Privacy Policy

Who we are

Engramic Ltd is a company registered in England and Wales (Company No. 17033873). We are registered with the Information Commissioner's Office (ICO), registration number ZC194794. This policy covers our marketing website at www.engramic.ai and the Engramic platform at app.engramic.ai.

For the purposes of UK GDPR and the Data Protection Act 2018, Engramic Ltd is the data controller for the personal data described in this policy — your account, billing, enquiry and website data. For the content your team creates inside a workspace, the picture is different; we explain that in ‘Content you and your team add to Engramic’ below.

You can contact us about data protection matters at any time at [email protected].

What data we collect and why

Contact and waitlist enquiries

When you submit your details via the contact form on this website, we collect:

• Email address
• Name (optional)
• Company name (optional)
• Industry sector (optional)
• Company size (optional)

We use this to respond to your enquiry and to contact you about Engramic. Our legal basis is your consent, given when you submit the form and tick the consent box. Completing the form is entirely voluntary.

Platform account data

If you create an account, we collect your email address, name, and anything you choose to provide during onboarding. We use this to create your account, sign you in, and provide the service. Our legal basis is the performance of our contract with you. You do not have to give us personal data, but we need an email address to create and secure an account, so without it we cannot provide the platform.

Billing data

If you subscribe to a paid plan, our payment provider (Stripe) processes your payment details on our behalf. We do not see or store full card numbers. We keep a record of your plan, invoices and payment status to manage your subscription. Our legal basis is the performance of our contract and compliance with our legal obligations, such as keeping tax records.

Usage and analytics data

We collect information about how the website and product are used — such as pages visited and features used, and, on this marketing website only and only if you accept cookies, a replay of your visit — to understand what is helpful and improve it. Aggregate usage analysis relies on our legitimate interest in understanding and improving Engramic. Where this involves analytics or advertising cookies, we rely on your consent instead; see ‘Cookies and similar technologies’ below.

Content you and your team add to Engramic

Engramic is a place for your organisation to author its own knowledge. The content your team records — the graph, chats, documents and the memory built from them — belongs to your organisation, not to us.

For that content, your organisation is the data controller and Engramic acts as a data processor: we process it on your organisation's instructions to provide the service, and not for our own purposes. Where your organisation is a business customer, this processing is governed by our customer terms and, where applicable, a data processing agreement. If personal data about you sits inside a workspace that belongs to your employer or another organisation, they are responsible for it as controller, and any request about that data is best directed to them.

Do we use artificial intelligence?

Yes. Engramic's assistant, Alia, uses large language models to help you work with your knowledge — for example spotting gaps and contradictions, answering questions, and helping you prepare. To do this, the relevant workspace content and your request are sent to our AI provider, Anthropic, for processing.

Today, that AI processing takes place on Anthropic's infrastructure in the United States. See ‘Where your data is stored’ for the safeguards that apply to that transfer.

Two commitments matter here. First, your content is not used to train third-party AI models — it is processed only to produce the response you asked for. Second, Alia's outputs are suggestions: they are proposals for a person to review and approve, not automated decisions. We do not use AI to make decisions about you that produce legal effects or similarly significant effects without human involvement.

Google account and Google Calendar

Sign in with Google

When you sign in with Google, we receive your name and email address from your Google account. We use this only to create and identify your Engramic account. We do not access any other Google profile information.

Google Calendar (optional, read-only)

If you choose to connect your Google Calendar, we request read-only access to your calendar events. We use this solely so your in-app assistant (Alia) can help you prepare for upcoming meetings. Engramic never creates, edits, or deletes anything in your calendar. Connecting your calendar is optional, and you can disconnect it at any time.

How we handle this data

We use Google account and calendar data only to provide the features described above. We do not sell it, and we do not share it with third parties except as needed to operate the service or where required by law.

Limited Use

Engramic's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Revoking access

You can revoke Engramic's access to your Google account at any time via your Google Account permissions page (myaccount.google.com/permissions).

How long we keep your data

Contact enquiry data is retained for as long as it is relevant to an ongoing or potential business relationship, and no longer than three years from last contact.

Platform account data is retained for the duration of your account and for up to 12 months after account closure, unless a longer retention period is required by law (for example, billing records kept to meet tax obligations).

Analytics data is kept only as long as needed to understand product trends and is held in aggregate or short-lived form. You can ask us to delete your data at any time by contacting [email protected].

