Privacy Policy

This Privacy Policy describes how Inco AI, a trading name of Inductive Concepts Ltd, collects, uses, discloses, and otherwise processes information about you. This policy applies to information we collect when you access or use our website (inco.ltd), our services, and when you otherwise interact with us.

We are committed to protecting your personal data and respecting your privacy in compliance with applicable data protection laws in the UK, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018).

—

1. Who We Are

Inco AI is a trading name of Inductive Concepts Ltd, a company registered in England & Wales under company number 16759388.

Our website is located at: inco.ltd.

For any privacy-related enquiries, please contact us at hello@inco.ltd.

—

2. Information We Collect About You

We collect various types of personal information to provide and improve our services. Personal data is defined as ‘any information relating to an identified or identifiable natural person’, whereby the person can be identified directly or indirectly.

2.1. Information You Provide to Us Directly
When you use our services, create an account, or interact with us, you may provide us with:
Contact Information: Names, email addresses, company name, telephone number.
Payment Information: Payment details, transaction history, and credit card details (processed securely by third-party payment processors).
Account Information: Details related to your account with us.
Communications: Information you provide when you contact customer support or communicate with us.

2.2. Information We Collect Automatically
When you visit our website or use our services, we may automatically collect certain information:
Technical Data: IP addresses, device information, browser information.
Usage Data: Details about how you interact with our website and services, including app interaction data. This may include limited information about the device you use to access our website.
Cookies: We use necessary cookies for core website functionality. For other types of cookies, such as those for targeted advertising, we will request your express consent.

2.3. Information We Obtain from Other Sources
We may obtain your personal information from other sources, such as social media platforms or data analytics service providers.

2.4. Special Categories of Personal Data
We generally do not collect ‘special categories’ of personal data, which include information on a person’s race, ethnic origin, political opinion, religious or philosophical beliefs, trade union membership, genetic data, biometric data, data concerning health, sex life or sexual orientation. If we ever need to process such data, we will seek your explicit consent and ensure additional safeguards are in place.

—

3. How We Use Your Information

We collect personal information for the following business purposes, adhering to the data protection principles that require personal data to be: used fairly, lawfully and transparently; used for specified, explicit purposes; adequate, relevant and limited to what is necessary; accurate and kept up to date; kept for no longer than necessary; and handled securely.

To Provide Our Services and Products: To deliver the services you request and fulfil our contractual obligations to you.
To Process Payments: To manage billing and transactions related to our services.
To Provide Marketing Offers: To send you information about our products, services, and promotions. This may involve automated decision-making and profiling as part of our marketing practices, for which you have specific rights.
Service Improvement: To understand how users engage with our services and develop new functions. Processing personal data solely for ‘service improvement’ is generally not considered objectively necessary for the performance of a contract, and thus requires a different legal basis, such as legitimate interests or consent.
Auditing and Testing AI Systems: To ensure our AI systems are compliant with legislation, which may involve processing personal data to test performance on different kinds of people.
Making Inferences: We may use AI systems to guess or predict details about individuals or groups, or to analyse correlations between datasets to categorise, profile, or make predictions. Whether an inference is personal data depends on if it relates to an identified or identifiable individual. If our AI system involves making inferences about a group and linking these to a specific individual, data protection law applies at both the development and deployment stages.

—

4. How We Share Your Information

We disclose personal information as described in this Privacy Policy:

Vendors and Service Providers: We make personal information available to our vendors, service providers, contractors, and consultants who perform services on our behalf. These include companies assisting us with web hosting, cloud computing and storage, maintenance, security, advertising measurement, customer support, data analytics services, customer relationship management platforms, and payment processors.
Law Enforcement Authorities and Individuals Involved in Legal Proceedings: We disclose personal information in response to a request for information if we believe that disclosure is in accordance with, or required by, any applicable law, regulation, or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements.
To Protect the Rights of Inco AI and Others: We may disclose personal information if we believe that your actions are inconsistent with our user agreements or policies, if we believe that you have violated the law, or if we believe it is necessary to protect the rights, property, and safety of Inco AI, our users, the public, or others.

