Privacy Policy

Alit Ltd (“Alit”, “we”, “us”, “our”) is the data controller responsible for your personal data. We are committed to protecting the privacy and security of the information you share with us.

This Privacy Policy explains how we collect, use, store, share and protect your information when you use our website, applications and AI-powered services (together, the “Service”). It applies to all users of the Service, including individuals acting on behalf of organisations, and to anyone who contacts us through our website.

This policy should be read alongside our Terms of Service. For any questions about this policy or your personal data, contact us at legal@getalit.ai.

1. Controller and processor roles

Alit acts in two capacities, depending on the type of data involved.

• As data controller, Alit determines the purposes and means of processing for account registration data, website enquiries, usage data and other information collected to operate and improve the Service.

• As data processor, when you upload documents, contracts or financial data for analysis, Alit processes that data on your behalf and in accordance with your instructions, or as a sub-processor where you are processing data on behalf of your own clients. Where a separate Data Processing Agreement is in place, its terms govern this processing.

2. Information we collect

Information you provide:

• Account registration details: name, email address, organisation name and role.

• Requests for access or for a pilot made through our website: name, work email, firm or company, role, organisation type, team size, the standards you work with, and any message you choose to include.

• Documents and data uploaded for analysis, such as contracts, financial data and accounting scenarios.

• Queries, inputs and interactions with the Service.

• Feedback, correspondence and support requests.

Information collected automatically:

• Device and browser type.

• IP address.

• Usage data, such as feature usage, session timestamps and error logs. For trial accounts only, the pages visited and time spent on them.

• Essential cookies required for the Service to function (see section 11).

We do not knowingly collect personal data from individuals under 18. We do not collect special category data (such as health, biometric, political or religious data) unless you include it in uploaded documents, in which case it is processed solely to provide the Service.

3. How we use your information

• Providing the Service, including account management, AI-powered analysis and output generation, using registration data, uploaded documents and queries. Lawful basis: contractual necessity.

• Responding to requests for access or for a pilot, using the details you submit through our website. Lawful basis: legitimate interest.

• Maintaining security, preventing abuse and detecting fraud, using IP address, usage data and device information. Lawful basis: legitimate interest.

• Improving and developing the Service, using anonymised, aggregated usage patterns only, with no client-specific content. Lawful basis: legitimate interest.

• Understanding how trial accounts use the Service to inform product decisions, using usage data, device information and page interaction data for trial accounts at an individual account level. Lawful basis: legitimate interest.

• Responding to support requests and other communications. Lawful basis: contractual necessity.

• Complying with legal or regulatory obligations. Lawful basis: legal obligation.

• Sending service-related communications, such as maintenance notices and security alerts. Lawful basis: legitimate interest.

4. No training on your data

Alit does not use your uploaded data, including contracts, scenarios, memos or other client materials, to train or fine-tune AI models. Your documents and inputs are never incorporated into any model training pipeline. Where we derive insights to improve our reasoning capabilities, these are limited to anonymised, non-identifiable patterns of platform usage, such as which accounting standards are commonly invoked or how decision points are structured, and contain no client-specific content.

5. Data sharing and sub-processors

We do not sell your personal data. We share data only with a limited number of trusted service providers (sub-processors) who process data on our behalf and under our instructions, for functions such as cloud hosting and storage, AI-powered analysis, website hosting and user authentication. All sub-processors are bound by appropriate contractual obligations regarding data protection and confidentiality.

A current list of our sub-processors is available on request from legal@getalit.ai. Where a Data Processing Agreement is in place, we will notify you of material changes to our sub-processor list in accordance with its terms. We may also disclose data where required by law, regulation or court order.

6. Data retention

• Account registration data: for the duration of your account plus 12 months after account closure.

• Uploaded documents and analysis outputs: for the duration of your account, and deleted within 30 days of account closure or earlier on request.

• Requests for access or for a pilot that do not lead to an account: 12 months from our last contact with you.

• Usage and analytics logs: 24 months from collection.

• Support correspondence: 24 months from resolution.

After the applicable retention period, data is securely deleted or anonymised. You may request earlier deletion of your data at any time (see section 8).

7. Data security

We implement appropriate technical and organisational measures to protect your data, including encryption in transit (TLS) and at rest, role-based access controls, infrastructure hosted with appropriate security configurations, and regular review of our security practices. No system is entirely secure. While we take reasonable steps to protect your data, we cannot guarantee absolute security, and you are responsible for keeping your account credentials secure.

8. Your rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to:

• access a copy of the personal data we hold about you;

• have inaccurate or incomplete data corrected;

• have your personal data erased, subject to any legal obligation to retain it;

• restrict how we use your data in certain circumstances;

• receive your data in a structured, commonly used, machine-readable format;

• object to processing based on legitimate interest;

• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of earlier processing.

To exercise any of these rights, contact us at legal@getalit.ai. We will respond within one month, which we may extend by a further two months in complex cases, in which case we will tell you. If you are dissatisfied with how we handle your data, you may complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113.

9. International data transfers

Some of our sub-processors are based outside the United Kingdom, including in the United States. Where personal data is transferred outside the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA), Standard Contractual Clauses approved by the relevant authority, or any applicable adequacy decision, and take reasonable steps to ensure your data receives an equivalent level of protection.

10. Use by minors

The Service is designed for professional and commercial use only. We do not knowingly collect personal data from individuals under 18. If we become aware that we have done so, we will delete it promptly.

11. Cookies

The Service uses only essential cookies required for basic functionality, such as session management and authentication. We do not use advertising or cross-site tracking cookies. You can manage cookies through your browser settings, although disabling essential cookies may affect your ability to use the Service. If we introduce additional cookies, we will update this section and, where required, ask for your consent first.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email or by a notice on the Service before they take effect. The date at the top of this policy shows when it was last revised.

13. Contact us

Alit Ltd, 84 Albert Hall Mansions, Kensington Gore, London, England, SW7 2AQ. Email: legal@getalit.ai.