Privacy notice

Draft – pending legal review. This page describes intended practice and is not legal advice.

Who we are

Koralis AI Limited (company number 16558134) is the controller of the details you send us.

What we collect

When you submit an enquiry form we collect exactly these details: your name, work email, and – where you provide them – your company, role, company size and message. We also record which enquiry type you selected, which page you submitted from and, if one of our team pages sent you to the form, which team page it was, so we can answer in context. If you came from one of our campaign links, we record its tags (source, medium, campaign and content), which travel in the page address, not on your device. Nothing else is collected. The form has one hidden anti-spam field that people never see; a submission that fills it is discarded.

We use your details for the enquiry you chose: to book a free Scoping Review, to answer a question about the policy dry run, a walkthrough, a Proof Pilot or a Quick-Start, to answer a general enquiry or one from a partner or investor, or to add you to our update list.

Who receives it

Your enquiry is kept on a server we rent from Hetzner, a hosting provider, in Helsinki, Finland. That server holds the enquiry store, a daily snapshot of it, and the web server’s logs, which record visitors’ IP addresses.

Each enquiry is also emailed to the Koralis founders through Resend, an email delivery provider, using its own delivery infrastructure. It arrives in a mailbox on Google Workspace, provided by Google LLC, where the founders read it. Email you send to hello@koralis.ai or enquiries@koralis.ai – which the refusal test on our pilot page opens in your own email – is held on Google Workspace too.

Hetzner, Resend and Google are the only third parties that receive your enquiry. Plausible, below, learns only that an enquiry was sent and its type. Enquiries are not entered into any CRM, and we use no marketing platform.

None of these recipients is in the UK. Where each one puts your data, and on what basis:

• Hetzner – in the EU (Finland). The UK recognises the EU/EEA as providing adequate protection, so no further safeguard is needed.
• Resend – stores your enquiry in the EU (Ireland), under the same adequacy. Resend is a US company, so its staff can access it in the course of providing the service. For that we rely on Resend’s certification under the UK Extension to the EU–US Data Privacy Framework. Its listing is currently marked as under re-certification review, so we note too that Resend’s data processing agreement incorporates the EU Standard Contractual Clauses with the UK Addendum.
• Google Workspace – Google LLC is a US company. We rely on its certification under the UK Extension to the EU–US Data Privacy Framework.

We would rather say all of that plainly than let “held in the UK/EU” imply something stronger.

The site also supports a webhook to a system we operate. It is switched off and has never received an enquiry. We name it so that switching it on is a change you can see here, rather than one you cannot.

Analytics

We use Plausible Analytics to understand how the site is used, in aggregate. It sets no cookies and stores nothing on your device. For each page you view it records the page address, the site that referred you, your browser, operating system and device type, how long you stayed, and your approximate location (country, region and city).

Your IP address is used to work out that location and to count unique visitors, then discarded – it is not stored. The count uses an identifier that is regenerated every 24 hours, so a visit today cannot be linked to one tomorrow. When you send an enquiry, Plausible also records that one was sent and its enquiry type, and nothing else – never your name, email or message.

When you click one of the team cards on our home page, or the button to book a Scoping Review on one of our team pages, Plausible also records that click and which team it was for, by a short name such as “finance”. It is recorded with the same details as a page view, above. The team is the only thing added – never your name, email or anything you type.

Plausible is an Estonian company. It processes this data in the EU, on infrastructure owned by European companies, under a data processing agreement. The data does not leave the EU, which the UK recognises as providing adequate protection. We rely on our legitimate interest in knowing which pages are useful. We do not build advertising profiles or sell data.

Lawful basis & retention

We rely on our legitimate interest in replying to an enquiry you chose to send us. The one exception is the update list: if you ask to join it, that is consent, and you can withdraw it at any time by replying to any message or writing to us.

We keep an enquiry for 24 months from our last exchange with you, then delete it. Two years because the conversations this site starts often take that long – an evaluation that stalls can restart much later, and we would rather still have the context than ask you to explain yourself twice. If an enquiry goes nowhere, the clock runs from the last thing either of us said.

On our own server that deletion is automatic. In our email, it is a review we carry out at least annually rather than something that happens on a particular day – we would rather describe that accurately than claim a precision we do not have. You can ask us to delete an enquiry sooner at any time, and we will.

We also keep backups of an enquiry: a daily snapshot on the same server, and a copy held off it. Both are ours and both stay in the UK/EU – no third-party backup service holds your enquiry. Backups expire on the same 24-month clock, so restoring one cannot bring back something we told you we had deleted.

Delivery failures are recorded in our server log, which is kept for 30 days.

If we contacted you first

We sometimes contact people whose work suggests our product could help their organisation, usually with a LinkedIn connection request or message, or by email. If we contacted you that way, this section is for you.

What we hold. Your name, your job title and employer, and your work contact details where they are published; when and how we contacted you; and what you replied.

Where it came from. Your employer’s own website, Companies House, official publications such as government websites, published news about your organisation, and your public LinkedIn profile. We do not buy contact lists or use data brokers.

Why, and on what basis. To tell you about our work and ask whether it is relevant to you or your organisation. We rely on our legitimate interest in finding the organisations our product could help. We contact you in your work role, about your work: a first message, at most two more, and none after you ask us to stop.

Who holds it. The messages themselves are held by LinkedIn, where we send them, and, if you reply by email, by Google Workspace, as above. Our own planning records hold your organisation and job title, and may hold your name. They are kept with GitLab, a US company, and we rely on its certification under the UK Extension to the EU–US Data Privacy Framework.

We plan this work with the help of an AI assistant, Claude, provided by Anthropic. It may see your name, job title and employer, and our notes about contacting you – never anything beyond your work role. For the account we use, Anthropic acts on its own behalf, not as our supplier: Anthropic Ireland, Limited is responsible for that information under Anthropic’s own privacy terms, stores it in the US, and relies on standard contractual clauses for transfers outside the UK and EEA. We have switched off the use of our conversations to train Anthropic’s models.

How long. If no conversation follows, we delete our record of contacting you 12 months after our last message. If a conversation does follow, it is kept like an enquiry, for 24 months from our last exchange. If you ask us not to contact you again, we keep only your name and organisation on a do-not-contact list, so that we don’t.

Your right to object. You can tell us to stop contacting you at any time, by replying to our message or by writing to us at the address below, and we will stop. You do not need to give a reason.

Your rights

You can ask us to access, correct or delete your data, or to stop contacting you, at any time by emailing enquiries@koralis.ai, which reaches both founders.

If you ask us to delete your data, we delete it. So that we never add you again by mistake, we keep only a coded fingerprint of your name and nothing else about you. It cannot be turned back into your name; it only lets us recognise your name if it comes up again, so that we can leave it out.

You can also complain to the Information Commissioner’s Office (ico.org.uk).