AI Assure is a product provided by IGC Technical Solutions Ltd, company number 06254148, whose registered office is 3 The Studios, 320 Chorley Old Road, Bolton, England, BL1 4JU. IGC Technical Solutions Ltd is responsible for the personal information described in this notice. Contact hello@aiassure.net.
This notice explains the information we use when you contact us, register, use a portal, or use AI Assure.
Information you provide
When you contact AI Assure or request a demonstration, we use your name, work email address, and message, and any company name, role, and approximate device count you choose to give, to respond to you. When you register, we use your company name and URL, billing name and address, country, owner name and email address, requested agent quantity, and a password hash to process registration, verify the email address, and arrange billing.
The registration service stores hashes of one-time verification and password-reset tokens rather than the tokens themselves. Uncompleted registration requests expire after 30 days. Passwords are stored only as password hashes.
AI readiness assessment
When you take the free AI readiness assessment, we use your first name, last name, company name, and answers to calculate and label your result, and we keep the assessment so you can return to it. If you start it from the customer portal, the result is also saved to your company workspace so your team can see it. If you ask for the full report or a results review, we also use your work email address to send it and to reply, and our team receives a copy of the report so we can prepare for any follow-up you request.
Service information
The AI Assure agent runs on the customer's Windows devices and reports information needed to provide the service: the device name, a Windows machine identifier, operating system and agent version, check-in times and policy version, AI services from our list identified on the device with the time seen, AI applications from our list installed on the device (whether or not used), AI programs closed under the customer's policy, blocked website or application attempts identified by the agent, enforcement health and diagnostic posture signals, and a fingerprint that shows when installed programs change without sending the full installed-program list. Website filtering checks the requested hostname against the customer's policy. Allowed HTTPS connections are tunneled without decryption. For the optional branded in-tab block page, the device creates a local trust certificate and terminates the blocked browser connection locally without contacting the blocked website. See Security and Responsible Monitoring for the certificate, fallback and enforcement limits. The agent does not capture prompts, typed content, uploaded files, AI responses, page content, emails, messages, or screen content. Activity that does not match a listed AI service is not reported as AI activity.
The agent service communicates with AI Assure over secure connections for registration, check-ins, policies, reports, and updates. Its local web-filtering proxy listens only on the device itself and forwards allowed browser connections to their requested destinations; blocked requests are not forwarded to the blocked destination. This does not give IGC Technical Solutions remote access to devices: we cannot connect to them, run commands, view their screens, or open their files. From version 1.3.0 the agent installs updates to itself that we publish, and it attempts to uninstall after receiving an authorised uninstall instruction or service-end instruction at check-in; it never installs other software. The customer portal shows the reported information, together with the customer's sites, departments, policies, reports, alerts, and audit records, to the people the customer authorises.
Offline agents retain and enforce their last cached policy. Our Trust and privacy page summarises what is and is not collected.
Each customer can set who its staff should ask about a blocked AI tool, as an email address or a web page. We store it with the customer's settings and the agent shows it in blocked notices on that customer's devices. If a blocked website cannot be explained in the browser tab, the device opens an explanation page on aiassure.net instead. Current agents put the blocked website's name in the part of that page address that browsers do not send to our servers; earlier agent versions included it in the address itself, so it could appear in our web server request records.
Our website and API also process connection addresses, request times and technical request information for request handling, abuse prevention and operational diagnostics. An address can identify a proxy or gateway rather than the person or device behind it. This technical processing is separate from the agent's AI activity records.
Accounts and support
For people who use the portals we keep their name, work email address, role, sign-in times, and security settings. Passwords and recovery codes are stored only as hashes, and authenticator secrets for two-step sign-in are stored encrypted. When a customer sends a support request, a name change request, or a cancellation request from the portal, we keep it with the sender's name and email address so we can respond. When a customer uses the AI policy builder, we keep its answers, any optional company logo, the generated policy, checkout and payment references, payment status, and delivery status for that customer. The public buyer's contact details are used to send access after payment clears. The email contains a private access link, not a PDF attachment; public delivery links expire after 30 days. Company policies are accessed through the signed-in portal.
We send emails needed to run the service, such as email verification, invitations, password resets, company URL reminders, invoices with PDF copies, payment and account notices, notice of price changes, alert summaries for account owners, written-policy availability messages, and replies to requests.
Why we use information
We use information to take steps you request before registration, provide and administer the service, respond to enquiries, secure accounts, prevent misuse, keep business and payment records, and meet legal obligations. Depending on the activity, the legal basis is taking steps before entering into, or performing, a contract; our legitimate interests in operating and protecting the service; or compliance with a legal obligation. When enabled, Google reCAPTCHA v3 processes device and interaction signals when you submit protected forms to help identify automated abuse.
