Privacy Policy

1. Who We Are

Thinking ForWord Ltd is a UK-based provider of AI assistant solutions for organisations. We build AI chatbots, staff knowledge hubs, and learning platforms trained on your approved content.

For data protection purposes, Colin Rodgers is the designated Data Controller for data we control. For client deployments, we act as a Data Processor under the client’s instructions and data processing agreement.

2. What Personal Data We Collect

2.1 Data You Provide to Us

• Account Information: Name, email address, phone number, organisation name, and any registration details you provide.
• Payment Information: Billing name, address, and payment card or transaction data (processed via third-party payment gateways — we do not store card details).
• Communications: Emails, contact forms, and support requests.

2.2 Data Collected Automatically

• Cookies & Tracking Technologies: IP address, browser type, device ID, operating system, referral links, and usage timestamps. See our Cookie Policy for details.
• Usage Data: Pages visited, navigation paths, and time spent using services.
• Chatbot Interactions: Chat content is processed in-session only to generate responses. It is not stored by default. If you choose to email or download a transcript, we process that action to fulfil your request.

3. How We Use Your Personal Data

We use your data to:

• Deliver and personalise our services
• Respond to support requests and enquiries
• Manage billing, payments, and subscription status
• Monitor technical functionality and security of our services
• Send service-related emails or updates (and marketing emails only with your consent)
• Understand anonymised, high-level usage patterns to improve our products

4. Chatbot Data

Our AI assistants use OpenAI’s platform to process conversations. Here is how chatbot data is handled:

• No chat data is stored by default. Conversations are session-based and not retained after the session ends.
• No data is used for AI model training. Neither we nor our AI infrastructure providers use your chat content to train or improve AI models.
• If you choose to email or download a transcript, that copy is processed to fulfil your request and retained only as necessary for delivery and audit purposes.
• If a client opts in to chat storage for analytics or quality purposes, this is agreed in a separate data processing agreement with specific retention terms.

You may withdraw consent for chatbot data processing at any time by contacting us at info@thinkingforword.com.

5. Legal Basis for Processing (UK GDPR)

We process your personal data based on:

• Performance of a Contract — providing services you have requested
• Consent — for marketing communications and where required for certain cookies
• Legal Obligation — complying with tax, accounting, or legal requirements
• Legitimate Interest — keeping services secure, fixing issues, and understanding high-level usage patterns (balanced against your rights)

6. Who We Share Your Data With

We only share your data when necessary:

• Carefully selected third-party service providers (e.g., payment processors, UK-based hosting providers, AI infrastructure providers)
• Legal or regulatory authorities, if required by law

We do not sell or trade your personal data. Each provider is under contract with appropriate data protection terms. A current list of sub-processors is available on request.

External links to third-party websites are governed by their own privacy policies.

7. Data Security

We implement appropriate technical and organisational measures, including:

• UK data residency by default for document hosting
• Encryption in transit (HTTPS/TLS) and at rest for applicable systems
• Access controls, audit trails, and least-privilege practices
• Two-factor authentication on administrative systems

No system is 100% secure, but we actively monitor and respond to any potential vulnerabilities.

8. Data Retention

• Account Data: Kept as long as your account is active or as required for legal/accounting purposes
• Chatbot Data: Session-based and not stored by default. If a client opts in to chat storage, retention periods are agreed in the data processing agreement
• Marketing Data: Retained until you opt out
• Payment Data: Retained according to UK tax law (usually 6 years)

9. Your Rights Under UK GDPR

You have the right to:

• Access — get a copy of your data
• Rectification — correct any inaccurate data
• Erasure — request deletion (where applicable)
• Restriction — limit how your data is used
• Portability — receive your data in a common format
• Object — object to processing, including profiling or direct marketing
• Withdraw Consent — at any time, for marketing emails or other consent-based processing

To exercise your rights, contact: info@thinkingforword.com

We will respond within 30 days in accordance with UK GDPR.

10. International Transfers

If personal data is transferred outside the UK or EEA (for example, through AI infrastructure providers), we ensure appropriate safeguards, such as:

• UK IDTA or UK-approved Standard Contractual Clauses (SCCs)
• Additional measures where appropriate

11. Cookies & Tracking

We use cookies to improve site performance and personalise your experience. You may manage or block cookies through your browser settings. For more, see our Cookie Policy.

12. Data Breach Notification

In the event of a breach that may affect your personal data, we will notify you and relevant supervisory authorities without undue delay, as required by law.

13. Children

Our services are designed for organisations and adult users. If you believe a child has provided personal data to us, contact us so we can act promptly.

14. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in law or our services. Significant changes will be signposted. Any changes will be posted on this page with the revised date.

15. Contact & Complaints

You may also lodge a complaint with the Information Commissioner’s Office (ICO): https://ico.org.uk