Privacy Policy
Effective date: 10 March 2026 · Newsletter section added: 11 September 2026 · Paid subscribers section added and followers wording updated: 19 September 2026 · Data-handling and analytics wording corrected: 6 October 2026 · LLM data-handling wording corrected: 8 October 2026 · Images statement added: 9 October 2026 · LLM wording clarified: 12 October 2026 · Approved by: Ben Todd
1. Who we are
Arcola AI Limited ("we", "us", "our") operates the AI incident monitoring platform at platform.arcolaai.com.
| Company | Arcola AI Limited |
| Company number | 16964635 (England & Wales) |
| Registered address | Fleur Cottage, Owletts Farm, Ashurstwood, East Grinstead, RH19 3SL, United Kingdom |
| Directors | Ben Todd, Simon Mylius |
| Data Protection Lead | Ben Todd |
| Contact | data@arcolaai.com |
| ICO registration | ZC169991 |
2. What our platform does
We provide an AI-powered monitoring platform for AI safety. The platform:
- Ingests publicly available information about AI incidents from news articles, regulatory notices, academic papers, court judgments, and social media
- Uses large language model (LLM) classification to identify, categorise, and assess AI incidents
- Provides a dashboard and API for organisations to monitor AI incidents relevant to their domain
We monitor incidents, not individuals. The platform indexes by incident, not by person - we do not build profiles or dossiers on individuals.
3. Personal data we collect
From dashboard users (our customers)
| Data | Source | Purpose |
|---|---|---|
| Name, email, organisation | Account registration | Providing the service |
| API keys | Self-generated | Programmatic access |
| Email address | Transactional email system | Authentication and notifications |
From people who follow us by email
If you ask to follow Arcola AI by email we create a subscriber account for you. We only add you after you confirm your address by clicking the link in the confirmation email (double opt-in). We send occasional news and word of new briefings and products; there is no fixed schedule.
| Data | Source | Purpose |
|---|---|---|
| Email address (name optional) | The sign-up form, confirmed by double opt-in | Sending you the email updates you asked for |
| Consent record: when you subscribed, the exact wording you agreed to (by version), the confirmation you clicked, and when you unsubscribed | Generated when you confirm or unsubscribe | Evidence that you consented, and that we stopped when you withdrew it |
| Delivery and unsubscribe events | Our EU-hosted email delivery processor | Making sure our email arrives, and honouring unsubscribes before the next send |
Following us does not create a dashboard account and gives no access to the platform.
From paying subscribers to the weekly brief
If you subscribe to the weekly incident brief we create a subscriber account for you (your email address, signed in by a link we email you - no password). Payment is taken by Stripe, our payment processor: your card details go to Stripe and never reach us. Stripe collects your billing address and, if you give one, your business tax number, to work out the tax due.
| Data | Source | Purpose |
|---|---|---|
| Email address | Your sign-in | Signing you in, sending you the brief and service notices about your subscription |
| Subscription status, renewal date, and the identifiers Stripe assigns to you as a customer and to your subscription | Stripe, via signed notifications | Knowing who to send the brief to and whether your subscription is active; showing your subscription on your account page |
| Card details, billing address, tax number, invoices and receipts | Held by Stripe only | Taking payment, calculating tax, and issuing your invoices - we never store card details |
| A per-copy watermark in each issue we send you | Generated when the issue is sent | Attributing a forwarded copy to the subscription it came from; it does not identify you to anyone who sees the email |
From incident data sources (individuals mentioned in public reports)
| Data | Source | Purpose |
|---|---|---|
| Names, job titles, organisational affiliations | News articles, regulatory notices, academic papers, court judgments | AI incident classification |
| Public statements | Published articles, press releases | Incident context |
| Social media handles | Public social media posts | Social media incident monitoring |
We do not target special category data (health, ethnicity, political opinions, religious beliefs, etc.).
4. How we protect personal data - pseudonymisation
Before any personal data from incident reports is processed by our AI systems, we apply pseudonymisation:
- What this means: Names and other identifiers of private individuals are replaced with anonymous placeholder strings before text reaches our LLM processors. Two kinds of name are not replaced: public figures acting in a public role, and names in incident records already published by the AI Incident Database, which we use as published. Detection is automated and can miss a name
- Separate lookup table: A mapping between placeholders and original data is stored in a separate, access-controlled database table that is never shared with LLM processors
- LLM exposure to PII is minimised: We pseudonymise personal data before AI processing wherever the purpose allows
- Images: images attached to a source item are processed as published; we do not alter them
- Why this matters: Our LLM gateway is configured for zero data retention. If a processor did retain a request, private individuals' names in it would appear as anonymous placeholders, except where detection missed one
- Reconstruction when needed: We can reconstruct the link between placeholders and real identities when required for legitimate purposes, such as responding to your data subject access request or executing your right to be forgotten
Access to the lookup table is strictly limited to the Data Protection Lead and Technical Lead, and is logged in our audit trail.
5. Lawful basis for processing
| Processing activity | Lawful basis | Detail |
|---|---|---|
| Dashboard user accounts | Article 6(1)(b) - contractual necessity | Required to provide the service you signed up for |
| Incident data (public figures) | Article 6(1)(f) - legitimate interests | AI safety monitoring of publicly available information |
| Newsletter | Article 6(1)(a) - consent (and PECR regulation 22) | You opted in and confirmed by double opt-in. Withdraw at any time via the unsubscribe link in every email, or by emailing data@arcolaai.com; withdrawal takes effect before the next send |
| Paid subscription to the weekly brief | Article 6(1)(b) - contractual necessity; Article 6(1)(c) for the invoicing and tax records | Providing the subscription you bought, taking payment through Stripe, and keeping the records the law requires |
| Employee/financial data | Article 6(1)(b) + 6(1)(c) | Contractual necessity and legal obligation (HMRC) |
For our legitimate interests processing, we have completed a full Legitimate Interest Assessment which concluded that our interests in AI safety monitoring are not overridden by the rights of the individuals mentioned in public reports. Key factors: data is already public, we add classification value without revealing private information, and we index by incident not by person.
