CardiganBayAI

Privacy Policy

Draft — not yet legally reviewed. This document was prepared as a working draft and has not been checked by a qualified UK privacy or legal professional. It is not legal advice and will be replaced with a reviewed version before public launch.

Version 0.1 (draft) — last updated 14 August 2026.

1. Who we are

CardiganBayAI ("we", "us") operates the farm opportunity checker at cardiganbayai.co.uk. For the purposes of UK data protection law we are the data controller for the personal data described in this policy.

Contact: info@cardiganbayai.co.uk

2. What personal data we collect

When you complete the farm checker, we collect:

  • Contact details — your first name and email address.
  • Farm details — postcode, country, approximate farm size, farm type(s), land and environmental features, investment interests, approximate livestock numbers.
  • Business details (optional) — land tenure, business structure, approximate turnover band, number of people working on the farm. You may skip all of these.
  • Consent records — whether you agreed to receive your report, and whether you opted in to marketing updates, together with the time you submitted the form.

We also record anonymous usage events (for example that a checker was started or completed) to understand how the service is used. These are not used to build a profile of you or to track you across other websites.

3. What we do not collect

  • Bank or payment details
  • Government identifiers (National Insurance numbers, passport details)
  • Special category data (health, ethnicity, political opinions, etc.)
  • Uploaded documents — file uploads are not supported

Please do not send us any of the above.

4. Why we use it, and our lawful basis

  • To produce and email your farm opportunity report — lawful basis: consent, which you give by ticking the report box before submitting.
  • To send you occasional updates about relevant funding — lawful basis: consent, given separately by ticking the marketing box. This box is never pre-ticked, and declining it does not affect your report.
  • To operate, secure and improve the service (including spam prevention and anonymous usage statistics) — lawful basis: legitimate interests, namely running a reliable and secure service.

5. Withdrawing consent

You can withdraw consent at any time by emailing info@cardiganbayai.co.uk. Marketing emails will also include an unsubscribe link. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

6. Who we share it with

We do not sell your personal data. We share it only with service providers ("processors") who help us run the service:

  • Supabase — database and authentication hosting.
  • Resend — email delivery for your report and any updates.
  • Vercel — website hosting.

Each processor acts only on our instructions. Where a provider stores or processes data outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Addendum or adequacy regulations. Our database is hosted in the EU (Ireland).

7. How long we keep it

  • Farm checker submissions — retained while they remain useful for providing and improving the service, and reviewed periodically. A formal retention schedule will be confirmed as part of legal review.
  • Marketing contact details — until you unsubscribe or withdraw consent.
  • Anonymous usage events — retained in aggregate.

You can ask us to delete your data sooner at any time (see below).

8. Your rights

Under UK GDPR you have the right to:

  • Access a copy of the personal data we hold about you
  • Have inaccurate data corrected
  • Have your data erased
  • Restrict or object to how we use it
  • Receive your data in a portable format
  • Withdraw consent at any time

To exercise any of these, email info@cardiganbayai.co.uk. We aim to respond within one month.

If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

9. Security

We use encrypted connections (HTTPS), a managed database with access controls and row-level security, server-side validation of all submissions, and rate limiting to reduce abuse. No system is perfectly secure, but we take reasonable steps to protect your information.

10. Cookies

See our cookie policy for details of the limited cookies we use.

11. Changes to this policy

We may update this policy as the service develops. Material changes affecting how we use your data will be notified to you where we hold your contact details.