Ayoob AI

Privacy Policy

Last updated: 16 October 2026

1. Who we are

Ayoob AI Ltd ("Ayoob AI", "we", "us") is a company registered in England and Wales under company number 15931832, with its registered office at 113 New Bridge Street, Innovation Northumbria Incubator, Newcastle upon Tyne, NE1 8ST.

We handle personal data in two distinct capacities:

  • As a data controller, for personal data collected through this website and in the course of running our business.
  • As a data processor, for personal data we handle on behalf of clients when delivering our services. In those engagements the client is the controller and determines the purposes of the processing. See Section 5.

We are registered with the Information Commissioner's Office under registration reference ZB923967.

Data protection contact. Husain Ayoob, who leads data protection at Ayoob AI. We are not required to appoint a statutory Data Protection Officer and have not done so.

Email: contact@ayoob.ai

113 New Bridge Street, Innovation Northumbria Incubator, Newcastle upon Tyne, NE1 8ST

2. What data we collect through this website

Where we act as controller for this website, we collect:

  • What you send us. If you use the contact form or book a call: your name, work email, company, phone number (optional), the kind of engagement you are interested in, your message or notes, and the time you chose. If you used the ROI calculator and accepted cookies, the figures you entered are sent with your enquiry.
  • How you found us. The page you first landed on, the website that referred you and any campaign tags in the link you clicked. This is only sent to us if you submit the contact form or book a call. See our Cookie Policy.
  • How the site is used. Google Analytics measures page views and clicks. Until you choose on the cookie banner it sends only anonymous, cookieless measurements. If you accept, it uses cookies, and Microsoft Clarity records clicks, scrolling and page layout. If you decline, neither runs at all.
  • Server records. Like any website, our hosting provider records each request to the site, including your IP address and browser type, to run and protect the site.

We do not collect data from minors and our services are not directed at individuals under 18.

Personal data we process on behalf of clients is described separately at Section 5.

3. How we use your data

We process personal data collected through this website for the following purposes:

  • To respond to your enquiry and hold the call you booked. Lawful basis: legitimate interest (Art. 6(1)(f) UK GDPR), in replying to people who contact us
  • To know which pages and campaigns bring enquiries. Lawful basis: legitimate interest (Art. 6(1)(f) UK GDPR)
  • To measure how the site is used, with anonymous measurements before you choose. Lawful basis: legitimate interest (Art. 6(1)(f) UK GDPR), under the statistical purposes exception in the Privacy and Electronic Communications Regulations. Pressing Decline stops it.
  • Analytics cookies and Microsoft Clarity. Lawful basis: consent (Art. 6(1)(a) UK GDPR), which you can withdraw at any time
  • To run and secure the website. Lawful basis: legitimate interest (Art. 6(1)(f) UK GDPR)
  • To provide requested services. Lawful basis: performance of a contract (Art. 6(1)(b) UK GDPR)
  • To comply with legal obligations. Lawful basis: legal obligation (Art. 6(1)(c) UK GDPR)

You do not have to give us any information, but we need your name and email to reply to an enquiry. We do not use website data for automated decision-making or profiling.

4. Cookies

We store one essential item to remember your cookie choice. Analytics cookies (Google Analytics and Microsoft Clarity) are only set if you press Accept on the cookie banner, and you can change your choice at any time. We do not use advertising cookies. The embedded Google Map on our contact and location pages is provided by Google. For full details, see our Cookie Policy.

5. Personal data we process on behalf of clients

When we deliver services to a client, we may process personal data on that client's behalf. In those engagements:

  • The client is the data controller and determines the purposes of the processing. We act as processor and process personal data only on the client's documented instructions, unless required to do otherwise by law.
  • Every such engagement is governed by a written data processing agreement meeting the requirements of Article 28 UK GDPR, setting out the subject matter, duration, nature and purpose of the processing, the categories of personal data and data subjects, and the obligations of each party.
  • We do not use client personal data for our own purposes, for marketing, for demonstration, or for any purpose outside the scope agreed with the client.
  • We do not sell client personal data under any circumstances.

Processing location. The location of processing is agreed with the client at the outset of each engagement. Where a client requires that personal data is processed and stored solely within the United Kingdom, we deliver on that basis and no personal data leaves the United Kingdom.

Third-party AI and cloud services. Some engagements involve third-party cloud or artificial intelligence services. Where they do, those providers are agreed with the client in advance, are bound by written data processing terms, and are recorded in the engagement documentation. Where a client requires that no personal data is transmitted to any third-party model provider, we deliver using locally hosted models on infrastructure we control.

