Legal
Privacy notice
Last updated 1 November 2026
This notice explains how Lowtide, a trading name of Cloudly Move Ltd, a company registered in England and Wales (company number 15646622), with its registered office at 167-169 Great Portland Street, London, England, W1W 5PF (“Lowtide”, “we”, “us”) uses personal data when you visit lowtidehq.com or use our tools. We are the controller of your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
What we collect
- Account data: your email address, and the date you signed up and last signed in.
- What you add to each tool: brand names, website addresses, competitors and prompts (Mentioned); provider admin keys and budgets (Burnguard); website addresses (Opentide); your company's AI profile, questionnaires you paste in and the answers and policy we draft (Soundings); your records register entries, steward names and emails, attestation and retrieval responses and disposal records (Mooring). We email stewards on your behalf, and you're responsible for having a basis to share their details with us. Questionnaire text and your profile are sent to our AI provider (OpenAI) to draft answers.
- Results the tools produce: AI answers and the sources they cite, daily AI spend figures and the AI models used, and accessibility scan reports.
- Website chat: questions you ask our AI assistant are sent to OpenAI to generate an answer and are not stored by us. If you choose "Talk to a person", we receive your name, email, question and, if you tick the box, the chat, and keep them as correspondence.
- Technical data: IP address, browser type and request logs, kept briefly by our hosting provider for security and to keep the service running. When you use the free accessibility scan or AI readiness check we keep a one-way (hashed) version of your IP address for up to 24 hours to stop abuse.
When you use the free accessibility scan without an account, we fetch the page you enter and return the result to your browser. We don't store the address or the result.
Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Creating your account, signing you in and running the tools you set up | Contract: we need it to provide the service you asked for |
| Sending sign-in links, reports and alerts | Contract |
| Keeping the service secure, preventing abuse and fixing problems | Legitimate interests: running a safe, reliable service |
| Telling you about important changes, such as new pricing | Legitimate interests: keeping existing users informed |
| The free accessibility scan | Legitimate interests: providing a tool you asked to use |
We don't send marketing emails. If we start, we'll only email existing users about similar Lowtide services, every email will include a one-click way to opt out, and we'll update this notice first. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.
Who we share it with
We use these service providers (“processors”), who act only on our instructions under written contracts:
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Website and app hosting | Servers in London (UK); global edge network |
| Supabase Inc. | Database and sign-in | Stockholm, Sweden (EU) |
| Resend (Plus Five Five Inc.) | Sending sign-in and alert emails | Ireland (EU) |
| OpenAI, Anthropic, Google, Perplexity | Answering the prompts you add to Mentioned | United States |
Prompts you add to Mentioned are sent to the AI providers to generate answers. They contain the questions you write, not your email address, so please don't include personal information in prompts. We never sell personal data and we don't share it with advertisers.
International transfers
Some providers are based in or access data from the United States. Where personal data leaves the UK, we rely on UK adequacy regulations (for the EU), the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
How long we keep it
- Account data and tool results: while your account is open. When you ask us to close it, we delete it within 30 days.
- Provider admin keys: encrypted at rest, and deleted immediately when you disconnect the account in Burnguard.
- Technical logs: kept by our hosting and email providers for short periods under their own retention policies, usually days to weeks.
Your rights
Under UK data protection law you have the right to:
- ask for a copy of your personal data;
- ask us to correct data that's wrong or incomplete;
- ask us to delete your data;
- ask us to restrict how we use it, or object to our use based on legitimate interests;
- receive your data in a portable format.
Email privacy@lowtidehq.com to use any of these rights. We'll reply within one month and it's free. We may ask you to confirm your identity first.
Cookies
We only use cookies that are strictly necessary to keep you signed in. We don't use analytics, advertising or tracking cookies. See our cookie policy for the full list.
Security
Data is encrypted in transit (HTTPS) and at rest. Provider admin keys are additionally encrypted by us with AES-256 before storage. Access to customer data is limited to what's needed to run and support the service.
Children
Lowtide is a business service and isn't intended for anyone under 18.
Complaints
If you're unhappy with how we've handled your data, please contact us first at privacy@lowtidehq.com. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
Changes to this notice
We'll update the date at the top when this notice changes, and email account holders about significant changes.
Contact
Lowtide, a trading name of Cloudly Move Ltd, a company registered in England and Wales (company number 15646622), with its registered office at 167-169 Great Portland Street, London, England, W1W 5PF. Email: privacy@lowtidehq.com.