# Privacy Policy | Koso > How Ideanab Private Ltd (trading as Koso) collects, uses and protects personal data under the UK GDPR and the Data Protection Act 2018, including AI processing, sub-processors, international transfers and your rights. [](/) [Services](/#services)[AI OS](/ai-os)[Training](/training)[Education](/education)[Agents](/agents) … [Book a call ](/book) Privacy · United Kingdom # Privacy Policy. What personal data Ideanab Private Ltd holds when you use koso.ai, why we hold it, who else touches it, and the rights the UK GDPR and the Data Protection Act 2018 give you over it. Written to be read, not to be survived. Last updated **26 August 2026** · Ideanab Private Ltd (trading as Koso), registered in England and Wales no. 16344048 Contents 1. 1.[Who we are](#who-we-are) 2. 2.[What this policy covers](#scope) 3. 3.[The personal data we collect](#what-we-collect) 4. 4.[Why we use it, and our lawful basis](#lawful-basis) 5. 5.[How AI processing works here](#ai-processing) 6. 6.[Cookies and similar technologies](#cookies) 7. 7.[Who we share it with](#sharing) 8. 8.[Sending data outside the UK](#transfers) 9. 9.[How long we keep it](#retention) 10. 10.[How we protect it](#security) 11. 11.[Your rights](#your-rights) 12. 12.[Children](#children) 13. 13.[Other sites and embedded services](#other-sites) 14. 14.[Changes to this policy](#changes) ## 01Who we are Koso is the trading name of Ideanab Private Ltd, a company incorporated in England and Wales. For the personal data described in this policy we are the **data controller**: we decide why and how it is processed. Ideanab Private Ltd Trading as Koso (koso.ai) A private limited company registered in England and Wales, company number 16344048 Registered office: 124 City Road, London, EC1V 2NX, United Kingdom Public record: [Companies House register](https://find-and-update.company-information.service.gov.uk/company/16344048) Email: aashish \[at\] koso.ai We are not required to appoint a statutory Data Protection Officer. Our founder is accountable for data protection, and every request sent to the address above reaches a person rather than a queue. ## 02What this policy covers This policy applies to koso.ai and everything we run on it: the marketing pages, the free AI agents at [koso.ai/agents](/agents), the contact form, call bookings, the careers section, the meeting-notes area, and the voice assistant embedded on the site. It also covers the personal data we hold about prospective, current and former clients and the people who work for them. Where we build or run AI systems for a client, that client normally decides what happens to the data inside their own system. In that case they are the controller and we act as a **processor** on their written instructions, under the data-processing terms in our engagement contract. This policy describes our own processing, not theirs. ## 03The personal data we collect ### Information you give us * **Enquiries.** Your name, email address, company name, website and the message you write in the contact form. * **Call bookings.** Your name, email address, the slot you choose, the questions you answer beforehand and anything you add as context. * **Agent sign-in.** Your name and email address, plus the one-time code we email to confirm the mailbox is yours. * **What you type into an agent.** Domain names, company names, website URLs, product descriptions and workflow descriptions, together with the result the agent produced and any share link or PDF generated from it. * **Job applications.** Your CV or profile links, work history, answers to the role questions, interview scheduling details and interview notes. * **Meetings.** Attendee names and email addresses, calendar details, and the notes, summaries and action points produced from a call you attended. * **Training and education clients.** Delegate lists, attendance, and the details needed to invoice and deliver a programme. ### Information we collect automatically * Server logs: IP address, browser and device type, the pages requested, timestamps and referring URL. * Rate-limiting and abuse-prevention counters tied to your IP address or session. * The two strictly necessary cookies described in our Cookie Policy. ### Information from other sources * Publicly available business information about a company you asked an agent to research, or about a company that has approached us (websites, registers, filings, job boards, news). * An email deliverability check that tells us whether an address is real and not disposable, before we send a code or a confirmation to it. * Calendar and meeting platform data when you accept an invitation from us. We do not ask for special category data. Health, ethnicity, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation, and criminal offence data have no place in a contact form or an agent prompt. Please do not send them to us, and do not paste anyone else's personal data into an agent. ## 04Why we use it, and our lawful basis Under Article 6 of the UK GDPR every use of personal data needs a lawful basis. Ours are set out below. | What we do | Personal data used | Lawful basis | | --------------------------------------------------------------------------------------------- | ---------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Answer your enquiry and follow it up | Name, email, company, website, message | Legitimate interests: replying to someone who contacted us about our services. Steps at your request prior to a contract, where the enquiry is about buying from us. | | Run and confirm a booked call | Name, email, slot, context you gave | Steps taken at your request before entering into a contract. | | Give you access to the free AI agents and your run history | Name, email, one-time code, run inputs and results | Performance of a contract: providing the service you asked for on our terms. | | Keep the agents from being abused (rate limits, disposable-mailbox checks, free-run tracking) | IP address, session identifiers, email address | Legitimate interests: keeping a free service available and paying for its compute honestly. | | Deliver client work, training and education programmes | Contact and delegate details, project data | Performance of a