Privacy Policy
Last updated: 27 July 2026
This Privacy Policy explains how Eden Foundry Ltd ("we", "us", "our"), trading as AI Navigator, collects and uses your personal data when you use this website (the "Service"). We are the data controller. Eden Foundry Ltd is a company registered in England and Wales (company number 17353098) at 2 Eden Heights, Culgaith, CA10 1QT, and is registered with the UK Information Commissioner's Office (registration ZC204816).
For any privacy question, or to exercise your rights, contact alex_j_mcintosh@yahoo.co.uk.
1. The data we collect
- Account data — your name, email address, and either a password (stored only as a secure hash) or your Google sign-in identifier.
- Business intake data — your onboarding answers (industry, size, activities, pain points, goals, optional website), and any document you choose to upload.
- Reports & activity — the reports we generate, your implementation progress, and your conversations with Nerys.
- Payment data — we use Stripe to take payments. We receive a customer reference and subscription status; we never see or store your full card details.
- Usage & device data — analytics events, pages visited, approximate location, device/browser, and referral/UTM source (via PostHog, with your consent). See our Cookie Policy.
- Session recordings & interaction data — if you consent to analytics cookies, PostHog records your sessions on the Service. A recording captures the pages you view, your clicks, scrolling and mouse movement, browser console messages, and page performance data. Because a recording reproduces what was displayed on your screen, it can include your onboarding answers and the reports we generate for you. Values you type into form fields — including passwords and any payment fields — are masked and are not recorded. We also produce aggregate heatmaps of where visitors click and scroll, and may show in-product surveys. We use this to diagnose faults and improve the Service. You can decline or withdraw consent at any time via "Cookie settings".
- Communications — emails we send you and your engagement with them.
2. How and why we use it
| Purpose | Lawful basis |
|---|---|
| Create and run your account; generate and store your reports | Performance of a contract |
| Take payment and manage subscriptions | Performance of a contract |
| Send service/transactional emails | Performance of a contract |
| Send marketing/lifecycle emails | Consent or legitimate interests (opt out any time) |
| Analytics and product improvement | Consent (cookies) / legitimate interests |
| Session recording, heatmaps and in-product surveys, to diagnose faults and improve usability | Consent |
| Security, fraud prevention, legal compliance | Legal obligation / legitimate interests |
3. AI processing
To generate your report and power Nerys, we send your business intake data (and any uploaded document) to our AI provider, Anthropic, for processing. We do not use your data to train AI models, and our providers are contractually restricted in how they may use it. Reports are AI-generated guidance — see our Terms of Service.
4. Who we share it with
We use trusted providers who process data on our behalf under data-processing agreements: Anthropic (AI generation), Stripe (payments), Resend (email), PostHog (product analytics, session recording and heatmaps), Sanity (content), Supabase (database), and Vercel (hosting). We do not sell your personal data.
5. International transfers
Some providers process data outside the UK, including in the United States. Where they do, transfers are protected by appropriate safeguards such as the UK International Data Transfer Agreement / Addendum or equivalent approved mechanisms.
6. How long we keep it
We keep your account and report data while your account is active. If you delete your account, your personal data and reports are deleted (subject to short backup retention and records we must keep by law, e.g. tax records). Uploaded documents are kept only as long as needed to generate and re-run your reports. Session recordings are kept only for as long as we need them to diagnose faults and improve the Service, after which they are automatically deleted by our analytics provider.
7. Your rights
Under UK GDPR you can access, correct, delete, restrict, or object to our use of your data, and request portability. Email alex_j_mcintosh@yahoo.co.uk to exercise these, or to withdraw consent. If you're unhappy with how we handle your data, you can complain to the ICO (ico.org.uk).
8. Changes
We may update this policy. Material changes will be notified by email or in-app, and the "last updated" date will change.