Privacy Notice

Premo AI Ltd, trading as Premoloop, is registered in England and Wales (company number 17407055) at 66 Paul Street, London, EC2A 4NA, and operates premoloop.ai. This notice explains what happens to information when you visit our site, sign up for a trial, use the Services as a subscriber, or leave feedback for one of our subscribers as an End Customer.

Depending on which of those you're doing, we act either as the data controller (we decide why and how the information is used) or as a data processor, acting on a subscriber's instructions. Section 5 explains which applies to you.

This notice covers three groups of people: visitors to our marketing site, businesses who hold a Premoloop subscription (and the staff they give access to), and End Customers, the people a subscriber has done work for, who are invited to leave feedback through a tap card, QR code or link. Where the position differs between these groups, we've said so below.

If you allow analytics in our cookie banner, we record which pages are viewed, with your device type and browser, to understand how the site is used. We use PostHog for this, on its EU hosting. It records only the page address and never what you type or search for, and uses your IP address to estimate your country and town without keeping it. If you don't allow it, nothing is recorded. We don't run advertising trackers, and we don't sell browsing data to anyone.

If you fill in a contact form, book a demo, or email us, we collect what you give us: your name, business name, email address and whatever you tell us, so we can reply. We use this for the enquiry it was given for and don't add it to a marketing list without asking you first.

If you join our waiting list, we keep your email address, business name and trade so we know who is waiting. We only email you if you tick the box asking to hear from us, and only once you have confirmed your address from the email we send straight after. That consent is our basis for writing to you. Every email we send carries an unsubscribe link that works in one click. Once you use it we add your address to a do-not-email list, so it is never emailed again even if it is signed up a second time. Your waiting-list details are deleted 30 days after you unsubscribe, or after 24 months if you never do. We never buy, rent or borrow email lists.

When you create a Premoloop account, we collect your name, business name, email address, phone number and postal address for card dispatch. Payment is handled by Stripe, our payment processor. We see that a payment succeeded or failed, but we don't receive or store your card details ourselves.

We use this information to provide the Services, bill your subscription, send you service updates (like a receipt or a notice that a card has shipped), and respond when you contact support. We rely on the fact that this processing is necessary to perform our contract with you, and on our legitimate interest in running and improving the Services.

To see which parts of Premo are used and where people get stuck, we record product events when you use your account, such as creating a job, inviting a colleague or asking Premo a question. In your browser this only happens if you allow analytics; a few events about your account as a whole, such as creating it and the cost of Premo's answers, are recorded by our servers. These carry your account and business identifiers and counts, never your name, email address, phone number, feedback text or the words of a question. We use PostHog for this, on its EU hosting, in the same way as for site visitors in section 3. It isn't loaded on the pages End Customers see, or on links sent by email.

If you've tapped a card, scanned a code, or clicked a link from one of our subscribers, the business you dealt with, not Premo, decides why your feedback is collected and is responsible for your data as its controller. We process it on that business's instructions, as a processor, under a data processing agreement with them.

The page may also show the name of the person or people who did the work on your job, if they're still with the business.

What we collect from an End Customer, when feedback is given, is deliberately narrow:

• your first name, so the business knows which job the feedback relates to;
• your star rating and anything you choose to write;
• basic technical details (device type and time) to keep the service working and prevent abuse.

We don't ask for your postal address or your phone number. Your email is only collected if you tick one of two separate, unticked boxes: one asking the business to reply about that job, and one asking to hear from them again about their own offers and news. Neither box implies the other, and leaving both alone means we never hold your address at all.

If you tick the second box, the business keeps your address to contact you, and we still do not send you anything. They send it themselves, from their own mailing tool, so they may also hold your address somewhere we cannot see. Every message sent that way carries a link that takes you off the list we hold, and you can use it at any time without contacting anybody.

If you go on to leave a review on Google, that happens on Google's own service, under Google's own privacy policy. We only record that the link was opened, not what you wrote there.

We only process personal data where the law gives us a basis to do so:

• Contract, to create and run a subscriber's account, bill their subscription, and provide the Services they've signed up for.
• Legitimate interests, where a subscriber's interest in hearing about work carried out for their customers covers the name, rating and comment an End Customer gives. We also rely on legitimate interests to keep the Services secure and working properly, to understand how subscribers use the product so we can improve it, and to respond to enquiries.
• Consent, used for an End Customer's optional email address, in two separate purposes: a reply about that particular job, and hearing from the business again. Each has its own unticked box and its own record of the exact wording shown, so one tick never stands for two purposes. Both can be withdrawn at any time, and there is no bundled or pre-ticked consent anywhere in the product.
• Legal obligation, where we need to keep or disclose information to comply with the law, for example accounting and tax records.

