AIO Fusion Ltd (company number 17303930), registered in England and Wales at Amelia House, Crescent Road, Worthing, West Sussex, United Kingdom, BN11 1RL. Contact: info@aiofusion.ai.
AIO Fusion is responsible as controller for its website administration, enquiries, account and billing administration and the professional media database it maintains for its own purposes.
Personal information customers upload solely for processing on their instructions may instead be processed by AIO Fusion as a processor. Customers remain responsible for their own lawful use of that information. The applicable data-processing agreement should describe these roles, instructions and safeguards. A customer's independent outreach activity is not automatically processing on our behalf.
Review note: confirm the controller/processor allocation for each feature and each category of shared or workspace-owned media information before final approval. Ownership of a database record is not, by itself, a legal determination of controller status.
This notice covers website visitors; people contacting us or requesting demonstrations; account holders, team members and billing contacts; marketing subscribers where subscriptions are offered; journalists and other professional media contacts; and people making privacy requests.
The website currently describes its insights subscription as coming soon. The marketing-subscription paragraphs below explain the proposed approach and must be checked before that service launches. Paying platform subscribers are covered separately by the account and billing sections.
Website and enquiry information may include names, work email addresses, company details, enquiry content, browser/device information, pages visited, referral information and security logs. Analytics information is collected only when the visitor permits analytics through our cookie controls.
Platform administration may involve names, emails, roles, workspace membership, authentication and security records, billing information, payment status, support correspondence and service-usage records. Payment-card processing is handled through the payment provider rather than requiring customers to send card details to us.
Project information may include audit inputs, campaign briefs, drafts, saved results, planner entries and outreach records. Some of this may identify spokespeople, staff, journalists or other individuals.
Professional media information may include names, roles, publications, professional contact details, beats/topics, business locations, professional profiles, published work, source links and verification or provenance records. We seek to keep this relevant to professional activity. Do not intentionally add private contact information, sensitive personal information or children's information without a separately assessed lawful basis.
A request for a new Beta trial may use account and workspace details already held by us, including the company name and account contact email. We record the request status and time, the decision and time, and an internal identifier for the authorised decision-maker.
Privacy cases may contain request details, proportionate identity-verification information, correspondence and records of decisions. Please do not send identity documents unless we specifically request them through an appropriate channel.
Information may come directly from you, your organisation, authorised workspace users, public publication websites and professional profiles, publicly accessible published work, supplied or licensed media datasets, and research or verification sources.
Information being publicly available does not remove data-protection obligations. We should identify and retain source provenance where appropriate and review accuracy and permitted use.
Review note: confirm the actual dataset suppliers, source permissions and collection practices. Indirectly obtained information requires an assessed transparency process, normally within one month, or earlier when first contacting the person or first disclosing their information. Any relied-on exception needs documented justification; placing this page online alone is not proof those duties have been fulfilled.
Enquiries, demonstrations and business relationship administration: responding to requests and managing professional relationships, generally legitimate interests; steps requested before entering an individual contract may instead use the contractual basis.
Account and paid-service administration: operating access, subscriptions and agreed services. Performance of a contract applies where the individual is party to that contract; legitimate interests may apply to an organisation's employees or representatives. Accounting and legally required recordkeeping use legal obligations where applicable.
New Beta trial requests: recording and assessing a request for a 60-day trial, administering the decision and maintaining an accurate account record. The current working basis is our legitimate interests in operating a controlled business trial and, where applicable, taking steps requested before a service agreement. This basis and assessment are provisional and will be checked during later legal review.
Security, abuse prevention and service reliability: proportionate legitimate interests in protecting users and systems, or applicable legal obligations. Cookie/storage requirements must be assessed separately from the UK GDPR lawful basis.
Optional website analytics: consent through the site's cookie controls. We have chosen opt-in rather than assuming an analytics exemption applies. Consent can be withdrawn through Cookie preferences.
Marketing subscriptions, when launched: the appropriate consent or other permitted marketing basis, assessed for the recipient and communication channel. A business email address does not automatically remove electronic-marketing rules. An enquiry does not automatically subscribe someone.
Professional media research and database provision: proposed legitimate interests in helping communications teams identify relevant professional contacts and supporting accurate, relevant media research. This requires a documented purpose, necessity and balancing assessment that considers journalists' reasonable expectations, rights and potential impact.
Privacy requests and suppression records: complying with legal obligations and maintaining proportionate evidence of compliance. Do not use rights-request information for unrelated marketing.
Review note: these proposed bases require business verification and legal approval. The ordinary legitimate-interests assessment must not be replaced by an assumption that professional contact data is exempt or that a recognised-legitimate-interest category automatically applies.
Authorised platform users may access professional media information for relevant research and communications. Access is permission-controlled; we do not provide a public name/email lookup that confirms whether a person is in the database.
Paid access to professional contact information is a form of disclosure to customers. It should be explained plainly rather than obscured by an unqualified statement that personal data is never sold or shared. This does not give customers permission for unlawful spam, harassment, unrestricted resale or unrelated use.
AIO Fusion's own controller responsibilities are distinct from customers' responsibilities for their contact lists, outreach choices and subsequent processing. Customer terms and data-processing arrangements must support this distinction.