Who we share your data with

We do not sell your personal data. We share it only with service providers who help us run Engramic, and only as needed to provide the service. Each is bound by a data processing agreement and may process data only on our instructions. These include:

• Anthropic — AI inference for Alia
• Amazon Web Services (AWS) — platform hosting
• Cloudflare — delivery of our website and app
• Stripe — payment processing
• Google — website and product analytics (only with your consent)
• Microsoft — advertising measurement, and website analytics including heatmaps and session replay via Microsoft Clarity (only with your consent)
• Our email delivery provider — sending service and enquiry emails

We will also disclose personal data if required to do so by law or in response to a valid legal request.

Where your data is stored

Your platform data is hosted on Amazon Web Services in London, United Kingdom. Our website and app are delivered by Cloudflare, whose processing for us takes place in the European Union. Some of the providers above process data outside the UK — in particular, AI processing by Anthropic currently takes place in the United States, and Stripe, Google and Microsoft may process data in the United States.

Where personal data is transferred outside the UK, we rely on appropriate safeguards under UK data protection law — such as the UK Extension to the EU–US Data Privacy Framework, where the provider is certified under it, and/or the UK International Data Transfer Addendum to the European Commission's standard contractual clauses — as applicable to each provider.

For our website analytics specifically: for visitors in the UK and EEA, Google collects measurement data at regional collection points and does not log or store your IP address (it is used only transiently to derive coarse location, then discarded). Google nonetheless processes and stores analytics data on its servers globally, including in the United States, and no single storage region can be selected.

Cookies and similar technologies

By default this website sets only the essential cookies needed for it to work. We do not load any analytics or advertising cookies until you have accepted them.

On your first visit we show a short banner. If you accept, we load Google Analytics (to measure how the site is used) and Microsoft Advertising (UET, to measure the effectiveness of our ads); both set cookies. If you decline, neither loads and no such cookies are set. Your choice is stored on your own device, in your browser's local storage under the key engramic-cookie-consent — it is not itself a tracking cookie and is not sent to us.

Our Microsoft tag also feeds Microsoft Clarity, and that deserves saying plainly, because it does more than count visits. Clarity can record how a page is actually used — where you click, how far you scroll and how the pointer moves — and combine many visits into heatmaps, so we can see which parts of a page work and which ones confuse people. It masks the contents of form fields and drop-down menus, so what you type is not captured. This runs only on this marketing website, never inside the Engramic platform, and only if you accept.

You can change your mind at any time. Select Cookie settings in the footer of any page to re-open the banner and update your choice, or clear this site's data in your browser to reset it completely.

Do Not Track and Global Privacy Control

If your browser sends a Global Privacy Control (GPC) signal, we treat it as a decline: we do not show the cookie banner and we do not load analytics or advertising cookies. You can still choose to opt in via Cookie settings in the footer. Browsers' older ‘Do Not Track’ signals are not standardised, so we do not rely on them; GPC is the signal we honour.

How we keep your data secure

We use appropriate technical and organisational measures to protect personal data, including encryption in transit, access controls that limit who can reach data internally, and reputable infrastructure providers. No system is perfectly secure, but we work to keep these measures proportionate to the data we hold.

Data breaches

If a personal data breach occurs, we will assess it promptly and, where the law requires, notify the ICO within 72 hours and inform affected individuals without undue delay.

Children

Engramic is a product for organisations and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Request deletion of your data
• Restrict how we process your data
• Object to processing based on our legitimate interests
• Receive your data in a portable, machine-readable format, or ask us to transfer it to another provider
• Withdraw consent at any time, where processing is based on consent
• Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, contact us at [email protected]. We will respond within one calendar month.

Reviewing, updating or deleting your data

You can review and update much of your data yourself in your account settings on the platform — for example your name, email and connected services. To request a copy of your data, or to have it deleted, email [email protected] and we will help. If your data lives inside a workspace controlled by your employer or another organisation, ask them, as they control that content.

Visitors from outside the UK

This policy reflects UK data protection law. If you are in the EU or another region, your local laws may give you additional rights; contact us and we will do our best to help.

Changes to this policy

We may update this policy from time to time. The date at the top of this page indicates when it was last revised. Significant changes will be communicated to registered users by email.

Contact

Engramic Ltd
Company No. 17033873
ICO registration ZC194794
Registered in England and Wales
[email protected]