Privacy Policy

Data controller

VHDigital Ltd, trading as Nexolve. Registered in England and Wales. Email: vincent@nexolve.co.uk.

What data we collect

• Questionnaire responses — answers you provide during the Free Scan or Full Blueprint audit, including L0–L5 maturity ratings and evidence responses.
• Chat transcripts — if you use the conversational audit mode, the full exchange is stored alongside your responses.
• Contact information — your name, agency name, and email address when you start or purchase an audit.
• Payment data — processed entirely by Stripe. We do not store or see card details.
• Usage data — anonymised analytics (page views, session duration) via Vercel Analytics. No cross-site tracking.

Lawful basis for processing

• Contract performance (Article 6(1)(b) UK GDPR) — questionnaire responses, contact information, and report data are processed to deliver the service you purchased.
• Legitimate interests (Article 6(1)(f) UK GDPR) — anonymised, aggregated usage analytics to improve the product. We have assessed that this does not override your rights.

How we use your data

• To generate and deliver your personalised AI Readiness Report.
• To create your personalised Google Sheet action plan (Full Blueprint only).
• To send your report and any follow-up correspondence by email.
• To send a reminder email if you start an audit but do not complete it within 3 days.
• To improve the quality of the audit product over time (aggregated and anonymised only — never individual data).

Data retention

• Incomplete audits — deleted 90 days after your last activity if not completed.
• Completed paid audits — retained for 1 year after purchase. After that, identifiable data and chat transcripts are anonymised; aggregated scoring data may be retained indefinitely for benchmarking.
• Free Scan — retained for 90 days after completion, then deleted.

You can request deletion at any time — see Your rights below.

Data storage and transfers

Your assessment and report data is stored in Supabase (EU region). Some of our subprocessors (listed below) operate globally. Where personal data is transferred outside the UK or EEA, we rely on Standard Contractual Clauses (SCCs) or equivalent adequacy mechanisms. See our Subprocessor List for details on each vendor.

Subprocessors

• Supabase — database and authentication (EU region).
• Vercel — application hosting, serverless functions, and AI Gateway for LLM routing.
• Stripe — payment processing (PCI DSS Level 1 compliant).
• Resend — transactional email delivery.
• OpenRouter / Anthropic — AI model inference for report generation. Your data is not used to train models.
• Google — Google Sheets for action plan delivery.

Full details, including each vendor's compliance posture, are on our Subprocessor List.

Your rights (UK GDPR)

You have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — correct inaccurate data.
• Erasure — request deletion of your data where there is no overriding legal basis for retention.
• Portability — receive your data in a structured, machine-readable format.
• Object — object to processing based on legitimate interests.
• Restriction — request that we restrict processing while a dispute is resolved.

To exercise any of these rights, email vincent@nexolve.co.uk. We will respond within 30 days.

Cookies

We use essential cookies only (session management and resume tokens). No third-party advertising or tracking cookies are set. Vercel Analytics uses privacy-preserving, cookieless measurement by default.

Complaints

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk. We would appreciate the chance to address your concern first — please email us before contacting the ICO.