6. Who we share data with
To provide our service we use categories of processors including:
- EU-hosted cloud infrastructure (hosting, storage, database)
- EU-hosted LLM inference providers for incident classification (pseudonymised data, with the exceptions in Section 4)
- Authentication and identity management
- Transactional email
- Newsletter email delivery (EU-hosted) - receives your email address and whether you are subscribed, nothing else
- Payment processing (Stripe) - receives your email address, billing address, card details and any tax number you give, and issues your invoices; we receive back only your subscription status and the identifiers Stripe assigns. Stripe is an independent controller for the payment data it holds, under its own privacy policy
- Error tracking, logging, and observability
All processors except Stripe are located within the EU. LLM processors receive pseudonymised data, with the exceptions in Section 4, which explains how our pseudonymisation works. Transfers by Stripe are covered in Section 7.
A complete, current sub-processor list -- including processor names, locations, and categories of data handled -- is available to customers under our Data Processing Agreement. Contact data@arcolaai.com to request it.
We do not sell personal data to anyone.
7. International transfers
All of our own processing takes place within the EU (Germany, France). We do not transfer personal data outside the EU, with one exception: payment. Stripe processes payments from Ireland and may transfer payment data to Stripe, Inc. in the United States under the UK Extension to the EU-US Data Privacy Framework and its standard contractual clauses. The data involved is what you give Stripe at checkout, never your use of the platform.
All LLM inference runs in Frankfurt, Germany: our primary gateway (Requesty) is configured for EU-only processing with zero data retention, and our failover (Amazon Bedrock) is pinned to eu-central-1. Both receive pseudonymised data, with the exceptions in Section 4.
EU Standard Contractual Clauses are available where applicable.
8. How long we keep data
| Data category | Retention period | Reason |
|---|---|---|
| Classified incident data | Indefinite | Core product and research asset; pseudonymised |
| LLM processing logs | 365 days | Debugging, quality assurance, and audit trail |
| Customer account data | Duration of relationship + 2 years | Service provision and follow-up |
| Newsletter subscription | Until you unsubscribe; the consent record is then kept for 2 years | Sending the newsletter; then evidence of the consent you gave and withdrew (PECR) |
| Pseudonymisation lookup table | As long as linked incident exists | Required for data access and erasure requests |
| Paid subscription account | Until you cancel and your paid period ends, then 2 years | Providing the subscription; then handling any dispute or query about it |
| Financial records | 6 years from financial year end | HMRC requirement (includes subscription invoices, held by Stripe and in our accounts) |
When a Right to be Forgotten request is executed, the pseudonymisation lookup table entries for that individual are permanently deleted, making re-identification impossible.
9. Your rights
Under UK GDPR, you have the following rights:
| Right | What it means | How we handle it |
|---|---|---|
| Access (Article 15) | See what data we hold about you | We search our records using the pseudonymisation lookup and provide a report |
| Rectification (Article 16) | Correct inaccurate data | We update the record and the lookup table |
| Erasure (Article 17) | Have your data deleted | We execute our RTBF process: hard-delete from lookup table, tombstone audit records, delete placeholders from incident records |
| Restrict processing (Article 18) | Stop us processing your data while a concern is resolved | We flag your records as restricted |
| Data portability (Article 20) | Receive your data in a structured format | We provide a JSON or CSV export |
| Withdraw consent (Article 7(3)) | Stop the newsletter | Unsubscribe link in every email, or data@arcolaai.com - takes effect before the next send |
| Object (Article 21) | Object to processing based on legitimate interests | We assess your objection against our Legitimate Interest Assessment |
| Complain | Lodge a complaint with the ICO | ico.org.uk |
Contact for all rights requests: data@arcolaai.com
We will respond within 30 days. If a request is complex, we may extend to 90 days with notice.
Erasure limitation: Private individuals' names reach our LLM processors as anonymous placeholders, and our gateway keeps no copies. Once your lookup entry is deleted, a placeholder cannot be connected back to you.
10. Cookies
We use only strictly necessary cookies required for the platform to function:
| Cookie | Type | Purpose |
|---|---|---|
| Session cookie | Functional (session) | Authentication - keeps you logged in |
| CSRF token | Functional (security) | Prevents cross-site request forgery |
We do not use:
- Advertising cookies
- Cross-site tracking
- Analytics cookies
We count visits with Umami, a self-hosted analytics tool that sets no cookies.
11. Children
Our platform is not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data about a child, please contact us immediately at data@arcolaai.com.
12. Changes to this policy
We may update this policy from time to time. When we make material changes:
- We will update the effective date at the top of this page
- We will notify registered dashboard users by email
- Previous versions are retained in our document control system
13. What we will never do
- Build profiles or dossiers on individuals - our platform indexes incidents, not people
- Sell personal data to third parties
- Send private individuals' names to LLM processors by design - our pipeline replaces them with anonymous placeholders first
- Use personal data for marketing without your explicit consent
- Process special category data (health, ethnicity, political opinions, etc.)
- Index incidents by individual - there is no person-search feature