Privacy policy

1. Introduction and scope

EnginuityAI Ltd (company number 15668054) whose registered office is at Riverside House, 3 Place Farm, Wheathampstead, St. Albans, England, AL4 8SB (“EnginuityAI”, “we”, “us” or “our”) is responsible for this website and for the processing of your Personal Data as described in this Privacy Policy.

EnginuityAI is committed to safeguarding the privacy and personal data of all individuals with whom we interact. We respect the rights of individuals to control their personal information and handle all personal data in accordance with applicable data protection and privacy laws that apply to us. Our approach to data privacy reflects our broader commitment to transparency, accountability, and regulatory compliance, ensuring that personal information is collected, used, stored, and disclosed responsibly and lawfully.

This Privacy Policy explains how EnginuityAI collects and processes Personal Data through your use of our website, Funding Scout and any related products or services, including any Personal Data you provide when you visit our website, create an account, submit information, purchase or access reports, use credits, request marketing, contact us or otherwise interact with us.

This Privacy Policy applies to:

• any Personal Data provided to us through our website (“Website Data”);

• any Personal Data provided to us in connection with your account, use of Funding Scout, purchase of reports or credits, customer support or contractual relationship with us (“User Data”); and

• any Personal Data contained in information submitted to Funding Scout about products, technologies, innovations or ideas (“Submission Data”).

Where we process Website Data, User Data and Submission Data, EnginuityAI is the controller.

For further information regarding how EnginuityAI processes Personal Data relating to its personnel—including prospective and current employees, independent contractors, and other staff—you may contact us at compliance@enginuityai.io. This includes inquiries about data collection, use, retention, and your rights under applicable data protection laws.

Our website and services, including Funding Scout, are not directed at individuals under the age of 18, and we do not knowingly collect Personal Data from them.

2. What Personal Data do we collect and how do we use it?

As part of our business operations, we collect various categories of Personal Data to support the delivery of our website and Funding Scout, and to fulfil our contractual and legal obligations.

Website Data

EnginuityAI collects Website Data, including but not limited to email addresses, telephone numbers, company names (where applicable), job titles, and any additional information voluntarily provided when submitting a request or inquiry through the website’s contact forms or interactive features.

In addition to the information you may provide directly, we may also collect certain technical data about your device and browsing behaviour. This may include your computer’s IP address, operating system, browser type, and similar information. Such data is gathered for system administration purposes and may be used to compile statistical reports on website usage, which we may use in aggregated form to understand website usage and improve our website, services and marketing activities. This information helps us improve the functionality and accessibility of our website services.

We also collect Personal Data through the use of cookies and similar tracking technologies. Further details on how we use cookies, and how you can manage your preferences, are available in our Cookie Policy.

We use the Website Data in the following ways where it is necessary for our legitimate interests:

• to ensure that content from our website is presented in the most effective manner;

• to analyse the data for the purposes of improving our website and services;

• to prevent fraud and/or for security; and

• to respond to a request submitted via our website.

Where applicable, we use Website Data to fulfil our obligations under any terms and conditions applicable between you and EnginuityAI. This may include, for example, responding to service inquiries or processing requests submitted via the website. In certain instances, we may also seek your explicit consent to use your Website Data—for example, when registering you for newsletters, updates, or other forms of direct communication that you have requested.

EnginuityAI does not sell or rent Website Data to third parties. We may share Website Data only as described in this Privacy Policy, including with our service providers where necessary for the operation of our website, communications, analytics, security and business administration. However, Website Data may be entered into our internal contact database for the purposes of managing ongoing communications and business relationships. We retain such information in accordance with the retention periods and principles described in the Storage and Retention section of this Privacy Policy.

We do not use your Personal Data for automated decision-making, including profiling, that produces legal or similarly significant effects on you. Funding Scout may generate AI-assisted reports, scores and outputs, but these are provided for informational and signposting purposes only and do not produce legal or similarly significant effects on you.

User Data

Where you create an account, purchase a report, use credits or otherwise access Funding Scout, the collection and processing of your Personal Data may be necessary for the performance of the contract between you and EnginuityAI.

The types of Personal Data we may collect include:

• your full name;

• your job title;

• your contact details, including your e-mail address, phone number and, where applicable, the name of your company;

• account information, login credentials and authentication information;

• billing information, payment status, transaction references, report purchase history and credit usage; and

• support communications and information about your use of Funding Scout.