We use cookies and similar browser storage in two groups. Strictly necessary ones keep you signed in, keep the site secure and remember the settings and cookie choices you make; they don't need your consent. Analytics, the PostHog cookie described in section 3, only runs if you allow it. We don't use any functional, marketing or advertising cookies.

Our Cookie Policy lists each cookie, what it's for and how long it lasts. You can change your choice at any time from Cookie preferences at the foot of every page or in your account menu; refusing analytics switches it off and removes its cookie. We ask again whenever what we use changes.

Feedback that identifies an End Customer is kept for 24 months from the date it's given, or for the period the subscriber sets (between 1 and 120 months), unless the subscriber deletes their account sooner. It is then anonymised: names, contact details, written comments and replies are removed, and only the scores are kept. We may keep anonymous, aggregated statistics, the kind that no longer identify anyone, for longer, to understand trends over time.

An address given to hear from a business again is kept on a different clock: for as long as that consent stands, until it is withdrawn. It is held on the End Customer's ongoing consent rather than as part of the feedback, so anonymising or deleting the feedback does not end the subscription, and ending the subscription does not remove the feedback.

When a subscription ends, we keep the Customer Data associated with it for 2 years, so the subscriber can export it or come back to it, and then delete it. Subscriber account and billing records are kept for as long as the law requires us to keep financial records, typically six years. Records of failed sign-in attempts are kept for 30 days, and our security log of account changes for 24 months.

Personal data is hosted in the United Kingdom or the European Economic Area, with service providers who are contractually required to protect it to the standard UK data protection law demands. A small number of providers process data in the United States: our payment processor, our staff sign-in provider, and the AI provider described in section 11. Those transfers are made under the UK Addendum to the European Commission's standard contractual clauses. No other personal data leaves the UK or EEA.

We don't sell personal data, and we don't share End Customer data with other businesses on the platform. We share information only where it's needed to run the Services:

• with the subscriber whose card or link you used, because they are the controller of your feedback;
• with Stripe, to process subscription payments;
• with PostHog, on its EU hosting, for the site and product analytics described in section 3 and section 4, which never includes End Customer data;
• with OpenAI, our AI provider, when a subscriber asks Premo a question about their feedback or asks it to draft a reply, as described in section 11;
• with Google Business Profile, Xero, QuickBooks or WhatsApp, only where a subscriber has connected that integration themselves, and only for the purpose that integration serves;
• with our hosting and infrastructure providers, who store and process data on our behalf under contract;
• with a regulator, law enforcement body or court, where we're required to by law.

Inside Premo, access to a subscriber's data is limited to staff at that business who are authorised to read feedback. Our own platform administrators can access data only for support and security purposes, and every such access is logged.

Premo, our AI assistant, reads feedback and drafts suggested replies and summaries. The models behind it are run by OpenAI, who process the text on our behalf under contract and are forbidden from using it to train their models. Names, email addresses and contact details are removed before anything is sent. OpenAI processes the text in the United States, under the safeguards in section 9. Premo does not make any automated decision that produces a legal or similarly significant effect about an End Customer, and nothing it drafts is sent, posted or published without a person at the subscriber's business reviewing and approving it first. If you have questions about how Premo processes feedback, contact us using the details in section 13.

We encrypt personal data at rest and in transit, take daily backups, and restrict access to what each system and person genuinely needs. No system is completely without risk, and if we ever become aware of a personal data breach likely to affect your rights, we'll notify the Information Commissioner's Office and, where required, tell you directly, in line with our legal obligations.

Under UK data protection law, you have the right to:

• ask us for a copy of the personal data we hold about you;
• ask us to correct information that's inaccurate or incomplete;
• ask us to delete your data, in certain circumstances;
• ask us to restrict, or object to, certain kinds of processing;
• ask for your data in a portable format, where we process it based on your consent or a contract with you;
• withdraw consent at any time, where we rely on consent, for example the End Customer follow-up email;
• complain to a supervisory authority.

If your feedback was given to one of our subscribers, they are the controller, so it's usually quickest to contact that business directly. You're also welcome to contact us at [email protected] and we'll either action your request, where we're the controller, or pass it promptly to the relevant subscriber, where they are.

If you're not satisfied with how we've handled your request, you can complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk or on 0303 123 1113.

The Services are intended for use by adults acting for a trade business, and by their adult customers. We don't knowingly collect personal data from children, and Premoloop is not directed at them.

We may update this notice as the Services change or the law requires. Meaningful changes will be reflected here with a new “last updated” date, and where a change affects how we handle End Customer consent, the version of the notice shown at the time is recorded against that consent, so a change here never rewrites what someone actually agreed to in the past.

For anything in this notice, email [email protected], or write to Premo AI Ltd, 66 Paul Street, London, EC2A 4NA. If you're contacting us about feedback you gave to a specific business, tell us which one and we'll get to the right place quickly.