Privacy Policy

Last Updated: 10 August 2026

1. Introduction

Welcome to Octopus AI Ltd. ("Company", "we", "our", or "us"). Octopus AI Ltd. is a company registered in the United Kingdom. We operate an AI assistant platform (the "Service"). This Privacy Policy explains how we collect, use, store, and protect personal data when you:

  • Visit our website
  • Create an account
  • Use our platform
  • Deploy AI assistants using our Service
  • Interact with AI assistants built using our platform

We are committed to protecting your personal data in accordance with:

  • The UK General Data Protection Regulation (UK GDPR)
  • The Data Protection Act 2018
  • Other applicable data protection laws

If you have questions about this Privacy Policy, please contact:

Email: privacy@asktheoctopus.com

2. Data Controller and Data Processor Roles

For the purposes of UK GDPR:

  • Octopus AI Ltd. acts as a Data Controller for personal data relating to account holders, website visitors, billing information, and business operations.
  • Octopus AI Ltd. acts as a Data Processor when users process personal data through AI assistants built or deployed on our platform.
  • Users deploying AI assistants are responsible for ensuring they have a lawful basis to collect and process personal data through their assistants and for providing appropriate privacy notices to their end users.

3. Information We Collect

3.1 Information You Provide Directly

We may collect:

  • Name
  • Email address
  • Account credentials
  • Company name
  • Billing and payment details
  • Communications with us
  • AI assistant configuration data
  • Prompts, uploaded materials, and related content

3.2 AI Conversation Logs

We store conversation logs generated through AI assistants built and deployed using our platform.

These logs may contain personal data, depending on what end users submit to the AI assistant.

We process and store conversation logs for the following purposes:

  • Providing and maintaining the Service
  • Improving system performance and reliability
  • Monitoring misuse, abuse, or security risks
  • Debugging and technical support
  • Complying with legal obligations

Users deploying AI assistants are responsible for informing their end users that conversations may be stored and processed.

3.3 Information Collected Automatically

We may automatically collect:

  • IP address
  • Device information
  • Browser type and version
  • Usage activity
  • Log data
  • Cookies and tracking technologies

3.4 Information from Third-Party Platforms

If AI assistants built on our platform are deployed on third-party platforms (such as messaging applications, social networks, collaboration tools, or other digital services), we may receive data from those platforms based on permissions granted by the user or end user.

We process such data solely for the purpose of providing our Service and in accordance with applicable platform terms and data protection laws.

4. Lawful Bases for Processing

Under UK GDPR, we rely on the following lawful bases:

  • Performance of a contract (to provide our Service)
  • Legitimate interests (platform security, system improvement, fraud prevention)
  • Legal obligation (compliance with applicable law)
  • Consent (where required for marketing or cookies)

5. How We Use Personal Data

We use personal data to:

  • Provide and operate the platform
  • Authenticate users
  • Process subscriptions and payments
  • Store and manage AI conversation logs
  • Maintain platform security
  • Improve system performance and reliability
  • Respond to support requests
  • Comply with legal obligations

We do not sell personal data.

6. Sharing of Personal Data

We may share data with:

  • Cloud hosting providers
  • Infrastructure providers
  • Payment processors
  • Analytics providers
  • Professional advisors
  • Law enforcement authorities where legally required

We require all service providers to implement appropriate security and data protection safeguards.

We do not sell, rent, or trade personal data.

6.1 Google Workspace API Data — Limited Use

Where you choose to connect a Google account to the Service, we request only the narrowest permissions needed for the feature you have enabled:

  • Permission to send email on your behalf, so that assistant completion emails can be sent from your own address. This permission is send-only. We cannot, and do not, read your mailbox.
  • Permission to access the specific Google Sheets files you select, so that assistant results can be written to them and, where you choose, so that a spreadsheet can be used as a knowledge source for your assistant.
  • Your account email address, used to identify the connected account.
  • Where you sign in to the Service using your Google account, your name, email address and profile picture, used only to create and sign you in to your Octopus AI account.

We do not share Google user data with any third party except as necessary to deliver the feature you enabled: our cloud hosting and database providers, who store it on our behalf, and — only where you have chosen to use a Google Sheet as a knowledge source for your assistant — the AI providers that generate and store the search index for that sheet. We do not share Google user data with advertisers, data brokers, or analytics providers, and we do not sell it.

Octopus AI Ltd. does not use, transfer, or sell Google user data — whether raw, aggregated, anonymised, or derived — to create, train, or improve any foundational or generalised machine learning or artificial intelligence model, whether our own or a third party's. Where Google user data is processed by a third-party AI service in order to deliver a feature you have requested, we use those services under terms that exclude our data from model training.

