising, we do not sell it, and we do not use it to develop, improve or train generalised AI or machine-learning models. People at Intellikon AI do not read your mail except with your consent, where needed for security or to give support you have requested, or where the law requires.

Who it is shared with

Only to provide a feature you use. Reply text is sent to our translation provider (Emotii) when you click Translate. A short extract of recent emails with a contact (the subject, sender, date and a snippet of up to five messages) is sent to our AI provider (Anthropic) when a draft response is generated, either at your request or by an automated action in Prism in your workspace. These providers process the data on our behalf under contracts that do not permit them to use it to train their models.

Who can see it in your workspace

Stored replies and message snippets are visible to members of your workspace who have access to the Pulse Inbox or campaign replies, and to administrators of your workspace, according to the permissions your workspace sets.

How long we keep it, and how to disconnect

You can disconnect Gmail at any time in Pulse (Profile, Connected Accounts, Disconnect). Disconnecting revokes Intellikon AI's access in your Google account, deletes the stored access tokens, and deletes the mailbox observations and cached translations stored from your mailbox. Reply text saved on a campaign remains part of that campaign until your workspace deletes it, and you can ask us to delete it at info@intellikon.ai. You can also remove Intellikon AI's access directly in your Google Account under Security, then Third-party access, at myaccount.google.com.

Google API Services User Data Policy

Intellikon AI's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact: