Legal
Privacy Notice
A2Zai · A2Z Agentic Solutions Ltd · Version 2026-10-28-sop · UK GDPR
How A2Zai handles personal data on the SOP desk. A solicitor has not settled this notice — open questions are stated rather than glossed over.
1. Who is responsible
A2Zai is operated by A2Z Agentic Solutions Ltd, company number 17483543, registered office 26 Meadow Park, Tamworth, England, B79 7RR. Contact for any privacy question or request: Archie@a2zagentics.net. A2Z Agentic Solutions Ltd acts as the Data Processor under UK GDPR and processes that transcript only to run this desk. All data ingestion, model processing, and text inference occur strictly on our private sovereign UK nodes. Your proprietary data never leaves the UK jurisdiction and is never transmitted to third-party US cloud AI APIs. You retain 100% ownership as the Data Controller. A stored transcript copy is removed when that organisation next opens the desk, if that folder is older than 6 years, unless the organisation deletes the copy sooner. Nothing removes it on a timer while the desk is idle. Removing the copy does not remove the audit log or an exported SOP file.
2. What we hold
Account records: username, display name, work email, organisation and role. Content you supply: transcript text and uploaded files, and the SOP drafts generated from them. Operational records: a hash-chained audit log, job status history, and invitation records (for invitation-only evaluations, the invited email). Billing records: plan, status and Stripe customer/subscription references — card numbers are handled by Stripe and are not stored on the desk.
3. Where it is processed
Transcript inference and stored SOP content run on a private computer in the United Kingdom operated by A2Z Agentic Solutions Ltd. Your transcript is not sent to a third-party AI API and is not used to train a public model. Card payments are processed by Stripe, which acts as its own controller for payment data and may process it outside the UK. The desk is reached through a Cloudflare tunnel, which terminates and inspects TLS traffic in transit.
4. Lawful bases and retention
We process account, billing and audit records to perform the contract and to keep our legal and financial records. We process transcripts and SOP drafts to provide the Service you ask for. A2Z Agentic Solutions Ltd acts as the Data Processor under UK GDPR and processes that transcript only to run this desk. All data ingestion, model processing, and text inference occur strictly on our private sovereign UK nodes. Your proprietary data never leaves the UK jurisdiction and is never transmitted to third-party US cloud AI APIs. You retain 100% ownership as the Data Controller. A stored transcript copy is removed when that organisation next opens the desk, if that folder is older than 6 years, unless the organisation deletes the copy sooner. Nothing removes it on a timer while the desk is idle. Removing the copy does not remove the audit log or an exported SOP file. Audit log lines are retained with the service's audit trail and are not removed when stored copies are deleted. Encrypted backups are kept under the operator's backup-retention schedule and are not selectively edited for individual deletion requests.
5. Your rights
Under UK GDPR you can request access to, rectification or erasure of personal data we hold about you, restriction of or objection to processing, and portability where applicable. Email Archie@a2zagentics.net from the address on the account; we verify the request against the account before acting. Erasure of customer content is actioned by a named administrator; audit and billing records required for our legal obligations are retained.
6. Security and honesty limits
We apply access controls, organisation-scoped data isolation, upload type/size limits, and encrypted backups where configured. The desk currently runs on a single computer and cannot promise continuous availability or certified compliance regimes. We do not claim ISO 27001 certification, SOC 2, or Cyber Essentials on this page.
7. Complaints
You can complain to us first at Archie@a2zagentics.net. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection.
8. Status of this notice
Version 2026-10-28-sop. This notice describes the Service as actually deployed. It was prepared without solicitor review and may be updated following legal review of retention wording.