Privacy Policy

1. Who we are

AI-WareHouse.net (“the Platform”) is a business-to-business directory and options-analysis service for AI tools, custom AI solution vendors and AI training providers. The data controller is Market Rounds Technologies Ltd, United Kingdom. Data protection contact: privacy@ai-warehouse.net.

2. The data we collect

a. Data you give us

• Account data — name, business email, company name, role, hashed password, two-factor authentication settings.
• Listing data — information vendors submit about their tools, services or training programmes, including logos, cover images, demo media and website addresses.
• Enquiry / lead data — when you request a demo, contact a vendor or use the AI match engine: your name, work email, company, role, industry, problem description, budget and timeline.
• Newsletter and alert subscriptions — email address, chosen topics and frequency.
• Payment data — for paid placements we receive a transaction reference, amount, currency and status from Stripe. We never see or store your full card number.

b. Data collected automatically

• Pages viewed, searches run, tools compared, clicks on vendor links, time on page, approximate location derived from IP, device and browser type.
• Security logs — sign-in attempts, IP address and timestamps, used to detect brute-force attacks.
• Email engagement. Our newsletter and vendor-outreach emails contain a 1×1 transparent tracking pixel and click-wrapped links. When you open one of those emails or click a link in it, we record the fact, the time, the link followed and your approximate location and device from the request. We use this only to measure which messages are useful and to stop emailing people who never engage. Service emails you must receive (verification codes, receipts, lead alerts, listing decisions) are also measured for delivery and open so we can prove a message reached you. You can stop all of it by blocking images in your mail client, using the one-click unsubscribe link in any marketing email, or emailing privacy@ai-warehouse.net.

We do not intentionally collect special category data (health, ethnicity, political opinions, biometrics) and ask you not to include such data in free-text fields.

3. Why we process it, and our lawful basis

• To operate your account and deliver the service — performance of a contract.
• To pass qualified enquiries to the vendor you selected — performance of a contract / legitimate interests. We tell you at the point of submission which vendor receives your enquiry.
• To secure the Platform (rate limiting, 2FA, fraud and abuse prevention) — legitimate interests and legal obligation.
• To send service emails (verification codes, lead alerts, listing decisions, receipts) — performance of a contract.
• To send marketing emails and newsletters — consent, or legitimate interests for business-to-business outreach to a company role address. Every marketing email carries a one-click unsubscribe link.
• To measure email opens and clicks (tracking pixel and click-wrapped links, described in section 2b) — legitimate interests in knowing which messages are useful, and consent where required. Engagement records are kept for 24 months.
• To measure and improve the Platform — consent for analytics cookies where required, otherwise legitimate interests using aggregated data.
• To meet accounting, tax and legal obligations — legal obligation.

4. AI processing

Our match engine, listing auto-fill and editorial tools use third-party large language models. When you use these features the text you submit (for example your problem description or a public website URL) is sent to the model provider to generate a response. We do not send your password, payment details or two-factor secrets to any model provider, and we instruct providers not to use the content to train their models. AI-generated recommendations are decision support only — they are not automated decisions with legal effect, and a human can always be involved by contacting us.

5. Who we share data with

• Vendors you choose to contact — they receive your enquiry and become an independent controller of that data under their own privacy policy.
• Processors acting on our instructions — cloud hosting and database providers, Resend (transactional and marketing email), Stripe (payments), Emergent (application hosting and managed object storage) and our LLM providers.
• Professional advisers, auditors, or authorities where we are legally required to disclose.
• A buyer or successor in the event of a merger, acquisition or restructuring, subject to this policy.

We never sell personal data, and we do not share it with data brokers or advertising networks.

6. International transfers

Some processors are located outside the UK/EEA (principally the United States). Where that happens we rely on UK International Data Transfer Agreements, the EU Standard Contractual Clauses, or an adequacy decision, together with technical safeguards such as encryption in transit.

7. How long we keep data

• Account and listing data — for as long as the account is active, then 12 months after closure.
• Enquiry / lead records — 24 months from submission, unless a longer period is required for a dispute.
• Marketing subscriptions — until you unsubscribe, then a suppression record is retained so we do not email you again.
• Analytics events — 25 months, after which they are aggregated irreversibly.
• Payment and invoice records — 7 years, to meet UK tax law.
• Security and sign-in logs — 12 months.

8. Your rights

Under the UK GDPR and EU GDPR you may request access to your data, correction, erasure, restriction, portability, or object to processing based on legitimate interests. You can withdraw consent for marketing at any time. Email privacy@ai-warehouse.net and we will respond within one month. You may also complain to the UK Information Commissioner’s Office (ico.org.uk) or your local supervisory authority.

9. Security

Passwords are stored as bcrypt hashes and are never recoverable in plain text. Two-factor authentication is available for every account and strongly recommended for vendor and administrator accounts. Traffic is encrypted with TLS, sign-in attempts are rate-limited, uploaded files are validated and re-served from our own domain, and access to production data is restricted to named personnel. No system is perfectly secure — please use a unique, strong password and keep your recovery codes safe.

10. Children

The Platform is intended for business users aged 18 or over. We do not knowingly collect data from children.

11. Changes

We will update this page and revise the “Last updated” date when this policy changes. Material changes affecting your rights will be notified by email to account holders.