Privacy Notice
PRIVACY NOTICE
Metadat-AI | Version 1.4 | Last updated: November 2026 | www.metadat-ai.com/legal/privacy
1. Who We Are and How to Contact Us
This Notice is issued by METADAT-AI LTD (Company No. 17486598), whose registered office is at 17 Cowdenbeath Path, London, N1 0LE (“Metadat-AI”, “we”, “us” or “our”). We operate an AI-powered media metadata and automation platform at www.metadat-ai.com.
We are registered as a data controller with the Information Commissioner’s Office (ICO). Our registration number is ZB864419.
We have not appointed a statutory data protection officer. Our Data Protection Lead, Damon Neale (CEO), is responsible for data protection and can be contacted at legal@metadat-ai.com.
Questions about this Notice or how we handle your personal data:
-
Email: legal@metadat-ai.com
-
Post: METADAT-AI LTD, 17 Cowdenbeath Path, London, N1 0LE
2. Scope of This Notice
This Notice covers personal data we collect and process as a data controller in connection with:
-
Use of our website www.metadat-ai.com and any associated subdomains;
-
Use of the Platform and API by subscribing organisations and their authorised users;
-
Enquiries, commercial relationships and communications with customers, resellers, introducers, partners and suppliers.
This Notice does not cover processing of personal data contained within content that customers upload to the Platform for analysis (for example, video or audio files containing images of individuals). For that processing we act as a data processor on the customer’s instructions; the customer is the data controller and must provide its own privacy notices to the individuals depicted. Our processor obligations are set out in our Data Processing Agreement (DPA).
3. Personal Data We Collect
3.1 Platform Authorised Users
When an organisation subscribes to our Platform, we process the following data about its designated users:
| Category | Examples |
|---|---|
| Identity data | Name, job title, role |
| Contact data | Work email address, telephone number |
| Account credentials | Encrypted password hash, two-factor authentication settings |
| Usage and activity data | Login timestamps, API call logs, features accessed, files uploaded or analysed |
| Technical data | IP address, browser type, operating system, session identifiers |
| Communications | Support tickets, in-app messages, feedback |
3.2 Customer and Partner Business Contacts
We collect and process contact information about individuals at our customers, resellers, introducers and other business partners, including: names, job titles, work email addresses, telephone numbers, company and registered address details, billing contacts, and correspondence and contractual records.
3.3 Website Visitors
-
Technical data: IP address, browser type, referring URL, pages visited, time on page
-
Cookie data: see Section 10 below
-
Contact form or email data: name, email address and the content of your enquiry
3.4 Job Applicants
If you apply to work with us, or work for us, our Staff and Candidate Privacy Notice explains how we use your personal data. We give it to you when you apply or join.
3.5 Where We Get Your Data
We collect most data directly from you. Data about platform users and business contacts may also be provided by your organisation, or by the reseller through which your organisation subscribes. Providing account data is necessary to use the Platform; otherwise providing data to us is voluntary.
3.6 Biometric Data
The Platform includes optional facial recognition and person-identification features. Where a customer uses these features, the resulting biometric data (facial geometry extracted from images or video frames) is processed on the customer’s behalf under their instructions; the customer is the data controller for that processing. Where we use these features in our own demos or marketing materials (as data controller), we do so only with the explicit consent of the individuals concerned.
3.7 AI Systems
We give customers that use our facial recognition and age and gender estimation features Instructions for Use that explain the features' limitations and the human oversight they require. Customers that use them are responsible for telling affected individuals where the law requires. We do not use AI outputs to make decisions about you that have legal or similarly significant effects without human involvement.
4. Lawful Basis for Processing
| Lawful Basis | Activity | Reference |
|---|---|---|
| Performance of a contract | Providing the Platform; managing user accounts; billing and subscription management | Art. 6(1)(b) UK GDPR |
| Legitimate interests | Security monitoring; fraud prevention; analytics; business contact management; service improvement; communicating with prospective and existing customers | Art. 6(1)(f) UK GDPR. We balance our interests against your rights before relying on this basis. |
| Legal obligation | Tax, accounting and regulatory record-keeping; responding to lawful disclosure requests | Art. 6(1)(c) UK GDPR |
| Consent | Non-essential cookies; marketing emails; biometric processing in our own demos | Art. 6(1)(a) / Art. 9(2)(a) UK GDPR. You may withdraw consent at any time. |
5. How We Use Your Personal Data
5.1 Providing and managing the Platform
-
Creating and maintaining your user account and processing your subscription
-
Authenticating your identity on login
-
Providing technical support and responding to service requests
-
Sending service-critical communications (security alerts, maintenance notices, invoices)
5.2 Security and fraud prevention
-
Monitoring for unauthorised access, abuse or security incidents
-
Detecting and investigating suspicious activity and data breaches
5.3 Analytics and service improvement
-
Understanding how users interact with the Platform to improve features and experience
-
Generating aggregated, anonymised usage statistics (which are not personal data)
-
Testing new features and identifying technical issues
5.4 Commercial relationships
-
Managing contracts with customers, resellers and other partners
-
Processing invoices and maintaining financial records
-
Communicating about renewals, changes to terms and pricing, and new products
5.5 Marketing
With your consent (or where we have a legitimate interest and you have not opted out), we may send you information about our products, events and updates. You may unsubscribe at any time by clicking the unsubscribe link in any email, or by emailing legal@metadat-ai.com.
