1. Who we are
ivee is a trading name of IVY HQ LIMITED, a company registered in England and Wales.
Company number: 15104292
Registered office: 9 Claremont Road, Twickenham, England, TW1 2QX
VAT number: 518977243
ICO registration: ZB729426
Contact: hello@ivee.jobs
In this policy, "we", "us" and "our" mean IVY HQ LIMITED. "You" means anyone whose personal data we handle - website visitors, programme participants, app users, and people at the companies we consult for.
We are the controller of the personal data described in this policy. That means we decide what data is collected and why, and we are responsible for looking after it.
Our obligations come from the UK General Data Protection Regulation (UK GDPR) as supplemented by the Data Protection Act 2018, and from the Privacy and Electronic Communications (EC Directive) Regulations 2003 where electronic marketing and cookies are concerned. Where this policy refers to "data protection law", it means these.
We sell to customers in the United Kingdom only. Our programmes and our application are offered to people in the UK, and we do not target or market to people outside it. If you are outside the UK, please do not book a programme or create an account.
Where we deliver consulting services and handle personal data on a client's behalf and under their instructions, we act as a processor rather than a controller. Those arrangements are governed by the separate written contract with that client, not by this policy.
2. Our Data Protection Officer
We have appointed an external Data Protection Officer:
Lex Dinamica Ltd
Michelin House, 81 Fulham Road, London, SW3 6RD, United Kingdom
Company number 13324428
You can reach our DPO by emailing hello@ivee.jobs with "DPO" in the subject line, and your message will be passed on. You are welcome to contact the DPO directly about anything in this policy, including a complaint.
3. What this policy covers
This policy applies to:
ivee.jobs and any other website we operate;
our AI programmes that you can book onto and attend;
our prompt improver application;
our consulting services, in respect of the client contacts we deal with; and
our marketing, events and general business communications.
Where the prompt improver application collects anything not described here, the in-app privacy information will say so, and this policy remains the primary statement of how we handle your data.
4. The personal data we collect
4.1 Information you give us
Name, email address, and where you provide them, job title, employer, telephone number. Collected when signing up, booking a programme, enquiring about consulting, subscribing to emails, or creating an app account.
What you tell us you want to achieve with ivee, your role, your team's AI maturity, and similar context. Collected through enquiry forms, discovery calls, onboarding questionnaires and programme applications.
Billing name, billing address and VAT details. Collected for purchases and invoicing.
Content you submit in the prompt improver, being the text of your prompts. Collected when using the application.
Questions, messages and correspondence. Collected when emailing us, contacting support, or using in-programme chat.
Dietary, accessibility or other requirements you choose to share. Collected during programme bookings, where relevant.
4.2 Information we collect automatically
Device and connection data: IP address, browser type and version, operating system, device type, time zone, language.
Usage data: pages viewed, links clicked, referring page, time on page, features used, session duration.
Session recordings: where you have consented, a replay of your interactions with our website (see section 4.4).
Cookies and similar technologies: see our Cookie Policy.
Email engagement: whether you opened an email from us and which links you clicked.
4.3 Payment information
Payments are processed by Stripe. We do not see, collect or store your full card number, expiry date or security code. Stripe provides us with a payment reference, the last four digits of the card, the card brand, the outcome of the transaction and the billing details you enter. Stripe handles your card data as a controller in its own right under its own privacy policy.
4.4 A note on session recording
We use PostHog's session recording feature on our website. This produces a replay of how you moved through and interacted with our pages. We configure it to mask text you type into form fields, and we do not record payment pages. Session recording only runs if you have given consent, and you can withdraw that consent at any time through our cookie settings.
4.5 What we do not collect
We do not run advertising or cross-site tracking technologies, and we do not sell or share your personal data with advertisers or data brokers.
We do not carry out profiling or automated decision-making that produces legal effects for you or otherwise significantly affects you.
We do not knowingly collect data from anyone under 18. Our programmes and applications are for adults only, and we ask that under-18s do not use them or provide us with personal data. If you believe a person under 18 has given us their data, email hello@ivee.jobs and we will delete it.
