Privacy Notice

1. Introduction

Hindsight Intelligence Ltd ("we", "us", "our") is a company registered in England and Wales (Company No. 17077668) and registered with the UK Information Commissioner's Office (ICO Registration ZB922393). This Privacy Notice explains how we collect, use, share and protect personal information when you visit our website (hindsightintelligence.co.uk), use ProjectHindsight (app.projecthindsight.uk), use ConditionIQ (getconditioniq.co.uk), or otherwise interact with us.

We are committed to handling personal information responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who we are — controller and processor roles

Hindsight Intelligence Ltd is the data controller for personal information collected through our marketing website, sales and account administration processes (for example, your name and email address when you contact us or register for a trial).

Where an organisation ("Customer") uses ProjectHindsight or ConditionIQ to manage its own project knowledge, asset condition records, or engineer/inspector data, that Customer is the data controller for the personal data within its account, and Hindsight Intelligence Ltd acts as a data processor on the Customer's behalf. The terms of that processing are set out in our Data Processing Agreement. If you are an individual user of the platform (for example, an engineer entering assessments), your organisation's privacy notice and instructions to us take priority for that data, and any requests about that data should generally be directed to your organisation first.

3. Information we collect

We do not deliberately collect special category data (such as health data, racial or ethnic origin, or biometric data). If such information is inadvertently included within uploaded documents or photographs (for example, in a site photograph), it is processed only as part of the Customer's content data, under the Customer's instructions, in accordance with our DPA.

4. How we use your information and our lawful basis

5. AI-assisted processing

Both ProjectHindsight and ConditionIQ use AI models (principally Anthropic's Claude, with supplementary use of OpenAI and xAI models for specific search features) to assist with extracting lessons from documents, proposing condition grades from inspection evidence, and surfacing relevant past information.

In every case:

• AI output is advisory only — a named human reviewer must approve any lesson, condition grade, or risk flag before it is treated as final.
• Where an AI-assisted output forms part of a report or evidence pack, this is disclosed on the document in line with Article 50 of the EU AI Act on transparency for AI-generated or AI-assisted content.
• Content submitted to AI providers for processing is not used by those providers to train their general-purpose models, in accordance with our contracts with those providers.
• AI providers process content as sub-processors under our instructions — see the sub-processor table below.

6. Sub-processors and third parties

We use the following categories of third-party service providers to operate our platforms. A current list of named sub-processors is also maintained in our Data Processing Agreement, Annex 3.

We do not sell personal information to third parties, and we do not permit our sub-processors to use your data for their own marketing purposes.

7. International data transfers

Some of our sub-processors are located outside the UK, including in the United States. Where personal data is transferred outside the UK, we ensure appropriate safeguards are in place, such as:

• Reliance on providers certified under the UK Extension to the EU–US Data Privacy Framework, where applicable; or
• The UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses.

You can request further information about the safeguards used for a specific transfer by contacting us using the details in section 13.

8. Data retention

9. How we keep your information secure

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (HTTPS/TLS), bcrypt password hashing, JWT-based authentication, organisation-level data isolation, and access controls limiting staff access to personal data on a need-to-know basis. Further detail is set out in Annex 2 of our Data Processing Agreement.

10. Your rights under UK GDPR

Subject to certain exemptions, you have the right to:

• Access — request a copy of the personal information we hold about you
• Rectification — ask us to correct inaccurate or incomplete information
• Erasure — ask us to delete your personal information in certain circumstances
• Restriction — ask us to limit how we use your information
• Portability — request your information in a structured, machine-readable format
• Object — object to processing based on legitimate interests or for direct marketing
• Withdraw consent — where processing is based on consent, at any time

If you are a user of ProjectHindsight or ConditionIQ acting on behalf of an organisation, please direct requests about content data to your Organisation Admin first, as your organisation is the data controller for that data. We will respond to verified requests within one calendar month, as required by UK GDPR Article 12.

11. Cookies and similar technologies

Our website and platforms use a limited number of essential cookies and browser storage items necessary for authentication and basic functionality. Full details are set out in our Cookies Policy.

12. Knowledge Commons and data sharing

ProjectHindsight includes an optional Knowledge Commons feature, allowing an Organisation Admin to choose to share selected lessons, in anonymised or aggregated form, with other participating organisations to build sector-wide intelligence. Participation is voluntary and controlled at the project level by the Customer's Organisation Admin. We do not enable Knowledge Commons sharing by default, and Customers remain responsible for ensuring that any lessons shared do not contain personal data they are not authorised to disclose.

13. Children's information

Our services are intended for business use by individuals aged 18 and over. We do not knowingly collect personal information from children.

14. Changes to this notice

We may update this Privacy Notice from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. If we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify Customers via email or an in-platform notice. We encourage you to review this page periodically.

15. Complaints and how to contact us

If you have a concern about how we handle your personal information, please contact us first so we can try to resolve it:

You also have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), at any time. We would, however, appreciate the opportunity to address your concern directly first.