contract with you or your employer. | | Assess a job application and arrange interviews | Application, CV, interview notes and scheduling data | Steps at your request before entering into an employment contract, and our legitimate interest in recruiting. | | Produce and share meeting notes with the people who were on the call | Attendee names, emails, meeting content | Legitimate interests: an accurate record of a meeting for the people who attended it. | | Send you a marketing email about a service close to one you have already discussed with us | Name, email | Legitimate interests, within the soft opt-in permitted by PECR. Every message has an unsubscribe link; otherwise we rely on your consent. | | Keep accounting, tax and contractual records | Billing and contract data | Legal obligation, principally under the Companies Act 2006 and tax law. | | Protect the site, investigate incidents and establish or defend legal claims | Logs, correspondence, account data | Legitimate interests, and legal obligation where an authority requires it. | Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and concluded it is not for the narrow purposes above. You can object at any time (see [your rights](#your-rights)), and we will stop unless we have compelling grounds to continue. Where we rely on consent, you can withdraw it at any time without affecting anything we did before you withdrew it. ## 05How AI processing works here We build AI systems, so we owe you a plain account of what happens when text you type reaches one. * What you type into an agent, and the public web pages the agent fetches while working on it, are sent to third-party model providers so the model can generate a result. Those providers process the text to return an answer to us. * Our model providers do not use data submitted through their business APIs to train their models by default, and we have not opted in to any such training. * We store your run and its result so your history works, so a share link keeps resolving, and so we can debug a run that went wrong. A member of our team can read a stored run for support, safety and quality purposes. * AI output is generated text. It can be wrong, out of date or incomplete, and two people asking the same question may get different answers. Nothing an agent produces is professional, legal, financial or investment advice. * We do not make decisions about you that produce legal or similarly significant effects on the basis of automated processing alone, and we do not use your inputs to build a profile of you. Treat an agent prompt as a public-facing sentence. Do not paste confidential material, credentials, or personal data about other people into an agent. If you need to run our models over sensitive data, that is a client engagement with a data-processing agreement behind it, not a free tool. ## 06Cookies and similar technologies This site sets two strictly necessary cookies and stores one item in your browser's local storage. We run no advertising, profiling or analytics cookies, which is why you are not met by a consent banner. The detail, including how to refuse them, is in our [Cookie Policy](/cookies). ## 07Who we share it with We do not sell personal data, and we do not share it for anyone else's marketing. We do rely on a small set of service providers who process personal data on our instructions under a written contract that meets Article 28 of the UK GDPR. | Provider | What it does for us | Where it processes data | | ----------------------------------- | --------------------------------------------------------------------------------- | -------------------------------- | | OpenAI | The language models behind the AI agents and the live contact-form read | United States | | ElevenLabs | The optional voice assistant embedded on the site | United States | | Supabase (on AWS) | The application database: enquiries, accounts, agent runs, bookings, applications | Asia Pacific (Mumbai) region | | Hostinger | Application hosting and server logs | European Union | | Brevo | Transactional email: sign-in codes, confirmations, notifications | European Union | | Google (Workspace, Calendar, Fonts) | Our own mail and calendar, invitations, and the web fonts the site loads | European Union and United States | | Zoom | Video calls and, where applicable, recordings of a call you attended | United States | | Granola | Meeting notes taken from calls we attend | United States | | Tavily | Live web search inside the research agents | United States | | Reoon | Checking that an email address is real and not disposable | Outside the UK | | unpkg / Cloudflare | Serving the voice-widget script; your IP address is visible to the CDN | Global edge network | We will also disclose personal data where: * our professional advisers (lawyers, accountants, insurers) need it, under a duty of confidentiality; * the law, a court or a regulator requires it, or it is needed to establish or defend legal claims; * a buyer or successor needs it in connection with a sale or reorganisation of our business, subject to the protections in this policy. ## 08Sending data outside the UK Some of the providers above, and some of the colleagues who deliver our work, are outside the United Kingdom. Our team is distributed across several continents and our database is hosted in the Asia Pacific region, so personal data you give us is transferred abroad. Every such transfer relies on one of the safeguards Chapter V of the UK GDPR allows: * UK adequacy regulations, where the destination country has been recognised as providing an adequate level of protection (this covers the EEA); * the UK's International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment behind it; * the UK Extension to the EU-US Data Privacy Framework, where the receiving organisation is certified under it. Ask us at aashish \[at\] koso.ai and we will tell you which safeguard applies to a particular transfer and give you a copy of the relevant clauses. ## 09How long we keep it We keep personal data only as long as the purpose it was collected for requires, then delete it or strip it of anything that identifies you. | Record | Retention | | ------------------------------------------------------ | --------------------------------------------------------------------------------------------------------- | | Enquiries and booking requests that do not become work | Up to 24 months from our last exchange, then deleted | | Agent accounts and run history | While the account is in use, and up to 24 months after the last sign-in | | Anonymous agent runs and share links | Up to 12 months from the run | | Client project records and correspondence | For the engagement plus 6 years, matching the limitation period for a contract claim in England and Wales | | Accounting and tax records | 6 years from the end of the relevant accounting period, as UK law requires | | Unsuccessful job applications | 12 months from the decision, unless you ask us to keep you on file for longer | | Meeting notes | For the engagement plus 24 months, or until the attendees ask us to remove them | | Server and security logs | Up to 12 months | ## 10How we protect it * Everything travels over HTTPS, and the database is reached over an encrypted connection. * Sign-in uses a signed, HttpOnly session cookie and an emailed one-time code. We never store a password for the agents, because there isn't one. * Access to production data is limited to the people who need it to do their job, and secrets are held in the environment, never in the codebase. * Rate limiting, input validation and disposable-mailbox checks sit in front of the public endpoints. No system is perfectly secure. If a breach is likely to result in a risk to your rights and freedoms we will report it to the ICO within 72 hours of becoming aware of it, and tell you directly where the risk is high. ## 11Your rights Under the UK GDPR you have the right to: * **Be informed** about how your data is used, which is what this policy is for. * **Access** a copy of the personal data we hold about you. * **Rectification** of data that is inaccurate or incomplete. * **Erasure** of your data where we no longer need it, or where you withdraw the consent it rested on. * **Restrict processing** while a dispute about accuracy or legitimate interests is resolved. * **Data portability**: the data you gave us, in a structured, commonly used, machine-readable form. * **Object** to processing based on legitimate interests, and absolutely to direct marketing. * **Withdraw consent** at any time, where consent is what we relied on. * **Not be subject** to a solely automated decision with legal or similarly significant effect. We do not make such decisions. To exercise any of them, email aashish \[at\] koso.ai and say what you want. We may ask for enough information to confirm who you are. We answer within one month, and will tell you if a complex request needs up to two months more. Exercising your rights is free unless a request is manifestly unfounded or excessive. You can also complain to the Information Commissioner's Office, the UK supervisory authority, at [ico.org.uk/make-a-complaint/](https://ico.org.uk/make-a-complaint/), on 0303 123 1113, or by post to Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would rather you raised it with us first so we can put it right. ## 12Children Koso sells to businesses and institutions. The site and the agents are not directed at children, and we do not knowingly collect personal data from anyone under 18\. Where we run an education programme, we work through the school, college or university, and the institution remains responsible for the pupils' data. If you believe a child has given us personal data, tell us and we will delete it. ## 13Other sites and embedded services Our pages link to third-party sites (LinkedIn, Instagram, WhatsApp, Companies House and others) and embed a voice assistant and web fonts served by third parties. Once you follow a link or interact with an embedded service, that provider's own privacy notice governs what it does with your data. We are not responsible for their practices. ## 14Changes to this policy We update this policy when what we do with personal data changes, or when the law does. The date at the top of the page always reflects the current version, and this page is where the current version lives. Where a change materially affects you, we will tell you directly, by email where we have an address for you. This version is dated 26 August 2026. The rest of the legal set [Terms of ServiceThe contract that governs koso.ai, the free agents and anything you buy from us.](/terms)[Privacy PolicyWhat personal data we hold, why we hold it, and the UK GDPR rights you have over it.](/privacy)[Cookie PolicyThe two cookies this site sets, why they exist, and how to refuse them.](/cookies)[Acceptable Use PolicyWhat you may and may not do with the free AI agents and the rest of the site.](/acceptable-use) Questions about any of this? Legal, privacy and data-protection queries all go to the same place, and a person answers them. aashish \[at\] koso.ai[Contact form ](/contact) A custom AI development agency. Bespoke agents, copilots and products engineered for teams that want a moat, not a subscription. Ideanab Private Ltd is a company registered in England and Wales, no. [16344048](https://find-and-update.company-information.service.gov.uk/company/16344048). Registered office: 124 City Road, London, EC1V 2NX, United Kingdom. ### Company * [Services](/#services) * [Custom AI Agency](/custom-ai-agency) * [AI Product Development](/ai-product-development) * [AI OS](/ai-os) * [AI Engineering](/ai-engineering-company) * [AI Consulting](/ai-consulting-company) * [AI Consulting Services](/artificial-intelligence-consulting-services) * [Training](/training) * [Education](/education) * [Free AI Agents](/agents) * [Fractional CAIO](/caio) * [About Us](/about) * [Careers](/careers) ### Contact * [Contact us](/contact) * [Book a call](/book) * [LinkedIn](https://www.linkedin.com/company/koso) * [Instagram](https://www.instagram.com/okaashish) ### Legal * [Terms of Service](/terms) * [Privacy Policy](/privacy) * [Cookie Policy](/cookies) * [Acceptable Use Policy](/acceptable-use) © 2026 Koso, a brand of Ideanab Private Ltd. All rights reserved. [Terms of Service](/terms)[Privacy Policy](/privacy)[Cookie Policy](/cookies)[Acceptable Use Policy](/acceptable-use) Crafted with care · Built to compound