We may also collect and process the following additional Personal Data about you:

• if you contact us, we may keep a record of that correspondence;

• where you log into the website, you will be required to set up an account following which we will also process your account information including your username and authentication credentials; and

• details of your visits to our website including, but not limited to, traffic data, location data, weblogs and other communication data, and the resources that you access (see section on Website Data below).

Where payments are processed by a third-party payment provider, we may receive limited payment and transaction information, such as payment status, transaction references, billing details and purchase history. We do not usually receive or store full payment card details.

We process User Data to create and manage your account, authenticate your access, process purchases, manage credits, deliver reports, provide support, communicate with you and operate Funding Scout. Where you use Funding Scout on behalf of a company or organisation, we may process your Personal Data for our legitimate interests in providing Funding Scout to that company or organisation and managing the related business relationship.

While you are not legally required to provide us with your Personal Data, failure to do so may prevent us from delivering the services in full or may limit our ability to meet our contractual requirements to you.

We use Personal Data for the following purposes and lawful bases:

• to operate our website, present content effectively, analyse website usage, prevent fraud and maintain security — our legitimate interests;

• to create and manage your account, provide access to Funding Scout, process purchases, manage credits, deliver reports and provide customer support — performance of a contract with you, or our legitimate interests where you act on behalf of an organisation;

• to send marketing communications — consent where required by law, or our legitimate interests where permitted;

• to comply with applicable law or regulation — compliance with legal obligations; and

• for record-keeping, audit, security, fraud prevention and the establishment, exercise or defence of legal claims — legal obligation and/or our legitimate interests.

In certain circumstances, where required by law or regulatory guidance, we may seek your explicit consent to process your Personal Data. In such cases, we will ensure that any request for consent is presented in a clear, transparent, and easily understandable manner, and that your consent is freely given, specific, informed, and unambiguous.

Submission Data

Information submitted to Funding Scout about products, technologies, innovations or ideas may, depending on its content, include Personal Data (“Submission Data”). For example, Submission Data may include names, roles, contact details or other information relating to founders, inventors, employees, researchers, customers, suppliers, partners or other individuals connected with a product, technology, innovation or idea.

Much of the information submitted to Funding Scout about products, technologies, innovations or ideas may be confidential commercial or technical information rather than Personal Data. This Privacy Policy applies only to such information where it identifies, or can reasonably be linked to, an individual.

Where Submission Data includes Personal Data, we may process it to:

• provide Funding Scout and generate reports, scores, demand indicators, opportunity matches, benchmarks and related outputs;

• analyse submitted information and assess potential alignment with market demand signals and funding opportunity areas;

• generate and retain technical and analytical data, including embeddings, classifications, scores, matched clusters and benchmark data, where this involves Personal Data;

• maintain, validate, benchmark and improve Funding Scout, including scoring methodology, cluster quality, similarity thresholds, benchmark pools, analytics, product performance and user experience;

• provide customer support, troubleshoot issues and maintain records; and

• comply with legal obligations, enforce our terms, protect our rights and establish, exercise or defend legal claims.

You are responsible for ensuring that you have all necessary rights, permissions and lawful bases to submit any Personal Data included in Submission Data to Funding Scout.

We do not use Submission Data to make decisions that produce legal or similarly significant effects on individuals.

Our lawful bases for processing Submission Data, where it includes Personal Data, are performance of a contract with you, our legitimate interests in providing, maintaining, improving and protecting Funding Scout, compliance with legal obligations, and, where applicable, your consent.

Where we rely on legitimate interests, we consider and balance any potential impact on you and your rights before processing your Personal Data.

3. Where we store your Personal Data

3.1. Storage and Retention

Unless otherwise permitted or required by applicable law or regulation, EnginuityAI will retain your Personal Data only for as long as is necessary to fulfil the specific purpose for which it was collected. For example, enquiry data submitted via our website is generally retained for up to twelve months, while account-related information is kept for as long as your account remains active. Business contact details may be retained for longer where necessary to maintain an ongoing business relationship. Report, transaction, billing, credit, support and account records may be retained for as long as necessary to provide Funding Scout, maintain business records, resolve disputes, comply with legal, accounting and tax obligations, and establish, exercise or defend legal claims.

When determining the appropriate retention period, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, whether we can achieve those purposes by other means, and applicable legal, accounting, tax and regulatory requirements.

