Last updated: 20 March 2026
This Privacy Policy explains how Artanis Ltd ("Artanis", "We", "Us", or "Our") collects, uses, shares, and protects personal data when You use Our website and platform. We are committed to protecting Your privacy and processing Your personal data in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
Artanis Ltd is the data controller for the personal data described in this Privacy Policy. Our details are:
Important distinction: Artanis acts as a data controller for account and usage data (described in this Privacy Policy). Where Customers submit data to the Service that may contain personal data, Artanis acts as a data processor on the Customer's behalf, governed by Our Data Processing Agreement.
Given the nature and scale of Our data processing activities, We are not currently required to appoint a Data Protection Officer under Article 37 of the UK GDPR. For any questions about data protection or to exercise Your rights, please contact us at privacy@artanis.ai.
When You create an account via Google OAuth, We receive and store:
We automatically collect certain technical information when You use the Service:
If You contact us via email or through the website, We collect Your name, email address, and the content of Your communication.
Customers may submit data to the Service (such as prompts, AI inputs and outputs, labels, and evaluation data) that could contain personal data. We process this data as a data processor on the Customer's behalf, under the terms of Our Data Processing Agreement. This Privacy Policy does not govern Customer-submitted data; the Customer's own privacy policy applies to that data.
We only process Your personal data when We have a lawful basis to do so under Article 6(1) of the UK GDPR:
| Purpose | Lawful Basis | Data Used |
|---|---|---|
| Providing and maintaining the Service | Contract (Art. 6(1)(b)) | Account data, usage data |
| Account authentication via Google OAuth | Contract (Art. 6(1)(b)) | Account data |
| Responding to Your enquiries | Legitimate interest (Art. 6(1)(f)) | Communication data |
| Security monitoring and fraud prevention | Legitimate interest (Art. 6(1)(f)) | Usage data, IP address |
| Product improvement and analytics | Legitimate interest (Art. 6(1)(f)) | Aggregated usage data |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) | Account data, billing data |
| Marketing communications | Consent (Art. 6(1)(a)) | Name, email address |
Where We rely on legitimate interests, We have conducted a balancing test to ensure that Our interests do not override Your fundamental rights and freedoms.
We use Google OAuth as Our sole authentication method. When You sign in with Google, We receive the data listed in Section 3.1. We do not receive or store Your Google password. Our use of information received from Google APIs adheres to Google's API Services User Data Policy.
We use only strictly necessary cookies to operate the Service, including session cookies for authentication and security. We do not use third-party advertising or tracking cookies. Because these cookies are strictly necessary for the operation of the Service, they do not require Your consent under the Privacy and Electronic Communications Regulations 2003 (PECR).
We share personal data only with the following categories of recipients, and only to the extent necessary:
| Sub-Processor | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting and content delivery | United States |
| Google LLC | Authentication (Google OAuth) and AI processing (Gemini API) | United States |
We may also disclose personal data where required by law, regulation, legal process, or governmental request.
We do not sell Your personal data. We do not share personal data with third parties for their own marketing purposes.
Some of Our sub-processors are based in the United States. When personal data is transferred outside the United Kingdom, We ensure appropriate safeguards are in place in accordance with Article 46 of the UK GDPR, including:
You may request a copy of the relevant transfer safeguards by contacting us at privacy@artanis.ai.
We retain personal data only for as long as necessary for the purposes for which it was collected:
Customer-submitted data is retained and deleted in accordance with Our Data Processing Agreement.
Under the UK GDPR, You have the following rights in relation to Your personal data. You may exercise any of these rights by contacting us at privacy@artanis.ai.
We will respond to Your request within one month. In complex cases, We may extend this period by a further two months, in which case We will inform You of the extension and the reasons for it within the first month.
We will not charge a fee for handling Your request unless the request is manifestly unfounded or excessive, in which case We may charge a reasonable fee or refuse to act on the request.
Where We process Your personal data on the basis of consent (such as for marketing communications), You have the right to withdraw Your consent at any time. Withdrawing consent does not affect the lawfulness of any processing carried out before withdrawal. You may withdraw consent by contacting us at privacy@artanis.ai or by using the unsubscribe link in any marketing email.
If You are unhappy with how We have handled Your personal data, You have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection:
We would appreciate the chance to address Your concerns before You approach the ICO, so please contact us first at privacy@artanis.ai.
The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If We become aware that We have collected personal data from a child, We will take steps to delete that data promptly.
The Service may contain links to third-party websites or services that are not operated by Us. We have no control over and assume no responsibility for the privacy practices of any third-party sites. We encourage You to review the privacy policy of every site You visit.
We may update this Privacy Policy from time to time. We will notify You of material changes by email or through the Service at least 30 days before the changes take effect. The "Last updated" date at the top of this policy indicates when it was last revised.
If You have any questions about this Privacy Policy or wish to exercise Your data protection rights, please contact us: