1. Who we are
ivee is a trading name of IVY HQ LIMITED, a company registered in England and Wales.
Company number: 15104292
Registered office: Arquen House, 4-6 Spicer Street, St. Albans, England, AL3 4PQ
VAT number: 518977243
ICO registration: ZB729426
Contact: hello@ivee.jobs
In this policy, "we", "us" and "our" mean IVY HQ LIMITED. "You" means anyone whose personal data we handle - website visitors, programme participants, app users, and people at the companies we consult for.
We are the controller of the personal data described in this policy. That means we decide what data is collected and why, and we are responsible for looking after it.
Our obligations come from the UK General Data Protection Regulation (UK GDPR) as supplemented by the Data Protection Act 2018, and from the Privacy and Electronic Communications (EC Directive) Regulations 2003 where electronic marketing and cookies are concerned. Where this policy refers to "data protection law", it means these.
We sell to customers in the United Kingdom only. Our programmes and our application are offered to people in the UK, and we do not target or market to people outside it. If you are outside the UK, please do not book a programme or create an account.
There are two situations where we act as a processor rather than a controller, on someone else's instructions:
Where we deliver consulting services and handle personal data on a client's behalf. Those arrangements are governed by the separate written contract with that client, not by this policy.
Where we produce Team Insights for an organisation that licenses the prompt improver for its staff. The organisation is the controller of those insights, we act on its instructions, and section 5.4 explains what that means for you.
Everything else in this policy, including processing your prompts and running your account, is processing for which we are the controller.
2. Our Data Protection Officer
We have appointed an external Data Protection Officer:
Lex Dinamica Ltd
Michelin House, 81 Fulham Road, London, SW3 6RD, United Kingdom
Company number 13324428
You can reach our DPO by emailing hello@ivee.jobs with "DPO" in the subject line, and your message will be passed on. You are welcome to contact the DPO directly about anything in this policy, including a complaint.
3. What this policy covers
This policy applies to:
ivee.jobs and any other website we operate;
our AI programmes that you can book onto and attend;
our prompt improver application;
our consulting services, in respect of the client contacts we deal with; and
our marketing, events and general business communications.
Where the prompt improver application collects anything not described here, the in-app privacy information will say so, and this policy remains the primary statement of how we handle your data.
4. The personal data we collect
4.1 Information you give us
Name, email address, and where you provide them, job title, employer, telephone number. Collected when signing up, booking a programme, enquiring about consulting, subscribing to emails, or creating an app account.
What you tell us you want to achieve with ivee, your role, your team's AI maturity, and similar context. Collected through enquiry forms, discovery calls, onboarding questionnaires and programme applications.
Billing name, billing address and VAT details. Collected for purchases and invoicing.
Content you submit in the prompt improver, being the text of your prompts. Collected when you press the application's keyboard shortcut. The name of the application you were working in - for example "Slack" - is sent with it, and nothing else is. Section 4.6 explains exactly what the application reads and what it never reads.
Questions, messages and correspondence. Collected when emailing us, contacting support, or using in-programme chat.
Dietary, accessibility or other requirements you choose to share. Collected during programme bookings, where relevant.
4.2 Information we collect automatically
Device and connection data: IP address, browser type and version, operating system, device type, time zone, language.
Usage data: pages viewed, links clicked, referring page, time on page, features used, session duration.
Session recordings: where you have consented, a replay of your interactions with our website (see section 4.4).
Cookies and similar technologies: see our Cookie Policy.
Email engagement: whether you opened an email from us and which links you clicked.
Prompt improver activity records: for each improvement, the time, the name of the application you were working in, and whether you used or discarded the improved prompt. We keep these records even where you have turned prompt storage off, because they contain no prompt text.
4.3 Payment information
Payments are processed by Stripe. We do not see, collect or store your full card number, expiry date or security code. Stripe provides us with a payment reference, the last four digits of the card, the card brand, the outcome of the transaction and the billing details you enter. Stripe handles your card data as a controller in its own right under its own privacy policy.
4.4 A note on session recording
We use PostHog's session recording feature on our website. This produces a replay of how you moved through and interacted with our pages. We configure it to mask text you type into form fields, and we do not record payment pages. Session recording only runs if you have given consent, and you can withdraw that consent at any time through our cookie settings.
4.5 What we do not collect
We do not run advertising or cross-site tracking technologies, and we do not sell or share your personal data with advertisers or data brokers.