Sub-processors. We carry out due diligence on any sub-processor before engagement and put in place a written agreement imposing obligations equivalent to those we owe the client. Clients are notified of sub-processors in accordance with their data processing agreement.

Retention and return. Client personal data is retained only for as long as necessary to deliver the engagement, and is returned or securely deleted at the end of the engagement or earlier on the client's instruction. Confirmation of deletion is provided on request.

Data subject rights. Where we receive a request from an individual relating to personal data we process on behalf of a client, we refer that request to the client without undue delay and assist the client in responding.

If you believe we process your personal data on behalf of one of our clients, please contact that organisation in the first instance. You may also contact us at contact@ayoob.ai and we will direct your request appropriately.

6. Data sharing

We do not sell your personal data. Where we act as controller, we may share data with:

  • Email service providers. Resend, to deliver your contact form submission to our team, and Microsoft 365, our team's email
  • Calendar and meeting providers. Microsoft 365 (Outlook and Teams), to schedule and hold a discovery call you book on this site. Your name, email and the details you give are added to the calendar invitation
  • Analytics providers. Google Analytics and, only if you accept cookies, Microsoft Clarity, as described in our Cookie Policy
  • Hosting providers. Google (Firebase App Hosting) hosts this website
  • Professional advisers. Where necessary for legal, accounting or insurance purposes
  • Legal authorities. Where required by law

All third-party processors are bound by data processing agreements and process data only on our instructions.

7. International transfers

We operate from the United Kingdom.

Client service data. The processing location for each client engagement is agreed with the client, as described at Section 5. Where an engagement requires United Kingdom only processing, no personal data is transferred outside the United Kingdom.

Website and business data. Google, Microsoft and Resend are based in the United States and certified under the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"), which UK law recognises as giving adequate protection. Where personal data is transferred outside the United Kingdom on any other basis, we ensure an appropriate transfer mechanism is in place in accordance with UK GDPR, such as the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment where required.

8. Data retention

We retain contact form and booking data for a maximum of 24 months from the date of submission, or until the enquiry is resolved and any resulting engagement concludes, whichever is later. After this period, data is securely deleted.

Google Analytics keeps usage data for no more than 14 months. Our hosting provider's server records are kept for no more than 30 days.

Retention of personal data processed on behalf of clients is governed by the relevant data processing agreement, as described at Section 5.

9. Your rights

Under UK GDPR, you have the right to:

  • Access your personal data (Subject Access Request)
  • Rectify inaccurate personal data
  • Erase your personal data ("right to be forgotten")
  • Restrict processing of your personal data
  • Object to processing based on legitimate interest
  • Data portability. Receive your data in a structured, machine-readable format
  • Withdraw consent at any time, where processing is based on consent

To exercise any of these rights, email us at contact@ayoob.ai. We will respond within one month of receiving your request. Where a request is complex or where we have received a number of requests from you, we may extend this by up to a further two months and will tell you within one month if we do.

10. Security

We implement appropriate technical and organisational measures to protect personal data. Ayoob AI holds ISO/IEC 27001:2022 certification and Cyber Essentials accreditation.

Our measures include:

  • Encryption of personal data in transit using TLS, and at rest
  • Access control on a least privilege basis, restricted to named authorised personnel
  • Access logging and monitoring
  • Documented incident management within our certified information security management system
  • Regular review of technical and organisational measures

11. Personal data breaches

We maintain a documented process for identifying, containing, assessing and reporting personal data breaches.

Where we act as controller and a breach is likely to result in a risk to the rights and freedoms of individuals, we report it to the Information Commissioner's Office within 72 hours of becoming aware, in accordance with Article 33 UK GDPR. Where a breach is likely to result in a high risk, we notify affected individuals without undue delay in accordance with Article 34 UK GDPR.

Where we act as processor on behalf of a client, we notify that client without undue delay on becoming aware of a personal data breach, and within any shorter period specified in the relevant data processing agreement, and provide all reasonable assistance in their investigation and reporting.

All personal data breaches are recorded in a breach register, whether or not they are reportable.

12. Complaints

If you are unhappy with how we handle your data, please contact us first at contact@ayoob.ai so that we can try to resolve it. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you updated, and tell you the outcome.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.

13. Changes to this policy

We may update this policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this policy periodically.