Privacy notice

AI Team Members

Last updated: 21 October 2026

This notice explains what personal data AI Team Members collects through its website (aiteammembers.co.uk), when you book or have a call with us, and when your business becomes a client. It also explains what happens to the personal data we handle for our clients when we build and run their AI team members.

1. Who we are

AI Team Members is a trading name of Ecom Giant Retail Limited, a company registered in England and Wales, company number 15545138. Registered office: 704 Skylines Plaza, Alencon Link, Basingstoke RG21 7AY, United Kingdom. Ecom Giant Retail Limited also trades as Autopilot.

For the personal data described in this notice, Ecom Giant Retail Limited is the controller, which means we decide how and why it is used. The exception is the data we handle for our clients (section 9), where our client is the controller and we are its processor.

• Email: [email protected] (please put "Privacy" in the subject line)
• Post: Ecom Giant Retail Limited, 704 Skylines Plaza, Alencon Link, Basingstoke RG21 7AY, United Kingdom
• ICO registration number: ZB948188
• Data protection officer: we do not have to appoint one. Calvin Odoi, Director, is responsible for data protection.

2. The short version

• If you book a call or email us, we get the details you give us, and we use them to arrange the call and reply to you.
• Our website runs on HighLevel, which records visits to the site (section 4).
• Booking a call does not sign you up to marketing. If you become a client, we may send you occasional emails about similar services, and you can unsubscribe at any time.
• Some of our providers are in the United States and India. Section 11 explains how we protect your data.
• We never sell personal data.
• You can ask to see, correct or delete your data, or complain, by emailing [email protected].

3. If you book a call or contact us

Our "Book a call" buttons open a booking calendar that runs on HighLevel.

• What we collect: your name, email address, phone number, your business name, the time you choose, and anything you type into the booking form or tell us by email. HighLevel also links your earlier visits to our website to your booking (section 4).
• Why: to arrange and hold the call, send confirmations and reminders by email or text, reply to you, and follow up afterwards about what you asked for.
• Lawful basis: taking steps at your request before entering into a contract (UK GDPR Article 6(1)(b)), and our legitimate interests in answering and following up enquiries (Article 6(1)(f)).
• Where it is held: in our HighLevel CRM and, for emails, in our Google Workspace email account.
• How long: 12 months after our last contact with you, unless your business becomes a client (section 6).

Do you have to give us this information? No, but we need your name and a way to contact you to arrange a call.

4. When you visit our website

Our website is built and hosted on HighLevel (HighLevel, Inc., also trading as LeadConnector). HighLevel's hosting runs behind Cloudflare, which protects the site and speeds it up.

We do not use Google Analytics, the Meta (Facebook) Pixel, advertising cookies or other marketing trackers on this website. Visitor records in our HighLevel account are kept for 12 months.

5. Marketing

• Booking a call or emailing us does not sign you up to marketing.
• If your business becomes a client, or you negotiated with us to buy our services, we may email you from time to time about our own similar services (the "soft opt in" under the Privacy and Electronic Communications Regulations). You can refuse when we first collect your details and in every email we send.
• We will only send other marketing emails or texts with your consent, and we never make automated marketing calls.
• Lawful basis: our legitimate interests in telling clients and people who asked about our services about similar services (Article 6(1)(f)), or your consent where we ask for it (Article 6(1)(a)).
• To unsubscribe: use the unsubscribe link in any email, reply "unsubscribe", or email [email protected]. We act on it within 2 working days, free of charge. We keep a short "do not contact" record so that we never contact you again by mistake.

6. If your business becomes a client

• What we collect: your name, job title, business name and address, email address, phone number, billing details, the signed Order Form, notes from our calls with you, the build specification, records of what we have done for you, support tickets, and the messages between us. We also record the names and mobile numbers of the members of your staff who may instruct and approve your AI team member.
• Payments: where you pay by card, payments are handled by Stripe. We never see or store your full card number. Stripe is also an independent controller for its own fraud checks and legal obligations, under its own privacy policy (stripe.com/gb/privacy).
• Why: to build, run and support your AI team member, take payments, deal with complaints and keep accounts.
• Lawful basis: performing our contract with you (Article 6(1)(b)). Where the contract is with your company rather than you personally, our legitimate interests in running the contract with your business (Article 6(1)(f)). Also our legal obligations, for example tax and accounting records (Article 6(1)(c)), and our legitimate interests in protecting our business, for example defending legal claims (Article 6(1)(f)).
• How long: contract and financial records are kept for 6 years after the contract ends. Support conversations are kept for 12 months after the ticket closes.

