1. Who we are
Cognifai AI Ltd ("Cognifai", "we", "us") reviews customer and client calls for regulated firms. We are registered in England & Wales under company number 16624957, with our registered office at 124 City Road, London, United Kingdom, EC1V 2NX. We are registered with the Information Commissioner's Office (ICO) as a data controller under registration number ZC183522. For any privacy matter, contact info@cognifai.uk.
2. Data we collect through this website
When you submit our enquiry form, we collect what you provide: your name, role, company, work email, team size, sector, and anything you add in the free-text field. We use this to respond to your enquiry, scope the work and talk to you about our services. Our lawful basis is legitimate interests (responding to a business enquiry you started) and, where an engagement follows, steps taken to enter into a contract.
This website does not use advertising trackers or analytics cookies. The site and form are hosted by Netlify, whose infrastructure records standard server logs (such as IP addresses) for security and operational purposes.
3. Call data we process for clients
Our service analyses recorded calls supplied by our clients. For this data, our client is the data controller and Cognifai is a data processor, acting only on the client's documented instructions under a signed Data Processing Agreement (DPA).
Our standing commitments for call data:
- Transferred securely, and processed only by subprocessors bound by UK GDPR-standard contractual terms.
- Never used to train AI models.
- Customer names are never reproduced in our reports. Findings are referenced by call and timestamp.
- Accessible only to the people who need it to deliver the work.
- Recordings and transcripts permanently deleted within 30 days of each report, or sooner on the client's instruction.
The scores we derive from calls (ratios and counts against each adviser, containing no recordings, transcripts or customer data) are kept for the length of the engagement and twelve months afterwards, so change over time can be measured.
Recordings may contain personal data of our clients' customers and staff, including names, contact details and, where disclosed on a call, health information. Where special category data is present, the client remains responsible for the controller-side lawful basis; our processing is limited to the analysis they instruct, under the safeguards above. If you are a customer of one of our clients and want to exercise your rights over a call recording, please contact the firm you spoke to. We will support them in responding.
4. Sharing and subprocessors
We do not sell personal data or share it with anyone for their own marketing. We use a small, fixed set of subprocessors, each bound by contractual terms consistent with UK GDPR:
- Hosting and analysis: storage and analysis of transcripts, in London, United Kingdom.
- Transcription: speech-to-text of call audio, in the EU.
Analysis runs inside our own cloud account in London. AI model providers have no access to your conversations, our prompts or the outputs. Netlify hosts this website and enquiry form only; it never processes call data. The named subprocessor list forms part of our DPA, and clients are told in advance of any change. See Trust & Data Handling for more.
5. International transfers
All storage and analysis takes place in London, United Kingdom. Call audio is transcribed in the EU. Transfers from the UK to the European Economic Area are permitted under UK adequacy regulations, so no additional transfer mechanism is needed. Where any other processing takes place outside the UK, we ensure adequate protection through UK adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement or Addendum.
6. Retention
Call recordings and transcripts are deleted within 30 days of each report. Derived adviser scores are kept as described in section 3. Enquiry data is kept as long as needed to manage our relationship with you and for a reasonable period afterwards, then deleted. Reports delivered to clients are held by the client as controller of their own records.
7. Security
We apply technical and organisational measures suited to the sensitivity of the data, including encrypted transfer, access controls and deletion procedures. No system is perfectly secure, but the commitments in section 3 are contractual, not aspirational.
8. Your rights
Under UK GDPR you have rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent where consent is the basis of processing. To exercise any of these for data we control, email info@cognifai.uk. You can also complain to the Information Commissioner's Office (ico.org.uk), though we would welcome the chance to put things right first.
9. Changes to this policy
We may update this policy from time to time. The date at the top shows the latest version, and material changes will be flagged to active clients directly.