We do not carry out profiling or automated decision-making that produces legal effects for you or otherwise significantly affects you. The prompting score described in section 4.2 assesses a prompt, not a person, and we do not use it to make any decision about you. On a team account it reaches your administrator only as part of a team-wide figure, never as a score attached to you.
We do not knowingly collect data from anyone under 18. Our programmes and applications are for adults only, and we ask that under-18s do not use them or provide us with personal data. If you believe a person under 18 has given us their data, email hello@ivee.jobs and we will delete it.
We do not seek special category data such as health, ethnicity or religious belief. If you volunteer something of this nature - for example an accessibility requirement for a programme - we use it only to accommodate you, we rely on your explicit consent, and we delete it once the programme has finished.
4.6 What the prompt improver reads, and what it never reads
The prompt improver reads the draft you were about to send, at the moment you press its keyboard shortcut. To do that it uses the macOS Accessibility permission, which you grant explicitly in System Settings and can withdraw at any time.
macOS grants that permission broadly, so we want to be clear that what limits us is our own commitment rather than the operating system. We never take screenshots, record your screen, log your keystrokes, read any window or application other than the field your draft is in, or read your files, emails, messages, browsing history or calendar. We read nothing at all until you press the shortcut.
Where macOS cannot expose the text field, the application falls back to your clipboard and improves what is currently on it. It reads the current clipboard contents only, not your clipboard history, and only at the moment you press the shortcut.
Two things are sent to us: the text of your prompt, and the name of the application you were working in. Nothing else - not window titles, not web addresses, not file names or contents, not the rest of your document, not any other text on your screen. Section 8 of our App Terms of Service states this as a contractual commitment, and widening it would require 30 days' notice to you.
5. Why we use your data, and our lawful basis
Under data protection law we must have a lawful basis for everything we do with your data. Here is ours.
5.1 Delivering programmes and consulting
Data: name, email, employer, job title, booking and payment details, requirements you share, programme attendance and participation.
Purpose: to take your booking, deliver the programme or engagement, give you access to materials, communicate with you about the sessions, issue invoices and receipts, and provide support.
Lawful basis: performance of a contract with you. Where you are a contact at a client company rather than the contracting party, our basis is legitimate interests - specifically our interest in delivering the services the company has engaged us for.
5.2 Running the prompt improver application
Data: account details, the text of the prompts you submit, the name of the application you were working in, and the activity records described in section 4.2.
Purpose: to process your prompt and return an improved version, to maintain your account and your own statistics, to provide support and to prevent abuse of the service.
Lawful basis: performance of a contract with you. Where your seat was provided by your employer, our basis is legitimate interests in delivering the service that employer has licensed for you.
Your control: you can turn prompt storage off at any time in your settings, on every tier. We then stop keeping the text of your prompts and keep only the activity record in section 4.2. Section 10.2 of our App Terms of Service sets out exactly what that does and does not change.
5.3 Improving the prompt improver application
Data: prompt text submitted by users of the free individual tier only.
Purpose: we and our staff review prompts submitted on the free tier in order to understand how the application is used, spot where it performs badly, and improve our prompt libraries, templates and product design.
Lawful basis: legitimate interests - our interest in improving a product we provide free of charge. We have carried out a balancing assessment and concluded that this use is proportionate, provided that (a) it is clearly disclosed, (b) you can object at any time, and (c) prompts are held for no longer than necessary.
Your control: you can turn this off at any time in your account settings, or by emailing hello@ivee.jobs. Turning it off does not affect your access to the free tier.
What we do not do: we do not use free-tier prompts to train or fine-tune any artificial intelligence model - not our own, and not anyone else's. If that ever changes, we will tell you in advance and ask for your consent first. We would not treat your continued use of the App as consent.
Paid personal tier: prompts submitted on the paid personal tier are never reviewed for product improvement and are never used for training.
Paid teams tier: prompts submitted on the paid teams tier are never reviewed for product improvement and are never used for training. They are retained for 12 months, so that team members can go back to their own prompts, and for security and abuse monitoring and to produce the Team Insights described in section 5.4. They are then deleted. See section 9.
5.4 Team accounts and Team Insights
This section applies only if your seat was provided by an organisation that licenses the prompt improver for its staff.
Data: the activity records in section 4.2, and categories derived from the text of team prompts.