—

5. AI-Specific Privacy Considerations

The use of Artificial Intelligence (AI) systems introduces unique challenges and risks to data privacy, which we are committed to addressing in compliance with UK GDPR:

Data Hunger and Intransparency: AI systems are highly data-hungry and often intransparent, making it difficult for individuals to control what information about them is collected, how it’s used, or how it might be corrected or removed.
Personal Information in Training Data: Generative AI tools, trained with data scraped from the internet, may memorise personal information about people, including relational data about their family and friends. This data can potentially be revealed as output or used for anti-social purposes like spear-phishing, identity theft, fraud, or AI voice cloning.
Lack of Control Over Training Data: Many AI platforms do not offer clear ways for users to opt out of having their prompts used to train AI models. Once personal or sensitive data is entered, there is often no practical mechanism to delete it from an AI model’s training dataset, even with rights like GDPR’s right to erasure. We are currently dependent on AI companies to remove personal information from their training data or set guardrails, which is not an acceptable long-term solution.
Inferences and Bias: AI systems can make inferences about individuals or groups, which may constitute personal data or even special categories of data, triggering data protection laws. There is also a risk of bias inherent in the data used to train AI algorithms, which can lead to misidentification or unfair outcomes.
Call for Opt-in and Collective Solutions: We advocate for a shift where the default is that personal data is not collected unless individuals affirmatively opt-in. Furthermore, individual privacy rights are often insufficient given the scale of data collection; collective solutions, such as data intermediaries, are needed to give the public more leverage to negotiate for their data rights at scale.

—

6. Legal Basis for Processing Your Personal Data

Under the UK GDPR, we must have a lawful basis to process your personal data. Our legal bases include:

Consent: Where you have given us clear consent to process your personal data for a specific purpose. Consent must be freely given, specific, informed, unambiguous, and involve a clear affirmative action. It cannot be inferred from silence, pre-ticked boxes, or inactivity.
Performance of a Contract: Where the processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract (e.g., to provide an AI-derived quote for a service) . This basis applies only if the processing is objectively necessary to deliver the contractual service.
Legal Obligation: Where the processing is necessary for us to comply with a legal obligation placed upon us as the data controller.
Legitimate Interests: Where the processing is necessary for our legitimate interests or those of a third party, provided your fundamental rights and freedoms do not override those interests . This may apply to certain marketing activities or service improvements where consent or contract is not applicable, and can sometimes allow processing on an “opt-out” basis.

Different lawful bases may apply at different stages of an AI system’s lifecycle (e.g., development vs. deployment) or for different purposes of a general-purpose AI system.

—

7. International Data Transfers

Inco AI is based in the United Kingdom. We and our service providers process and store personal information on servers located in the United Kingdom and other countries.

Transfers within the UK and EEA: The UK GDPR and the EU GDPR are currently aligned, meaning broadly that they place the same legal obligations on businesses . Data can generally flow from the UK to the EEA (European Economic Area) and vice-versa without new arrangements. However, it is important to note that in the future, the two pieces of legislation may diverge as the UK has left the EU.
Transfers Outside the EEA/UK: Whenever we make restricted international transfers of personal information outside the EEA or UK, we take steps to ensure that your personal information receives an an adequate level of protection. This is achieved by putting in place appropriate safeguards, such as contractual clauses (e.g., Standard Contractual Clauses), or by relying on an appropriate derogation under data protection laws. Where relevant, you may request access to any safeguard we use for such transfers.

—

8. Data Retention

We retain your personal information for as long as you have an account with us, for purposes applicable, or to comply with laws and regulations. This means we keep your information for as long as necessary to fulfil the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements.

—

9. Your Data Protection Rights

Under the UK GDPR and DPA 2018, you have the following rights regarding your personal data, with some exceptions:

The Right to be Informed: You have the right to be informed about how your data is being used.
The Right of Access: You have the right to request access to the personal data we hold about you.
The Right to Rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
The Right to Erasure (the ‘Right to be Forgotten’): You have the right to request the deletion of your personal data under certain circumstances.
The Right to Restrict Processing: You have the right to request that we restrict the processing of your personal data under certain conditions.
The Right to Data Portability: You have the right to request that we transfer the data that we have collected to another organisation, or directly to you, under certain conditions.
The Right to Object: You have the right to object to our processing of your personal data in certain circumstances.
Rights in Relation to Automated Individual Decision-Making and Profiling: You have rights when an organisation is using your personal data for automated decision-making processes (without human involvement) and profiling, for example, to predict your behaviour or interests.
Right to Withdraw Consent: Where we rely on your consent to process your personal information, you have the right to withdraw that consent at any time.

If you are concerned about how an organisation is handling your personal data, you can contact the Information Commissioner’s Office (ICO) for advice or to make a complaint.

—

10. Changes to This Privacy Policy

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the “Last Updated” date at the bottom of this policy. If we make material changes, we may provide you with additional notice (such as by adding a statement to our services or sending you a notification). We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you.

—

11. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:

Inductive Concepts Ltd (trading as Inco AI)
Registered Address: 2 Ashdown Court, Lewes Road, Forest Row, Englandf, RH18 5EZ
Company Number: 16759388
E-Mail: hello@inco.ltd

—
Last Updated: 02 October 2025