AI-suggested relevance, contact matches or inferred topics are not guaranteed facts. Source verification and human review are needed before relying on them. Review whether any profiling requires additional explanation or safeguards. This notice does not authorise solely automated decisions producing legal or similarly significant effects.
Journalists can use the Journalist privacy rights page or email info@aiofusion.ai to ask for information, correction, objection or removal. A request acknowledgement does not confirm that a matching record exists. Verification and a properly scoped review are needed before disclosure or changes.
Relevant information may be processed by hosting, infrastructure, database and storage providers; transactional email and communications providers; payment and billing providers; analytics providers; security and support providers; and AI providers used for requested audits, research or content generation. The services currently used include Resend, Stripe, Google Analytics and OpenAI/Anthropic integrations. Google or Microsoft may process information when their sign-in option is used.
For a new Beta request, the company name, account contact email and request time may be sent through our transactional email provider to an authorised AIO Fusion decision-maker. The decision status and time are retained with the account record. Applicants can check a pending request in their signed-in account; the current flow does not promise a decision date or a separate decision email.
Providers' legal roles depend on the service and contract; not every provider is a processor for every activity. Authorised customers may receive media information as described above. Professional advisers, regulators or authorities may receive information where necessary and legally justified, including in a properly assessed business transfer.
We should send AI providers only the information relevant to the requested function. Their retention, model-training and downstream processing terms depend on the contracted service, integration and configuration.
Review note: verify the actual provider agreements, subprocessors and settings. This draft deliberately does not repeat the previous blanket promise that all AI providers are contractually prevented from training on data, because that promise has not been established by this code review.
Some services may involve processing outside the UK or EEA. The relevant hosting locations, recipients and transfer arrangements must be verified rather than inferred from a provider's brand or our company address.
Where transfer safeguards are required, the applicable mechanism may include an adequacy decision or appropriate contractual safeguards and associated assessments. You may contact info@aiofusion.ai for information about relevant safeguards, subject to appropriate redactions.
Review note: complete the transfer inventory and verify the actual mechanisms before final publication. This notice is not evidence that an IDTA, UK Addendum or EU Standard Contractual Clauses have already been signed for every provider.
Retention should be tied to each purpose: active accounts and service delivery; enquiries and business follow-up; legally required accounting records; proportionate security records; professional media-data relevance and accuracy; privacy-case evidence; and suppression records needed to prevent renewed unwanted processing.
Data that is no longer needed should be deleted or anonymised, subject to applicable legal duties, disputes, valid holds and the handling of backups. Deleting an active record does not necessarily remove it instantly from every backup; retained copies should remain protected and not be reintroduced into ordinary use without appropriate safeguards.
Cookie preferences are retained for up to 180 days before we request a fresh choice. Accepted Google Analytics cookies are configured for a one-year lifetime, which may refresh during permitted use. Other cookie lifetimes are described in the Cookie Policy.
Review note: a detailed retention schedule, including media review intervals, dormant accounts, enquiries, logs, financial records, backups and rights cases, still needs approval. This draft does not invent deletion deadlines that the current system cannot meet.
Depending on the applicable law and processing, you may have rights to access, correct or erase information; restrict processing; object to processing based on legitimate interests; receive certain data in a portable format; withdraw consent; and challenge relevant automated decisions. Not every right applies in every circumstance.
Where processing is for direct marketing, you can object to that use at any time. Withdrawing consent does not retrospectively make earlier consent-based processing unlawful.
Contact info@aiofusion.ai or use the Journalist privacy rights form for media-data requests. We may request proportionate verification or clarification to protect information from unauthorised disclosure. We aim to handle requests within the applicable statutory period, normally one month; legally permitted extensions, pauses or exceptions must be explained where applicable.
Where a customer is the relevant controller, we may direct you to that customer and support the request as required by our agreement. This does not prevent you from asking AIO Fusion about information for which it is itself responsible.
You can complain to the UK Information Commissioner's Office at ico.org.uk or another relevant supervisory authority. Contacting us first may help resolve concerns, but it is not a condition of exercising your right to complain.
If an insights or other marketing subscription is offered, its collection point should explain what is sent, who sends it and the basis used. Marketing emails should include an appropriate unsubscribe route. Necessary account, security and billing communications are separate from marketing.
The insights subscription is not currently presented as a live service. The final policy and unsubscribe handling must be confirmed before launch. Contact info@aiofusion.ai about an unwanted communication; we should retain only proportionate suppression information needed to respect the choice.
The Cookie Policy explains browser storage and the available controls. Optional Google Analytics is held back until accepted. External websites, sign-in providers and payment pages may apply their own notices when you choose to use them.
The service uses measures such as HTTPS, authenticated access and workspace-scoped permissions. No system can be guaranteed completely secure. Our security descriptions should be checked against current operations and must not promise absolute protection or imply certification we do not hold.
An approved notice should show its effective date and material changes should be communicated appropriately. New purposes may require additional notice, a new assessment or consent before processing starts.
This interim notice is in use pending later legal and factual review; it has not been reviewed or approved by an external lawyer. Questions, privacy requests or requests for more detailed provider information can be sent to info@aiofusion.ai or the registered address above.