Analytics and Google
If you accept analytics cookies, Google Analytics receives website usage information to help us understand and improve the site. Analytics is not loaded before you accept. You can reject it or change your choice at any time using Cookie settings. Google reCAPTCHA is used for security checks on sign-in, signup, payment setup, password reset, company URL reminder, enquiry, readiness, and written AI policy forms. Details about browser storage are in our Cookie Policy. Google's Privacy Policy and Terms of Service apply to Google's services.
Billing and service providers
Payments are handled by GoCardless Direct Debit under its own privacy responsibilities. See the GoCardless privacy notice. Bank details are entered on GoCardless' own page and are not stored by AI Assure. AI Assure keeps the company subscription status, agent quantity, billing name, address and email, invoices, mandate references, payment status and account credit records needed to manage the account. If you use the optional address search during signup, the text you type is sent from our servers to Geoapify to find matching UK addresses. Email is sent through the relay service operated by IGC Technical Solutions Ltd. Current provider details are listed on our Subprocessors page.
Where information is stored
AI Assure runs on servers in IGC Technical Solutions Ltd's own data centre in the United Kingdom, and the information described in this notice is stored there. Providers listed on our Subprocessors page handle only the parts described there, such as payment setup.
Some of those providers process information outside the United Kingdom. Google may process information for reCAPTCHA and, if you accept analytics, Google Analytics in the United States; Google LLC participates in the EU-US Data Privacy Framework and its UK Extension, which the UK recognises as providing adequate protection. Geoapify processes address searches in the European Union, and GoCardless may process payment information in the European Union; the UK recognises the European Economic Area as providing adequate protection. If we ever need to transfer personal information elsewhere, we will put the safeguards required by UK data protection law in place first.
How long information is kept
Uncompleted registration requests expire after 30 days. Verification and password-reset links expire after their stated validity period. Account, billing, security, and service records are kept while needed to provide the service, protect accounts, resolve disputes, and meet applicable record-keeping obligations. When information is no longer needed for those purposes, it is deleted or anonymised.
AI readiness assessments and written AI policies that are not saved to a customer's company workspace are deleted 24 months after they were last used. For a policy that was paid for, the answers, logo, contact details and access link are removed at that point, and the payment record is kept as described below. Assessments and policies saved to a company workspace are kept and deleted with that company's service data. Contact and demonstration requests are kept for up to 24 months after our last reply, unless they lead to an account.
When a company's cancellation takes effect, the AI Assure agent is told to uninstall itself from the company's devices the next time each one checks in. The company's service data is deleted 90 days after the cancellation takes effect, or sooner if the account owner asks us, subject to the retention described here. This covers devices and the AI use they reported, policies, sites, departments, people's access, support requests, and notes. People who do not belong to another company account are anonymised. Invoices, payment records, account credit records, and the company name and billing details shown on those records are retained for six years after the end of the financial year they relate to, to meet applicable accounting and tax record-keeping requirements. Security audit records are retained for six years after the end of the financial year they relate to under our operational retention schedule; this period is not stated as a statutory accounting requirement. Financial records for an active customer are kept while needed to administer its account and are assessed for deletion after it leaves; the six-year automated purge uses the retained company records and financial-year cutoff. Security audit records are assessed against that cutoff separately. This does not mean that all active-account records disappear on a fixed anniversary.
Browser storage
The registration journey saves company and billing continuation details in browser session storage so you can move between signup steps. Portal sign-in uses an essential secure session cookie, and the portals keep a few preferences in local storage: your chosen number of table rows, your company URL if you ask the sign-in page to remember it, and the time of your last activity, so that open tabs sign you out together after a period of inactivity. The public AI policy builder keeps a document reference and private access token in local storage so you can return to your policy. Public assessment references and resume keys also use local storage. These access tokens should be treated as private; clearing storage removes saved browser access, not the server record. Optional Google Analytics cookies are used only if you accept them. Read the Cookie Policy for details.
Your choices and requests
To create an account, the registration and billing details marked as required must be provided; without them we cannot set up or bill the service. Other information, such as optional enquiry details, is up to you.
You can contact us with a data protection complaint or to request access, correction, deletion, restriction, or objection where those rights apply. Your rights depend on the circumstances and the reason the information is used. Where applicable, you may request data portability, object to processing based on legitimate interests, or withdraw consent for optional analytics. If your employer or another customer is the controller of monitoring data, direct the request to that organisation; we assist it under our Data Processing Agreement. We do not use these service records to make solely automated decisions producing legal or similarly significant effects about people. We will acknowledge a data protection complaint within 30 days, investigate it without waiting for that acknowledgement deadline, keep you informed and provide an outcome without undue delay. Rights requests have their own applicable time limits, normally one calendar month, subject to lawful extensions and identity checks. If you remain concerned, you can complain to the Information Commission, which is known as the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint.
Contact
For privacy questions or requests, email hello@aiassure.net. Include enough information for us to understand your request, and do not send passwords or authentication codes.