Legal

AI & Data Handling

Last updated: 8 August 2026

Our Privacy Policy covers the data we hold about you as a visitor or an enquirer. This page covers something different and, if you are considering hiring us, more important: what happens to your business’s data — and your customers’ data — when we build automation that touches it.

Most suppliers will not put this in writing before you ask. We would rather you could read it first.

Which hat we are wearing

When you engage us to build something, you remain the data controller: it is your business that decides why the data is collected and what it is for. We act as your processor, working on your instructions, under a written data processing agreement that we put in place before we touch anything.

That matters because liability follows those roles, not the invoice. Any AI provider or third-party service we connect on your behalf becomes a sub-processor, and each link in that chain needs its own agreement. Where one is missing, there is a point where your customers’ data sits unprotected and someone is still accountable for it. We do not build those gaps.

The five commitments

• It stays in your accounts. We build under your logins and your billing. If we part company, nothing has to move and nothing is held hostage — you keep the systems, the data and the credentials.
• Each part only sees the slice it needs. A booking step gets a name and an address; it does not get your customer’s entire history. Minimising what each component can see is a design decision we make at the start, not a setting we add afterwards.
• Retention is decided up front. Anything captured — call recordings, transcripts, enquiry logs — is given a lifespan before it is switched on, and deleted on it. Stored data is a liability, not an asset. You cannot lose what you have already deleted.
• Special-category data gets its own treatment. Information about health, children or vulnerability is handled only under a signed agreement with a written purpose, or not at all. It is never swept into a general-purpose system because it happened to arrive in a message.
• Every third party is contracted. Nothing belonging to your customers goes to a service that is not bound by terms to protect it.

How we use AI specifically

There is a real difference between a consumer chat account and a contracted business or API service, and it is the difference that matters for your data.

• We use contracted business and API tiers only — never a personal chat account — and we read each provider’s data processing terms before your data goes anywhere near it.
• Most of the system is not AI at all. Reliable automation is mostly deterministic plumbing: rules that run identically every time. We reserve the AI for the specific steps that genuinely need judgement. That is cheaper, far more predictable, and it means less of your data passes through a model.
• Anything outward-facing or irreversible has a person in the loop unless you explicitly decide otherwise — money movements, messages to your customers, deletions. An automation being confident is not the same as it being right.
• We monitor whether it is actually working, and test the alarms by breaking things on purpose before handover. An alert that has never been seen to fire is not an alert.

Work we will not take on

A supplier who lists only what they will do is telling you half the story. These exclusions are deliberate and they stay in our contracts:

• We do not handle or hold your customers’ money, and we do not act as a payment processor. We connect to yours.
• We do not provide regulated advice — financial, legal or medical — and we do not build systems that appear to.
• We do not certify work that requires a competent person. Gas, electrical and comparable sign-offs route to your qualified engineer. Software never signs.
• We do not build automated decisions that materially affect a person — hiring, dismissal, credit, refusal of service — without a human making the decision.
• We do not send marketing on your behalf without your explicit written sign-off on the content.
• We do not rip out or replace the systems you already rely on as part of an integration engagement.

Who else is involved

The sub-processors on any given build depend on what we are connecting for you, and the full list goes in your agreement before work starts. The services we most commonly use are named in our Privacy Policy. If you need the list for a specific engagement, or your insurer or accountant has asked for one, email us and we will send it.

Questions, or a request

If you want a copy of our data processing agreement before committing to anything, ask — we would rather you read it early. Email hello@loomwork-ai.co.uk.

This page describes how we work. It is not a substitute for the written agreement covering your engagement, which is what actually governs it.