This policy is a detailed operational template generated for the configured Gaotus service. It is not a substitute for legal advice and should be reviewed against the operator’s real company details, payment stack, subprocessors, retention schedule, audience and jurisdictions before publication.
1. Who controls your data
The service operator is the entity identified below or on your contractual confirmation/invoice. For some payment activities, WooCommerce and the payment gateway you select may process information under their own privacy terms.
Beaphoenix WebDesign LtdContact: hello@gaotus.com
2. Information we collect
We may process account and contact data, company and billing details, technical identifiers, IP addresses, security records, orders and subscription state, plan usage, Council cases, uploaded files, generated artifacts and outcome feedback. We do not intentionally request special-category or highly sensitive personal data; do not upload sensitive information unless it is necessary and you have a lawful basis to do so.
3. Why we use information and legal bases
We use information to create and secure accounts, provide the service, process payments, enforce plan limits, prevent abuse and fraud, provide support, diagnose failures, maintain audit records, comply with law and improve product reliability. Where UK/EU data protection law applies, legal bases may include performance of a contract, legal obligations, legitimate interests and consent for optional processing where consent is required.
4. AI processing and uploaded material
Content submitted to Council may be processed by the configured AI providers in order to perform the analysis or execution you request. Gaotus uses a server-side architecture and does not expose provider secrets to the public browser. You must upload only content you are entitled to process and disclose.
5. Learning and confirmed outcomes
Council discussion is not automatically memorised as truth. User-confirmed real outcomes may feed Gaotus experience mechanisms according to product controls. Organisation-specific information remains isolated unless an expressly authorised sanitisation or promotion policy applies.
6. Payments and WooCommerce
Payments are handled through WooCommerce and installed payment gateways. We do not normally store full payment-card numbers. We may store external references, orders, invoice information, subscription state and payment events necessary for entitlement, accounting, fraud prevention and audit.
7. Cookies and device storage
We use strictly necessary cookies for authentication, session security, cart, checkout and preferences. Non-essential cookies must be handled according to the Cookies Policy and the consent mechanism available on the site.
8. Recipients and service providers
Information may be shared on a need-to-know basis with hosting, AI, transactional email, security, analytics where enabled, WooCommerce/payment providers and professional advisers. Providers are limited to their service purpose and relevant contractual obligations.
9. International transfers
Some providers may process data in other countries. Where required by applicable law, appropriate transfer mechanisms and contractual safeguards are used. We cannot control every infrastructure location of third-party services a customer independently chooses to enable.
10. Retention
We retain information only for as long as reasonably necessary for service delivery, security, audit, billing and legal obligations. Retention can differ for accounts, orders, logs, cases, artifacts and backups. Expired information is deleted or anonymised according to applicable technical and legal policies.
11. Security
We apply organisation-scoped authorisation, secure sessions, server-side entitlement checks, encrypted secrets and separation between the private Brain and public customer surface. No security measure can promise zero risk; contact us promptly if you suspect unauthorised access.
12. Your rights
Depending on your jurisdiction, you may have rights of access, correction, deletion, restriction, portability, objection and withdrawal of consent. We may need to verify identity and may retain information where legal obligations or overriding legitimate grounds require it.
13. Children
The service is intended for users able to enter a binding contract for professional or business services. It is not directed to children and we do not knowingly collect data from persons below the applicable minimum legal age.
14. Automated decision-making and profiling
Council produces AI-assisted analysis and execution requested by the customer. Unless a separately configured workflow and notice says otherwise, this public service is not intended to make solely automated decisions about individuals that produce legal or similarly significant effects. If such processing is introduced, the operator should document the legal basis, safeguards, meaningful information about the logic involved where required, and an appropriate human-review route.
15. Retention criteria and deletion
Retention depends on the purpose and record type. Account and entitlement records may be kept while the account is active; billing and tax records may be retained for statutory periods; security logs, case material, artifacts and backups may follow shorter or longer operational schedules. Where a fixed period is not stated, we use necessity, contractual, security, dispute and legal-obligation criteria and periodically review whether the information is still required.
16. International-transfer safeguards
Where personal data is transferred internationally and applicable law requires safeguards, the operator should identify the transfer mechanism used, such as an adequacy decision or appropriate contractual safeguards, and explain how an individual can obtain information about those safeguards. Customer-enabled third-party services may create additional transfers that must be assessed separately.
17. Complaints and supervisory authorities
You may contact us first so we can investigate a privacy concern. If UK data protection law applies, you may also have the right to complain to the Information Commissioner’s Office (ICO); other jurisdictions may provide a local supervisory authority. This does not remove any other legal remedy available to you.
18. Changes and contact
We may update this policy for product, provider or legal changes. Material updates will be published here and, where required, brought to affected users’ attention before a materially new use begins. For privacy questions or rights requests, use the contact details below.
Contact details
Beaphoenix WebDesign LtdContact: hello@gaotus.com