Privacy Policy

Based in India? See our India-specific Privacy Policy.

Last updated: 24 July 2026

Note: This is a drafted starting point, not a substitute for review by a qualified lawyer or data protection professional. It has not yet received legal review.

1. Who we are

StipuloReady is provided by Stipulo AI Ltd, a company registered in England and Wales (company number 17272510), registered office at 128 City Road, London, EC1V 2NX. Stipulo AI Ltd is the data controller for the personal data described below.

2. What we collect

Account information: email address, password (stored as a secure hash, never in plain text), company name, sector, registration number, and region.
Company profile information you choose to add: company overview, case studies, and standard policy text used to inform AI-drafted proposals.
Compliance documents you upload, and their associated category and expiry date.
Tender requirement text you paste or upload when generating an AI draft, and the resulting draft content.
Billing information: handled directly by Stripe, our payment processor — we do not store your card details ourselves.
Basic technical/log data (e.g. request timestamps) generated in the ordinary course of running the Service.

3. How we use it

We use this data to provide the Service: storing and tracking your compliance documents, sending expiry reminder emails (which you can turn off in Settings), generating AI-assisted draft proposals, processing subscription payments, and maintaining account security.

4. Legal basis

We process your data on the basis of performing our contract with you (providing the Service you've signed up for) and, where relevant, our legitimate interests in operating and improving the Service securely.

5. Third parties we share data with

We use the following third-party processors to provide the Service:

Neon — hosts our database (account data, document metadata, draft content).
Microsoft Azure — hosts our application and stores your uploaded compliance documents (in a private, non-public storage container).
Google (Gemini API) — processes the tender requirement text and company profile information you submit, in order to generate AI-drafted proposal content.
Stripe — processes subscription payments; we do not receive or store your full card details.
Google (Gmail) — sends transactional emails (verification, expiry reminders).

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes.

6. Data retention

We retain your account and document data for as long as your account is active. If you close your account, we will delete or anonymise your personal data within a reasonable period, except where we're required to retain certain records for legal or accounting purposes.

7. International transfers

Some of our processors (listed above) may process data outside the UK. Where this happens, we rely on the processors' own compliance with applicable data transfer safeguards (such as Standard Contractual Clauses).

8. Your rights

Under UK data protection law, you have the right to access, correct, or request deletion of your personal data, to object to or restrict certain processing, and to request a copy of your data in a portable format. To exercise any of these rights, contact us at hello@stipuloai.com. You also have the right to complain to the UK Information Commissioner's Office (ICO) if you believe your data has been mishandled.

9. Cookies and local storage

We use your browser's local storage to keep you signed in (storing your session token) — this is functionally necessary and not used for tracking or advertising. We do not currently use third-party analytics or advertising cookies.

10. Children's data

StipuloReady is a business-to-business service intended for use by adults acting on behalf of a business. It is not directed at children, and we do not knowingly collect data from anyone under 18.

11. Security

Passwords are stored as secure hashes, not plain text. Uploaded documents are stored in a private container and only ever accessed via short-lived, signed URLs. We use industry-standard practices to protect your data, though no system can be guaranteed 100% secure.

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date above.

13. Contact

Questions about this policy or your data: hello@stipuloai.com.