Octopus AI Ltd.'s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

You can disconnect a connected Google account at any time from the Service's settings screen. When you do, we delete the stored credential and ask Google to revoke the permission, so the access is withdrawn from your Google account and not merely removed from ours. The same happens automatically when the last feature using that account is removed. Data already written to your own Google Sheets, and emails already sent from your account, remain yours and are unaffected. You can also review and revoke access at any time at myaccount.google.com/permissions.

7. International Data Transfers

Some of our service providers may be located outside the United Kingdom.

Where personal data is transferred internationally, we implement appropriate safeguards such as:

  • UK International Data Transfer Agreements (IDTA)
  • Standard Contractual Clauses (SCCs)
  • Transfers to jurisdictions recognised as adequate under UK law

8. Data Retention

We retain personal data only for as long as necessary to:

  • Provide the Service
  • Maintain AI conversation logs
  • Fulfil contractual obligations
  • Comply with legal requirements
  • Resolve disputes and enforce agreements

AI conversation logs are retained in accordance with our internal retention policies and may be deleted upon account termination, subject to legal or contractual obligations. Users may request deletion of account-related personal data by contacting privacy@asktheoctopus.com.

9. Data Security

We implement appropriate technical and organisational measures including:

  • Encryption in transit (TLS/SSL)
  • Secure cloud infrastructure
  • Role-based access controls
  • Monitoring and logging
  • Internal data protection procedures

While we take reasonable steps to protect personal data, no system can guarantee absolute security.

10. Your Rights Under UK GDPR

If you are located in the UK or EEA, you have the right to:

  • Access your personal data
  • Correct inaccurate data
  • Request deletion of personal data
  • Restrict processing
  • Object to processing
  • Request data portability
  • Withdraw consent (where applicable)
  • Lodge a complaint with the UK Information Commissioner's Office (ICO)

To exercise your rights, contact:

privacy@asktheoctopus.com

11. Third-Party Services and Links

Our website and platform may contain links to third-party services or integrate with external platforms.

We are not responsible for the privacy practices of third-party services. We encourage users to review the privacy policies of those services before providing personal data.

We use PostHog to measure how this website is used. PostHog acts as our data processor and stores this data on servers within the European Union. It records pages viewed, clicks, approximate location derived from IP address, and a recording of on-page activity. Form fields are masked, so anything typed into the contact form is never recorded. PostHog does not use this data for its own purposes, and we never sell it or use it for advertising.

12. Cookies

We measure how this website is used in one of two ways, depending on your choice.

  • Anonymous measurement (the default). Unless you allow cookies, our analytics run without storing anything at all on your device. We can count page visits and see which pages are read, but each page you open is counted separately and we cannot connect your visit together or recognise you if you return. No consent is required for this because nothing is stored on your device, and we rely on our legitimate interest in understanding how our website performs.
  • Full measurement (only if you allow it). If you choose “Allow”, PostHog sets a cookie so we can see how a whole visit fits together across pages and recognise returning visitors. This is the only cookie we set for analytics, and we only set it after you agree.

We also store your choice itself in your browser, so we do not ask again on every page. This is strictly necessary to respect your decision and is kept whichever option you pick.

We do not use advertising or marketing cookies, we do not track you across other websites, and we do not sell your data. We honour the “Do Not Track” setting in your browser in both cases, including if you have allowed cookies.

You can change your mind at any time using the “Cookies” link in the footer of any page. Choosing “No thanks” after previously allowing cookies removes the analytics cookie and returns you to anonymous measurement. You can also block or delete cookies via your browser settings, or use your browser’s “Do Not Track” setting to opt out of measurement entirely.

Our signed-in platform at dock.asktheoctopus.com also uses cookies, which are strictly necessary to keep you logged in and to operate the service.

This website also carries our own AI chat assistant. So that it behaves sensibly as you move between pages, it remembers two things for the current browser tab only: whether you closed the chat panel, and what size you left it at. Both are cleared when you close the tab, neither identifies you, and neither is used for analytics or advertising. Anything you type to the assistant is handled as described in this policy.

Our demonstration page at /demo carries a second assistant, for a made-up apartment operator, so that you can try the product without contacting us. It runs on its own address inside a frame on that page. Anything you type into it is handled exactly as described in this policy, and no booking is made and no payment is taken — nothing there is real.

13. Children's Data

Our Service is not directed to individuals under 16 years of age.

We do not knowingly collect personal data from children.

If we become aware that we have collected such data, we will take steps to delete it.

14. Changes to This Policy

We may update this Privacy Policy periodically.

Material changes will be communicated via the website or email.

The latest version will always be available on our website with the updated effective date.

15. Contact Information

Email: privacy@asktheoctopus.com

Registered office: Octopus AI Ltd, Langbrae, Deepdene Park Road, Dorking RH5 4AW, United Kingdom. Registered in England and Wales, company number 17017221.