We do not seek special category data such as health, ethnicity or religious belief. If you volunteer something of this nature - for example an accessibility requirement for a programme - we use it only to accommodate you, we rely on your explicit consent, and we delete it once the programme has finished.
5. Why we use your data, and our lawful basis
Under data protection law we must have a lawful basis for everything we do with your data. Here is ours.
5.1 Delivering programmes and consulting
Data: name, email, employer, job title, booking and payment details, requirements you share, programme attendance and participation.
Purpose: to take your booking, deliver the programme or engagement, give you access to materials, communicate with you about the sessions, issue invoices and receipts, and provide support.
Lawful basis: performance of a contract with you. Where you are a contact at a client company rather than the contracting party, our basis is legitimate interests - specifically our interest in delivering the services the company has engaged us for.
5.2 Running the prompt improver application
Data: account details, prompt text you submit, usage data.
Purpose: to process your prompt and return an improved version, to maintain your account, to provide support and to prevent abuse of the service.
Lawful basis: performance of a contract with you.
5.3 Improving the prompt improver application
Data: prompt text submitted by users of the free individual tier only.
Purpose: we and our staff review prompts submitted on the free tier in order to understand how the application is used, spot where it performs badly, and improve our prompt libraries, templates and product design.
Lawful basis: legitimate interests - our interest in improving a product we provide free of charge. We have carried out a balancing assessment and concluded that this use is proportionate, provided that (a) it is clearly disclosed, (b) you can object at any time, and (c) prompts are held for no longer than necessary.
Your control: you can turn this off at any time in your account settings, or by emailing hello@ivee.jobs. Turning it off does not affect your access to the free tier.
What we do not do: we do not use free-tier prompts to train or fine-tune any artificial intelligence model - not our own, and not anyone else's. If that ever changes, we will tell you in advance and ask for your consent first. We would not treat your continued use of the App as consent.
Paid teams tier: prompts submitted on the paid teams tier are never reviewed for product improvement and are never used for training. They are retained only briefly for security and abuse monitoring. See section 9.
5.4 Marketing and keeping in touch
Data: name, email, employer, job title, email engagement data, and where relevant the context you shared with us about what you want to achieve.
Purpose: to send you information about our programmes, insights, events and services, and to tailor what we send so it is relevant to you.
Lawful basis: consent where you have opted in. Legitimate interests where you are an existing customer and we are telling you about services similar to those you have already bought, which is the "soft opt-in" permitted by regulation 22(3) of the Privacy and Electronic Communications (EC Directive) Regulations 2003.
Your control: every marketing email has an unsubscribe link. You can also email hello@ivee.jobs. We act on unsubscribes promptly, and unsubscribing never affects a programme you have booked or a service you have bought.
5.5 Website analytics and improvement
Data: usage data, device and connection data, session recordings, cookie identifiers.
Purpose: to understand how people find and use our site, which content is useful, and where things break.
Lawful basis: consent, given through our cookie banner. Non-essential analytics do not run until you consent, and you can withdraw consent at any time.
5.6 Payments, accounting and tax
Data: billing details, transaction records, invoices.
Purpose: to take payment, keep proper accounting records and meet our tax obligations.
Lawful basis: performance of a contract, and legal obligation under the Companies Act 2006, the Value Added Tax Act 1994 and associated HMRC requirements.
5.7 Security, fraud prevention and abuse monitoring
Data: IP address, device data, access logs, prompt metadata.
Purpose: to keep our systems secure, detect and prevent fraud, and identify misuse of our services.
Lawful basis: legitimate interests in protecting our business, our users and our systems.
5.8 Legal claims, complaints and compliance
Data: whatever is relevant to the matter.
Purpose: to handle complaints, exercise or defend legal claims, respond to regulators and comply with the law.
Lawful basis: legal obligation, and legitimate interests in establishing, exercising or defending legal claims.
5.9 Business transactions
If we ever sell, restructure or merge part of our business, or take on investment, we may need to disclose data to the other party and its advisers.
