Legal

Privacy Policy

Last updated: March 2026  ·  Whin AI Ltd, York, UK

This policy explains how Whin AI collects and uses your personal data. We keep it short and plain. If you have questions, email chris@whinai.co.uk.

Who we are

Whin AI is a managed AI agent services business based in York, UK. We design, build, and operate custom AI agent systems for businesses. Our registered address is York, UK. Company number: 17113795. ICO Registration Number: C1895769.

For the purposes of UK GDPR and the Data Protection Act 2018, Whin AI is the data controller for personal data we collect through this website and our client engagements.

What data we collect and why

We collect personal data only where we have a legitimate reason to do so. The main categories are:

• Enquiry data — your name, email address, and any information you share when you contact us via email or a discovery call. Used to respond to your enquiry and assess whether we can help.
• Client contact data — names and email addresses of contacts at client organisations. Used to deliver our services, communicate about project work, and send invoices.
• Website usage data — standard server logs including IP addresses and browser type, retained briefly for security purposes. We do not use tracking cookies or analytics tools on this site.

Our lawful basis for processing

We rely on the following lawful bases under UK GDPR:

• Legitimate interests — for responding to enquiries and managing client relationships.
• Contract performance — for processing data necessary to deliver agreed services.
• Legal obligation — where required by law, such as retaining financial records for HMRC purposes.

How we use AI systems in our work

Whin AI builds and operates AI agent systems powered by third-party large language model providers, primarily Anthropic (Claude). When we process client data through these systems, we act as a data controller or processor depending on the engagement.

We ensure that any personal data processed through AI systems is subject to appropriate contractual protections. Anthropic operates a standard Data Processing Agreement covering their API services. We do not use client data to train AI models.

Before deploying any agent system that processes personal data, we document what data flows through the system, how long it is retained, and who has access to it.

How long we keep your data

• Enquiry emails and correspondence — up to 2 years from last contact
• Client project records — 6 years from project completion (HMRC requirement)