7. Calls with us

• Sales and discovery calls are normally held by phone or Google Meet.
• We only record a call with you if we tell you first. If we record a call, we keep the recording for 90 days after the call, so that we have an accurate note of what you asked for. If we need it for a complaint or dispute, we keep it until that is resolved.
• Lawful basis: our legitimate interests in keeping an accurate record of what was agreed (Article 6(1)(f)). You can object, and we will not record.

8. Use of AI in running our business

We use AI tools, including our AI assistant (Grok Bot), to help draft emails and documents and organise our work. It acts as our processor and processes data in the United States. A person checks anything sent in our name before it goes out. We do not use AI, or any other automated process, to make decisions about you that have legal or similarly significant effects.

9. Data we handle for our clients (when we act as processor)

We build and run AI team members for businesses, inside each client's own HighLevel account. An AI team member may, for example, read the client's customer records, prepare messages for the client's staff to approve, and make service calls to the client's customers about their own job, booking or quote. Every call starts by saying it is an AI assistant, and offers a person.

For that data, our client is the controller and we are its processor. We only use it to provide the service to that client, on the client's written instructions, under the AI Team Members Data Processing Terms that form part of every client contract (UK GDPR Article 28). Those terms set out the data involved, the subprocessors (including HighLevel, Twilio and OpenAI), retention, security, breach notice and international transfers. We do not use clients' customer data to train AI models, for any other client or for our own marketing, and we never sell it.

If you are a customer of one of our clients, please read that business's privacy notice and contact the business first. If you contact us, we will pass your request to the right business promptly.

A copy of our Data Processing Terms is available on request from [email protected].

10. Who we share personal data with

We do not sell personal data. We share it only with the providers we need, who act on our instructions, and where the law requires.

We may also disclose personal data if the law requires it, to protect our rights or someone's safety, or to a buyer if our business is ever sold.

11. Transfers outside the UK

Some of our providers are outside the UK. When personal data leaves the UK, we make sure it stays protected by using UK adequacy regulations where they apply (for example the UK Extension to the EU US Data Privacy Framework, for US providers certified under it), or otherwise the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses in the provider's data processing terms.

• United States: HighLevel, Google, Cloudflare, Stripe, our AI assistant and HighLevel's providers.
• India: HighLevel's support team, covered by HighLevel's contractual safeguards (the UK Addendum).

You can ask us for more information about these safeguards by emailing [email protected].

12. How long we keep personal data

We may keep data for longer if we need it for a complaint or legal claim, or if the law requires it.

13. How we keep data secure

We use reputable providers. Two step login is required on our business systems, and access is limited to what each person's role needs. Each client has its own separate HighLevel account. We do not send passwords by plain email, and we remove access when someone leaves.

14. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you and get a copy;
• have inaccurate data corrected;
• have your data deleted in some circumstances;
• restrict how we use it in some circumstances;
• data portability, where we rely on consent or a contract;
• object to our use of your data where we rely on legitimate interests; and
• withdraw consent at any time, where we rely on consent.

You have an absolute right to object to direct marketing. If you object, we will stop.

To use any of these rights, email [email protected] or write to us at the address in section 1. We will reply within one month. For complex requests this can be extended by up to two further months, and we will tell you if so. We may need to check your identity first. There is normally no charge.

15. Complaints

If you are unhappy with how we have handled your personal data, please tell us first by emailing [email protected] with "Privacy complaint" in the subject line, or by post to the address in section 1. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint, or call 0303 123 1113.

16. Cookies

Our website uses only the cookies and similar technologies described in section 4:

HighLevel sets the msgsndr_id cookie and the local storage history when a page loads, and we cannot switch this off in HighLevel's settings. You can object at any time by emailing [email protected], or block cookies and site data for aiteammembers.co.uk in your browser settings; the site still works. The booking calendar, which runs on HighLevel, may set its own functional cookies when you use it. We do not use advertising or marketing cookies. If we ever add our own analytics or marketing cookies, they will only run if you agree to them first.

17. Children

Our website and services are for businesses. We do not knowingly collect children's personal data for our own purposes.

18. Changes to this notice

We will update this notice when our services or the law change, and change the "Last updated" date above. If a change significantly affects how we use data we already hold about you, we will tell you directly where we can.