Legal
Privacy Policy
1. Controller
Codaiq LTD, 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, represented by Director Hassan Hasso. Email: info@growthaiq.com; telephone: +971 58 560 6084. No data protection officer has been appointed. Please send privacy requests to the email address above.
2. Scope and legal bases
This policy applies to the GrowthAIQ website, contact forms, AI Advisor and protected client portal. Where applicable, we process data under the UK GDPR, Data Protection Act 2018 and, for EEA-related processing, the EU GDPR.
Legal bases include steps prior to or performance of a contract, legitimate interests in secure operation, communication and service improvement, legal obligations, and consent where explicitly requested.
3. Website and server logs
When you access the website, technically necessary data such as IP address, time, URL, referrer, browser and device information may be processed for delivery, stability, abuse prevention and error analysis. Logs are retained only as long as required for security and operation.
4. Contact and Blueprint requests
When you submit a form, we process your name, business email, company, website, investment range, requested engagement and message to respond, prepare proposals and conduct pre-contractual communication. Unsuccessful enquiries are generally deleted after twelve months unless legal retention or documentation interests apply.
5. AI Advisor
Chat messages are routed through OpenRouter or Vercel AI Gateway to the selected model provider to generate a response. Where available, we use data-minimising routing and retention settings. Participating providers may process technical usage metadata. Do not enter sensitive personal data, trade secrets or credentials.
The AI Advisor provides initial information and can be incorrect. Processing occurs at your request and under our legitimate interest in efficient initial guidance. See the privacy information of OpenRouter and Vercel.
6. Client portal and authentication
Protected areas use Neon Auth. We process user identifiers, email addresses, encrypted authentication data and technically necessary session information for authentication, tenant separation, secure access and delivery of proposals, invoices and project information.
7. Contract, proposal and invoice data
During an engagement we process business contacts, company and service data, proposals, acceptance status, invoices, payment status, communications and project information for contract performance and statutory retention.
8. Recipients and infrastructure
| Service | Purpose | Possible location |
|---|---|---|
| Vercel Inc. | Hosting, delivery, server-side functions and, where used, AI Gateway | EU/USA and global delivery network |
| Neon, Inc. / Databricks | Postgres database and authentication | Selected database region and provider infrastructure |
| OpenRouter and selected model provider | AI Advisor responses and model routing where configured | EU/USA or provider region |
| Resend | Transactional email after contact and project actions | EU/USA under provider terms |
Other recipients may include project tools selected with you, professional advisers or authorities where legally required. See our subprocessor list.
9. International transfers
Where required, transfers outside the UK or EEA rely on adequacy decisions, recognised standard contractual clauses, the UK International Data Transfer Addendum or other appropriate safeguards. Data minimisation, access controls and regional routing reduce remaining risk.
10. Audience measurement, cookies and local storage
We measure selected events such as page views, CTA clicks, form starts and successful enquiries without marketing cookies or persistent visitor identifiers. We store the event name, page, language and any campaign parameters supplied by you; the measurement does not store IP addresses or the full user agent. The purpose is privacy-minimised improvement of navigation and services. Protected areas may use technically necessary cookies for sign-in, security and session control. See our Cookie Policy.
11. Security
We use appropriate technical and organisational measures including encrypted transport, role-based access, tenant separation, data minimisation, security logging and regular updates. No system can guarantee absolute security.
12. Your rights
Depending on applicable law, you may have rights of access, correction, erasure, restriction, portability, objection and withdrawal of consent. You may complain to the UK ICO or a competent EEA authority. Contact info@growthaiq.com. We may request proof of identity.
13. Automated decisions and children
The website does not make solely automated decisions with legal or similarly significant effects. Our services are intended for businesses, not children.
14. Changes
We update this policy when services, law or processing change. The version published on this page applies.
This policy describes the currently implemented platform. Project-specific processing is additionally governed by the contract and, where required, a Data Processing Agreement.