Where we generate technical or analytical data, including embeddings, scores, classifications, matched clusters, benchmark data or usage analytics, and such data includes or can reasonably be linked to Personal Data, we may retain it for as long as reasonably necessary for benchmarking, analytics, product improvement, security, audit and legitimate business purposes, subject to applicable data protection laws.

In some circumstances, we may anonymise Personal Data so that it can no longer be associated with you. We may use anonymised information indefinitely for research, statistical, benchmarking and product improvement purposes.

In certain cases, we may retain data for longer periods where required to comply with legal or regulatory obligations, or where necessary for the establishment, exercise, or defence of legal claims.

If you request the deletion of your Personal Data, we will respond to your request in accordance with applicable data protection laws. Our response will consider our legal obligations and any permissible grounds for continued retention, including where we are required or permitted to retain certain records or anonymised or non-identifiable data.

For further details regarding how to exercise your rights—including the rights of access, correction, deletion, or objection—please refer to the “Your Rights” section of this Privacy Policy below.

3.2. Transfers out of the UK and EEA

EnginuityAI typically stores Personal Data on secure servers located within the United Kingdom or the European Economic Area (“EEA”). However, in the course of our operations, we may transfer Personal Data to third-party service providers, professional advisers, group companies, business partners or other recipients described in this Privacy Policy who are located outside the United Kingdom or the EEA, including in the United States.

Where we transfer Personal Data outside the United Kingdom or the EEA, we will do so in accordance with applicable data protection laws and will ensure that appropriate safeguards are in place. These safeguards may include reliance on UK adequacy regulations, an adequacy decision issued by the European Commission, or the use of legally recognised contractual protections, such as the EU Standard Contractual Clauses, the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

These safeguards are intended to ensure that your Personal Data receives an appropriate level of protection when transferred internationally.

4. How we protect your data

EnginuityAI has implemented appropriate technical and organisational measures to safeguard Personal Data and protect it against accidental loss, unauthorised access, use, alteration, disclosure or destruction. These measures are designed to support the ongoing confidentiality, integrity, and availability of the Personal Data we process.

Electronic data and databases are securely stored on protected computer systems, and access to such data is restricted and managed through a combination of physical controls and electronic safeguards. Access rights are granted on a need-to-know basis and only to employees, agents, contractors and other third parties who have a business need to access the relevant Personal Data and are regularly reviewed to maintain appropriate levels of protection.

In addition, our personnel receive training on data protection and privacy obligations. We adhere to our internal data protection policies and procedures, which all employees and relevant third parties are required to follow when handling Personal Data. Where third parties process Personal Data on our behalf, they are required to process it only for specified purposes, in accordance with our instructions where applicable, and subject to appropriate confidentiality and security obligations. These measures help ensure that data is processed responsibly, securely, and in accordance with applicable legal and regulatory standards.

We have put in place procedures to deal with any suspected Personal Data breach and will notify affected individuals and any applicable regulator where we are legally required to do so.

5. Disclosures of Personal Data

We may share your Personal Data with selected third-party suppliers and service providers, including payment processors and billing providers, who assist us in delivering our website, Funding Scout and related services and in fulfilling the purposes described in this Privacy Policy. These may include IT hosting providers, cloud hosting providers, AI and analytics service providers, CRM providers, email/communications providers, payment providers, security, fraud prevention and compliance providers, professional advisers such as accountants, auditors and legal advisers, and other trusted suppliers who support the operation of our business.

All such disclosures are made in accordance with applicable data protection laws and are subject to appropriate safeguards to ensure the security and confidentiality of your Personal Data. Where legally required, disclosures will be made on a confidential basis and subject to contractual or statutory obligations that protect your privacy and limit the use of the data to the specified purposes. Where third-party service providers process Personal Data on our behalf, we require them to process it only for specified purposes, in accordance with our instructions where applicable, and subject to appropriate confidentiality and security obligations. Some third parties, such as payment providers, professional advisers or analytics providers, may act as independent controllers in respect of certain processing activities.

We may also disclose your Personal Data to third parties:

• in the event that we sell or buy a business or assets, in which case we may disclose your Personal Data to the prospective seller or buyer of such business or assets;

• if EnginuityAI or substantially all of its assets are acquired by a third party, in which case Personal Data held by it will be one of the transferred assets; or

• if we are under a duty to disclose or share your Personal Data in order to comply with any legal obligation, to enforce or apply our terms of use and other agreements, or to protect the rights, property or safety of EnginuityAI, our customers, users, service providers or others. This includes providing information to our accountants, auditors and legal advisers and exchanging information with other companies and organisations for the purposes of fraud protection, security, compliance and risk reduction.

