Privacy Policy

Depending on how you use AEGIS, we may process:

• Session messages. During a training drill, the messages you send are processed to generate the AI’s responses. For our conversational drills this happens on a per-request basis and we do not keep your individual messages afterwards. In some structured training modes, the messages exchanged in a session are stored as a session transcript so the session can be reviewed.
• Debrief records. When you complete a session, we store a debrief record: the narrative debrief and related signal metadata (such as how the session ended, its tone, and the types of signals detected). This drives your feedback and, for organisations, aggregate reporting.
• Drill decisions. In verification / media drills we store the choices, scores, and reasoning you submit for each item.
• Organisation attribution. If you belong to a Team or Enterprise organisation, sessions you run are linked to that organisation and its programme (see section 4).
• Feedback. If you send feedback, we store the text you write, an optional rating, the page or mode you were on, a shortened version of your browser’s user-agent string, and your user ID if you are signed in.
• Message Scanner submissions. Text, images, or audio you submit to the scanner are processed to produce your analysis (audio is transcribed to text first). These submissions are not stored by us after the analysis is returned — they are held only in memory for the duration of the request.
• Account data. If you create an account, we store your email address and a securely hashed (never plaintext) password, plus session records to keep you signed in.

You can use many drills without an account. When an anonymous session is completed, the debrief record is stored without any link to an account — there is no user identity attached to it, so we cannot associate it with you. It contributes only to anonymous volume and quality metrics.

• To provide the service — running drills, generating debriefs, analysing scanner submissions, and managing licences and accounts. Lawful basis: contract.
• To improve and protect the product — reviewing feedback, understanding aggregate usage, and preventing abuse (including rate-limiting by IP address). Lawful basis: legitimate interests.
• Where you have given consent — for any processing that relies on your consent, which you may withdraw at any time.

If you use AEGIS as part of a Team or Enterprise organisation, please be aware: your session debriefs and performance signals are linked to your organisation and are visible to the administrators and analysts of that organisation through their dashboard. This includes debrief summaries and the behavioural signals derived from your sessions. If you do not want your training activity to be visible to your organisation, do not run sessions while signed in to that organisation’s account.

We use trusted providers to run AEGIS. They process data on our instructions:

• OpenRouter — routes your messages and scanner text to AI model providers to generate responses and analysis.
• Groq — transcribes audio you submit to the Message Scanner.
• Vercel — hosting and infrastructure (and privacy-friendly, cookieless usage analytics).
• Neon — our managed PostgreSQL database, where stored records (debriefs, accounts, feedback) live.
• Stripe — payment processing. Card details are handled directly by Stripe and never reach AEGIS’s servers.

Some of these providers — in particular the AI model providers reached via OpenRouter, and transcription via Groq — may process your content on servers outside the UK. Where personal data is transferred internationally, we rely on appropriate safeguards (such as UK-approved standard contractual clauses or an adequacy decision) as required by UK data-protection law.

• Debrief records and session data are retained until you (or, for organisation members, your organisation) ask us to delete them, or your account or organisation is closed.
• Anonymous session debriefs are stored without any account linkage and cannot be traced back to an individual.
• Feedback is retained so we can act on it and track product quality over time.
• Message Scanner submissions are not retained after your analysis is produced.
• Sign-in sessions expire automatically (currently after 14 days).

Under UK GDPR you have the right to access, correct, delete, or port your personal data, to object to or restrict certain processing, and to withdraw consent where processing relies on it. To exercise any of these, email hello@imelabs.co.uk.

If you are unhappy with how we handle your data, you can complain to the UK’s data-protection regulator, the Information Commissioner’s Office (ICO), at ico.org.uk. We’d appreciate the chance to resolve it first.

We keep our use of cookies to the essentials:

• aegis_session — an essential, secure, HTTP-only cookie that keeps you signed in.
• aegis_license — an essential, secure, HTTP-only cookie that remembers, in a signed form, that you have activated a paid licence in this browser.

We also store a couple of small interface preferences (for example, whether you have dismissed an explainer) in your browser’s local storage. These stay on your device and are never sent to us. We use Vercel’s privacy-friendly analytics, which do not use cookies to track you across sites, and we do not use advertising or cross-site tracking cookies.

AEGIS is intended for adults and is not directed at children. We do not knowingly collect personal data from anyone under 18.

We may update this policy from time to time. When we do, we will revise the “Last updated” date above.

For any privacy question or request, contact IME Labs at hello@imelabs.co.uk.