6. Data Sharing
We do not sell your personal data. We share it only in the following circumstances.
6.1 Technology sub-processors
We use third-party service providers who process personal data on our behalf under our instructions and appropriate data processing agreements. They provide cloud hosting and storage (Amazon Web Services, eu-west-1, Ireland), database services (MongoDB Atlas, hosted in AWS eu-west-1), email and productivity tools (Amazon Web Services and Microsoft 365), software development and support (contractors in the UK, the United States and India), and AI tools for internal operations, such as reviewing code and system logs (Anthropic), managing our customer relationship records and business email (Anthropic and xAI) and handling support tickets (Google). For this website we also use Vercel (website hosting), Cloudflare (a spam check on the contact form) and Resend (delivery of contact form messages to us).
The full list is in our Sub-processor Register at www.metadat-ai.com/legal/sub-processors. We do not use a third-party payment processor.
6.2 Professional advisers
We may share personal data with our lawyers, accountants, insurers and other advisers where necessary for professional advice or legal proceedings.
6.3 Legal and regulatory disclosures
We will disclose personal data where required by law, court order or a regulatory authority (including the ICO), or to protect our rights, safety or property.
6.4 Business transfers
In a merger, acquisition or asset sale, personal data may transfer to the acquiring entity subject to the same protections as in this Notice. We will provide reasonable prior notice where required by law.
7. International Transfers
We process personal data primarily in the United Kingdom and EEA. Our production systems are hosted in Ireland (AWS eu-west-1), which is in the EEA and does not involve a restricted international transfer under UK law. Our development, demonstration and trial environment runs on our own Mac Studio hardware at our registered office in London. It is never used for production, but personal data may be processed there for authorised trials and demonstrations under our Demonstration and Trial Policy. Some service providers, including Anthropic, xAI and Google, are in the United States; where personal data is transferred to them, we use a transfer mechanism permitted by UK data protection law, such as the UK-US data bridge or the International Data Transfer Addendum.
Some of our software development and support contractors are based in the United States and India and may access personal data held on our systems where necessary to maintain and support our services. Where we transfer personal data outside the UK or EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses with the UK Addendum. Details of safeguards are available on request.
8. How Long We Keep Your Data
| Data Type | Retention Period | Reason |
|---|---|---|
| Authorised user account data | Duration of subscription + 6 years after termination | Contract; legal obligation (Companies Act, HMRC) |
| Usage and activity logs | 12 months | Security; service improvement |
| Customer / partner contact data | Duration of relationship + 6 years | Legal obligation; legitimate interests |
| Billing and payment records | 6 years from relevant transaction | Legal obligation (HMRC, Companies Act) |
| Website contact enquiries | 2 years from last contact (or until resolved) | Legitimate interests |
| Marketing consent records | Until consent withdrawn + 12 months | Accountability (UK GDPR / PECR) |
| Security incident and data breach records | 5 years from closure | Legal obligation; legitimate interests |
Customer Content (uploaded files and AI outputs) is processed for our customers and deleted in line with their agreement and our Data Processing Agreement. Our Data Retention Policy is available on request from legal@metadat-ai.com.
9. Your Rights
You have the rights listed below under the UK GDPR and, where it applies to you, the EU GDPR. To exercise any right, email legal@metadat-ai.com. We will respond within one calendar month (extendable by two months for complex requests, with prior notice).
Right of access: Request a copy of the personal data we hold about you.
Right to rectification: Ask us to correct inaccurate or incomplete data.
Right to erasure: Ask us to delete your data where it is no longer needed, consent is withdrawn, or processing is unlawful.
Right to restriction: Ask us to limit processing in certain circumstances.
Right to data portability: Receive your data in a structured, machine-readable format where processing is based on consent or contract.
Right to object: Object to processing based on legitimate interests. We will stop unless we have compelling grounds that override your interests.
Right re: automated decisions: We do not make solely automated decisions producing legal or similarly significant effects without human involvement.
Right to withdraw consent: Withdraw consent at any time without affecting lawfulness of prior processing.
You also have the right to complain to the ICO: ico.org.uk | 0303 123 1113 | Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF. If you are in the EU, you may also complain to the data protection authority in your country. We would welcome the opportunity to address your concerns first.
10. Cookies
Our website uses cookies. Full details of the cookies we use, and how to manage them, are set out in our Cookie Policy at www.metadat-ai.com/legal/policies/cookies. In summary, we use two categories:
-
Strictly necessary cookies: required for the website and the platform to work, including keeping platform users signed in and security. Cannot be disabled.
-
Analytics cookies (Google Analytics 4, provided by Google Ireland Limited, with possible transfer to Google LLC in the United States under the EU-US Data Privacy Framework and its UK Extension): help us understand how visitors use the site. Set only with your consent.
On your first visit you will see a cookie consent banner. You may update your preferences at any time via ‘Cookie Settings’ in our website footer. Blocking certain cookies may affect site functionality.
11. Security
We use appropriate technical and organisational security measures, including encryption in transit and at rest and access controls. If a personal data breach is likely to result in a risk to your rights and freedoms, we will notify the ICO where required by law and, where required, notify affected individuals without undue delay.
12. Changes to This Notice
We may update this Notice from time to time. The current version will always be at www.metadat-ai.com/legal/privacy with the version number and effective date at the top. Where changes are material, we will notify affected individuals by email or by a prominent notice on our website.