If a change happens to our business, the new owner may use your Personal Data in the same way as described in this Privacy Policy.

6. Your Rights

6.1. Opt-Out

You have the right to object to the processing of your Personal Data for direct marketing purposes. You can exercise this right at the point of data collection by selecting the appropriate options on our data submission forms, which allow you to opt out of receiving marketing communications.

Additionally, you may withdraw your consent or object to marketing-related processing at any time by contacting us directly at compliance@enginuityai.io or by following the unsubscribe or opt-out link included in any marketing communication we send to you. Upon receipt of such a request, we will promptly update our records to ensure that your preferences are respected in accordance with applicable data protection laws.

All direct marketing communications will be sent in compliance with the Privacy and Electronic Communications Regulations 2003 (PECR), meaning we will only send you electronic marketing where we have your prior consent or are otherwise permitted to do so by law. Where you opt out of marketing, we may still send you service, transactional or administrative communications relating to your account, purchases, reports, legal notices or use of Funding Scout.

6.2. Data Subject Rights

In addition to the right set out above, applicable data protection laws provide individuals the following rights:

• to request access to the Personal Data we hold about you;

• to request correction or deletion of your Personal Data;

• to withdraw your consent for a specific use of your Personal Data provided to us;

• to request restriction of processing by us of your Personal Data;

• to object to processing of your Personal Data by us;

• to obtain copies of the data that we hold about you in a machine-readable format and to transfer such data to another company on your request.

Where we rely on legitimate interests as our lawful basis, you may have the right to object to that processing.

However, please note that some of these rights may not always apply, as there are sometimes requirements and exemptions which may mean we need to keep processing the Personal Data or not disclose it, or other times when the rights may not apply at all. As such, each request will be evaluated based on the request type, context of the personal information in question, and other applicable factors.

If you wish to exercise any of these rights, please contact us at compliance@enginuityai.io. We will process such requests promptly and in accordance with applicable data protection laws.

You will not usually have to pay a fee to exercise your rights. However, we may charge a reasonable fee or refuse to comply with a request if it is clearly unfounded, repetitive or excessive.

We may need to request specific information from you to confirm your identity and ensure that Personal Data is not disclosed to someone who is not entitled to receive it.

We aim to respond to legitimate requests within one month. If your request is complex or you have made a number of requests, it may take us longer, in which case we will notify you and keep you updated.

7. Complaints Process

If you believe that our processing of your Personal Data violates your rights under applicable data protection laws, or if you are otherwise dissatisfied with how your Personal Data is being handled, you have the right to lodge a complaint with the relevant supervisory authority.

In the United Kingdom, this is the Information Commissioner’s Office (ICO), which can be contacted via its website at https://ico.org.uk or at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom.

We encourage you to contact us directly in the first instance at compliance@enginuityai.io so that we may address your concerns promptly and fairly. However, you are entitled to escalate the matter to the supervisory authority at any time.

A full list of supervisory authorities in the EEA can be found on the European Data Protection Board’s website at www.edpb.europa.eu/about-edpb/about-edpb/members_en.

8. Links to Third Party Websites

From time to time, our website or Funding Scout may include links to or from third-party websites, platforms, tools or services. Please be aware that these external sites and services operate independently and are governed by their own privacy policies. If you choose to follow a link to any such website or use any such third-party service, you do so at your own discretion and risk.

EnginuityAI accepts no responsibility or liability for the content, practices, or privacy standards of third-party websites, platforms, tools or services, nor for any Personal Data you choose to submit to them. We strongly encourage you to review the applicable privacy policies of those websites and services before providing any personal information or engaging with their services.

9. Contact

Any questions you have in relation to this policy and how we use your Personal Data should be sent to compliance@enginuityai.io.

We are not required to appoint a Data Protection Officer under UK data protection law. If we are required to appoint an EU representative or any other local representative in the future, we will update this Privacy Policy with the relevant details.

10. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our website, Funding Scout, our processing activities, applicable law or regulatory guidance. Any updated Privacy Policy will be posted on our website and will take effect when published, unless otherwise stated.

Please review this Privacy Policy periodically so that you remain informed about how we process your Personal Data. Please also keep us informed if your Personal Data changes during your relationship with us, as it is important that the Personal Data we hold about you is accurate and current.