Purpose: to give your organisation's administrator a view of how its team is using the application. Where the organisation has three or more people holding seats, that view shows a team-wide prompting score, how often the team uses the application, the categories of work the team's prompts fall into, how much of the application's work the team keeps rather than discards, which AI applications the team uses it alongside and how often each appears, how often team drafts were found to contain personal data and how many identifiers were removed, and a modelled estimate of the time and processing cost saved. Below three seat holders, none of it is shown. Identified to you individually, the administrator sees only the number of times you have used the improver, how many of its improvements you used rather than discarded, when you last used it and on which days, and that you hold a seat.
What an administrator never sees: the text of your prompts, the text of what the application returned, your individual prompting score, the categories of your own work as distinct from the team's, which AI applications you personally used it alongside, whether any of your own drafts were found to contain personal data, or anything on your screen. There is no setting or plan that turns any of this on.
Who is responsible: for Team Insights your organisation is the controller and we act as its processor under a written data processing agreement. It decides whether to use them and what to do with what it sees, and its own workplace and monitoring policies apply. Questions about that go to your organisation first. Because your organisation is the controller, it is also responsible for telling you that it monitors App use in this way, and for handling requests you make about the insights themselves.
Aggregated, not anonymous. We describe the team-level figures as aggregated, and we do not describe them as anonymised. In a small team, an aggregate can still tell colleagues something about an individual, and the three-seat threshold makes that harder rather than impossible. We would rather be accurate than reassuring.
Your control: prompt storage is not a setting you control on a team account, because your seat sits inside an account your organisation licenses and administers, and prompt storage is what produces both your own history and the team view. What that view can contain is fixed by the list above, and it does not include anything you wrote. You can ask us at hello@ivee.jobs exactly what your administrator can currently see and we will tell you, and you can ask us to delete prompts we hold about you.
5.5 Marketing and keeping in touch
Data: name, email, employer, job title, email engagement data, and where relevant the context you shared with us about what you want to achieve.
Purpose: to send you information about our programmes, insights, events and services, and to tailor what we send so it is relevant to you.
Lawful basis: consent where you have opted in. Legitimate interests where you are an existing customer and we are telling you about services similar to those you have already bought, which is the "soft opt-in" permitted by regulation 22(3) of the Privacy and Electronic Communications (EC Directive) Regulations 2003.
Your control: every marketing email has an unsubscribe link. You can also email hello@ivee.jobs. We act on unsubscribes promptly, and unsubscribing never affects a programme you have booked or a service you have bought.
5.6 Website analytics and improvement
Data: usage data, device and connection data, session recordings, cookie identifiers.
Purpose: to understand how people find and use our site, which content is useful, and where things break.
Lawful basis: consent, given through our cookie banner. Non-essential analytics do not run until you consent, and you can withdraw consent at any time.
5.7 Payments, accounting and tax
Data: billing details, transaction records, invoices.
Purpose: to take payment, keep proper accounting records and meet our tax obligations.
Lawful basis: performance of a contract, and legal obligation under the Companies Act 2006, the Value Added Tax Act 1994 and associated HMRC requirements.
5.8 Security, fraud prevention and abuse monitoring
Data: IP address, device data, access logs, prompt metadata.
Purpose: to keep our systems secure, detect and prevent fraud, and identify misuse of our services.
Lawful basis: legitimate interests in protecting our business, our users and our systems.
5.9 Legal claims, complaints and compliance
Data: whatever is relevant to the matter.
Purpose: to handle complaints, exercise or defend legal claims, respond to regulators and comply with the law.
Lawful basis: legal obligation, and legitimate interests in establishing, exercising or defending legal claims.
5.10 Business transactions
If we ever sell, restructure or merge part of our business, or take on investment, we may need to disclose data to the other party and its advisers.
Lawful basis: legitimate interests in conducting our business. Any recipient would be bound by confidentiality, and we would tell you if the way your data is handled materially changed.
6. Objecting to legitimate interests
Where we rely on legitimate interests, you have the right to object. Tell us at hello@ivee.jobs and we will stop unless we have compelling grounds to continue, which we would explain to you. Where we rely on legitimate interests for direct marketing, your objection is absolute - we will always stop.
You can ask us for a copy of the balancing assessment behind any legitimate interests basis in this policy, and we will provide it.
7. Artificial intelligence and your data
We build our business around AI, so we want to be specific about how it touches your data.