Lawful basis: legitimate interests in conducting our business. Any recipient would be bound by confidentiality, and we would tell you if the way your data is handled materially changed.
6. Objecting to legitimate interests
Where we rely on legitimate interests, you have the right to object. Tell us at hello@ivee.jobs and we will stop unless we have compelling grounds to continue, which we would explain to you. Where we rely on legitimate interests for direct marketing, your objection is absolute - we will always stop.
You can ask us for a copy of the balancing assessment behind any legitimate interests basis in this policy, and we will provide it.
7. Artificial intelligence and your data
We build our business around AI, so we want to be specific about how it touches your data.
The prompt improver uses a third-party AI model. When you submit a prompt, the text is sent to Anthropic to be processed and returned in improved form. Anthropic acts as our processor and handles the text under our instructions.
Anthropic does not train its models on your prompts. We use Anthropic's commercial API, under terms which do not permit inputs and outputs to be used to train its models.
We do not train our own models on your data. Not on prompts, not on programme materials you produce, not on anything you tell us.
You are told when you are interacting with an AI system. The prompt improver is clearly identified as AI-powered.
AI output is not always right. Anything the prompt improver returns is a suggestion. Check it before you rely on it. See our Disclaimer.
Do not put other people's personal data into the application. Our Acceptable Use Policy prohibits it, and we have no way of honouring the rights of a person whose data reaches us this way. If it happens, tell us and we will delete it.
We do not use AI to make decisions about you.
8. Who we share your data with
We share personal data with the service providers below, each of which processes it on our behalf under a written contract that restricts what they can do with it. We keep a current list at ivee.jobs/legal/subprocessors.
Stripe - payments and invoicing. Data involved: name, email, billing address, transaction data. Where: UK, EU, USA.
Anthropic - AI processing for the prompt improver. Data involved: prompt text. Where: USA.
ActiveCampaign - email marketing and transactional email. Data involved: name, email, engagement data, segmentation attributes. Where: USA.
PostHog - product and website analytics, session recording. Data involved: usage data, device data, cookie identifiers, session recordings. Where: EU.
Google Analytics - website analytics. Data involved: usage data, device data, cookie identifiers. Where: USA.
Attio - customer relationship management. Data involved: name, email, employer, job title, correspondence, enquiry context. Where: EU, USA.
We may also share data with:
Professional advisers - accountants, auditors, lawyers and insurers, where they need it to advise us;
Our hosting and IT providers, to the extent data sits on their infrastructure;
Regulators, courts and law enforcement, where we are legally required to disclose or where disclosure is necessary to establish or defend a legal claim.
We do not sell your personal data. We do not share it for anyone else's marketing.
9. How long we keep your data
We keep data only as long as we need it. Where the law sets a minimum, we follow that.
Marketing contacts who never purchase: 24 months from your last engagement with us.
Unconverted enquiries: 12 months from last contact.
Programme participant records: 6 years from the end of the programme.
Consulting client contact records: 6 years from the end of the engagement.
Payment, invoice and accounting records: 6 years from the end of the accounting period in which the transaction occurred.
App account data: deleted 12 months after the account becomes inactive.
Prompt content - free individual tier: 12 months from submission.
Prompt content - paid teams tier: 30 days from submission, for security and abuse monitoring only.
Website analytics events (PostHog): 12 months.
Session recordings: 30 days.
Google Analytics data: 14 months.
Correspondence and support tickets: 3 years from resolution.
Records relating to a complaint or legal claim: 6 years from resolution, or longer if a claim remains live.
The six-year periods reflect the limitation period for bringing a contract claim in England and Wales under the Limitation Act 1980, and HMRC's record-keeping requirements.
Once a retention period ends we delete the data or anonymise it so it can no longer identify you. Anonymised and aggregated data may be kept indefinitely, because it is no longer personal data.
Backups follow their own cycle and are overwritten within 90 days, so deleted data may persist briefly in a backup before being permanently removed.