The prompt improver uses a third-party AI model. When you submit a prompt, the text is sent to Anthropic to be processed and returned in improved form. Anthropic acts as our processor and handles the text under our instructions.
Anthropic does not train its models on your prompts. We use Anthropic's commercial API, under terms which do not permit inputs and outputs to be used to train its models.
We do not train our own models on your data. Not on prompts, not on programme materials you produce, not on anything you tell us.
You are told when you are interacting with an AI system. The prompt improver is clearly identified as AI-powered.
We score prompts, not people. The application assesses each prompt against our internal framework of good prompting. That score describes the prompt. It is not a rating of you, it is not used to make any decision about you, and on a team account it reaches an administrator only inside a team-wide figure.
AI output is not always right. Anything the prompt improver returns is a suggestion. Check it before you rely on it. See our Disclaimer.
Do not put other people's personal data into the application. Our Acceptable Use Policy prohibits it, and we have no way of honouring the rights of a person whose data reaches us this way. If it happens, tell us and we will delete it.
We do not use AI to make decisions about you. Nothing in the prompt improver, including its prompting score, is used for automated decision-making about you within the meaning of Article 22 of the UK GDPR.
8. Who we share your data with
We share personal data with the service providers below, each of which processes it on our behalf under a written contract that restricts what they can do with it. We keep a current list at ivee.jobs/legal/subprocessors.
Stripe - payments and invoicing. Data involved: name, email, billing address, transaction data. Where: UK, EU, USA.
Anthropic - AI processing for the prompt improver. Data involved: prompt text. Where: USA.
ActiveCampaign - email marketing and transactional email. Data involved: name, email, engagement data, segmentation attributes. Where: USA.
PostHog - product and website analytics, session recording. Data involved: usage data, device data, cookie identifiers, session recordings. Where: EU.
Google Analytics - website analytics. Data involved: usage data, device data, cookie identifiers. Where: USA.
Attio - customer relationship management. Data involved: name, email, employer, job title, correspondence, enquiry context. Where: EU, USA.
We may also share data with:
Professional advisers - accountants, auditors, lawyers and insurers, where they need it to advise us;
Our hosting and IT providers, to the extent data sits on their infrastructure;
Regulators, courts and law enforcement, where we are legally required to disclose or where disclosure is necessary to establish or defend a legal claim.
On a team account, we also disclose the Team Insights described in section 5.4 to the administrator your organisation has appointed. We never disclose the text of your prompts or of what the application returned, to an administrator or to anyone else.
We do not sell your personal data. We do not share it for anyone else's marketing.
9. How long we keep your data
We keep data only as long as we need it. Where the law sets a minimum, we follow that.
Marketing contacts who never purchase: 24 months from your last engagement with us.
Unconverted enquiries: 12 months from last contact.
Programme participant records: 6 years from the end of the programme.
Consulting client contact records: 6 years from the end of the engagement.
Payment, invoice and accounting records: 6 years from the end of the accounting period in which the transaction occurred.
App account data: deleted 12 months after the account becomes inactive.
Prompt content - free individual tier: 12 months from submission.
Prompt content - paid personal tier: 12 months from submission. Never reviewed for product improvement.
Prompt content - paid teams tier: 12 months from submission, for your own access to it, for security and abuse monitoring and to produce Team Insights. Never reviewed for product improvement.
Prompt improver activity records (time, application name, whether the improvement was used or discarded, no prompt text): for as long as your account is open, and 12 months afterwards.
Prompting scores derived from prompt text: for as long as your account is open, and 12 months afterwards. A score is stored as a number, separately from the prompt, and is kept after the prompt text it came from has been deleted.
Team Insights aggregates derived from team prompts, containing no prompt text: for as long as the organisation holds a licence, and 12 months afterwards.
Prompt content where you have turned prompt storage off (free and paid personal tiers only; the setting is not available on the teams tier): not stored. Prompts already held are deleted at the end of the period above, or sooner if you ask us.
Website analytics events (PostHog): 12 months.
Session recordings: 30 days.
Google Analytics data: 14 months.
Correspondence and support tickets: 3 years from resolution.
Records relating to a complaint or legal claim: 6 years from resolution, or longer if a claim remains live.
The six-year periods reflect the limitation period for bringing a contract claim in England and Wales under the Limitation Act 1980, and HMRC's record-keeping requirements.