10. Where your data goes
We sell only to UK customers, but some of our service providers are based abroad. Where personal data leaves the UK, we make sure it is protected to an equivalent standard using one of these mechanisms, as Chapter V of the UK GDPR requires:
Adequacy regulations - the Secretary of State has formally recognised the destination country as providing adequate protection. This covers the EU and EEA.
The International Data Transfer Agreement, or the UK Addendum to the European Commission's Standard Contractual Clauses.
The UK Extension to the EU-US Data Privacy Framework, where our provider is certified.
Transfers to the United States - which affect Anthropic, ActiveCampaign, Google and Stripe - are covered by a combination of the mechanisms above. We carry out a transfer risk assessment for each one and keep it on file.
You can ask us for a copy of the safeguards for any specific transfer by emailing hello@ivee.jobs.
11. How we protect your data
We take security seriously and we use measures appropriate to the risk, including:
encryption of data in transit using TLS, and encryption at rest where our providers support it;
access controls, so staff and contractors only reach data they need for their role;
multi-factor authentication on business systems;
written contracts with every processor containing the terms required by Article 28 of the UK GDPR;
a documented process for detecting, investigating and reporting personal data breaches, including notification to the Information Commissioner's Office within 72 hours where the breach is likely to result in a risk to your rights and freedoms, and notification to you where the risk is high, as required by Articles 33 and 34 of the UK GDPR and the Data Protection Act 2018;
regular review of who has access to what, and removal of access when people leave.
No system is perfectly secure. If something goes wrong we will tell you what we know, what we are doing about it, and what you should do.
12. Your rights
Under the UK GDPR and the Data Protection Act 2018 you have the following rights.
Access - ask for a copy of the personal data we hold about you, and information about how we use it.
Rectification - have inaccurate data corrected and incomplete data completed.
Erasure - ask us to delete your data where we no longer have a good reason to keep it. This is not absolute; we may need to retain records to meet a legal obligation or defend a claim.
Restriction - ask us to pause our use of your data while a dispute about its accuracy or our basis for using it is resolved.
Portability - receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another provider, where we process it by automated means on the basis of consent or contract.
Objection - object to processing based on legitimate interests, and object absolutely to direct marketing.
Withdraw consent - where we rely on consent, withdraw it at any time. This does not affect anything we did before you withdrew it.
Not be subject to solely automated decision-making that has legal or similarly significant effects. We do not do this.
Complain to the Information Commissioner's Office. See section 14.
How to exercise a right
Email hello@ivee.jobs. There is no fee. We will respond within one month, and if your request is complex or you have made several, we may extend that by up to two further months and will tell you if we do.
We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else.
If we decide not to act on your request, we will explain why and tell you how to challenge that.
13. Cookies
Our website uses cookies and similar technologies. Non-essential cookies only run with your consent. Full details, including a table of every cookie we set, are in our Cookie Policy. You can change or withdraw your choices at any time through the cookie settings link in our website footer.
14. Complaints
If you are unhappy with how we have handled your data, please tell us first at hello@ivee.jobs. We would rather fix it than have you go elsewhere, and our Complaints and Dispute Resolution Policy sets out how we handle it.
You also have the right to complain to the Information Commissioner's Office at any time, whether or not you have raised it with us.
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint
15. Links to other sites
Our website may link to sites we do not control. This policy does not apply to them. Read their privacy policies before giving them your data.
16. Changes to this policy
We will update this policy when our practices or the law change. The date at the top always shows the current version. If a change materially affects how we use your data or the basis on which we do it, we will tell you directly - by email where we have your address - before it takes effect, and where the change requires your consent we will ask for it.
We keep previous versions and will send you one on request.
17. Contact us
Questions about this policy, about your data, or about anything else in it:
Email: hello@ivee.jobs
Post: Data Protection, IVY HQ LIMITED, 9 Claremont Road, Twickenham, England, TW1 2QX
Data Protection Officer: Lex Dinamica Ltd, Michelin House, 81 Fulham Road, London, SW3 6RD - contact via hello@ivee.jobs marked "DPO"