Once a retention period ends we delete the data or anonymise it so it can no longer identify you. Anonymised and aggregated data may be kept indefinitely, because it is no longer personal data.
Backups follow their own cycle and are overwritten within 90 days, so deleted data may persist briefly in a backup before being permanently removed.
10. Where your data goes
We sell only to UK customers, but some of our service providers are based abroad. Where personal data leaves the UK, we make sure it is protected to an equivalent standard using one of these mechanisms, as Chapter V of the UK GDPR requires:
Adequacy regulations - the Secretary of State has formally recognised the destination country as providing adequate protection. This covers the EU and EEA.
The International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses.
The UK Extension to the EU-US Data Privacy Framework, where our provider is certified.
Transfers to the United States - which affect Anthropic, ActiveCampaign, Google and Stripe - are covered by a combination of the mechanisms above. We carry out a transfer risk assessment for each one and keep it on file.
You can ask us for a copy of the safeguards for any specific transfer by emailing hello@ivee.jobs.
11. How we protect your data
We take security seriously and we use measures appropriate to the risk, including:
encryption of data in transit using TLS, and encryption at rest where our providers support it;
access controls, so staff and contractors only reach data they need for their role;
multi-factor authentication on business systems;
written contracts with every processor containing the terms required by Article 28 of the UK GDPR;
a documented process for detecting, investigating and reporting personal data breaches, including notification to the Information Commissioner's Office within 72 hours where the breach is likely to result in a risk to your rights and freedoms, and notification to you where the risk is high, as required by Articles 33 and 34 of the UK GDPR and the Data Protection Act 2018;
regular review of who has access to what, and removal of access when people leave.
No system is perfectly secure. If something goes wrong we will tell you what we know, what we are doing about it, and what you should do.
12. Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the following rights.
Access - ask for a copy of the personal data we hold about you, and information about how we use it.
Rectification - have inaccurate data corrected and incomplete data completed.
Erasure - ask us to delete your data where we no longer have a good reason to keep it. This is not absolute; we may need to retain records to meet a legal obligation or defend a claim.
Restriction - ask us to pause our use of your data while a dispute about its accuracy or our basis for using it is resolved.
Portability - receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another provider, where we process it by automated means on the basis of consent or contract.
Objection - object to processing based on legitimate interests, and object absolutely to direct marketing.
Withdraw consent - where we rely on consent, withdraw it at any time. This does not affect anything we did before you withdrew it.
Not be subject to solely automated decision-making that has legal or similarly significant effects. We do not do this.
Complain to the Information Commissioner's Office. See section 14.
If your seat was provided by an organisation, requests about the Team Insights in section 5.4 should go to that organisation, because it is the controller of them. Tell us anyway if you would rather start with us, and we will point you to the right place and help where we can.
How to exercise a right
Email hello@ivee.jobs. There is no fee. We will respond within one month, and if your request is complex or you have made several, we may extend that by up to two further months and will tell you if we do.
We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else.
If we decide not to act on your request, we will explain why and tell you how to challenge that.
13. Cookies
Our website uses cookies and similar technologies. Non-essential cookies only run with your consent. Full details, including a table of every cookie we set, are in our Cookie Policy. You can change or withdraw your choices at any time through the cookie settings link in our website footer.
14. Complaints
If you are unhappy with how we have handled your data, please tell us first at hello@ivee.jobs. We would rather fix it than have you go elsewhere, and our Complaints and Dispute Resolution Policy sets out how we handle it.
You also have the right to complain to the Information Commissioner's Office at any time, whether or not you have raised it with us.
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
15. Links to other sites
Our website may link to sites we do not control. This policy does not apply to them. Read their privacy policies before giving them your data.
16. Changes to this policy
We will update this policy when our practices or the law change. The date at the top always shows the current version. If a change materially affects how we use your data or the basis on which we do it, we will tell you directly - by email where we have your address - before it takes effect, and where the change requires your consent we will ask for it.
We keep previous versions and will send you one on request.
17. Contact us
Questions about this policy, about your data, or about anything else in it:
Email: hello@ivee.jobs
Post: Data Protection, IVY HQ LIMITED, Arquen House, 4-6 Spicer Street, St. Albans, England, AL3 4PQ
Data Protection Officer: Lex Dinamica Ltd, Michelin House, 81 Fulham Road, London, SW3 6RD - contact via hello@ivee.jobs marked "DPO"
