How we handle your data with AI

Custom AI means working with your real data, so how we treat it matters as much as what we build. These are the principles behind every AI automation we deliver, in plain English.

UK and EU GDPRHIPAA where it appliesHuman reviewClient-owned accounts

Our six principles

The rules every AI automation we build follows.

Your data stays in your accounts

The apps and automations we build run in accounts you own, such as your own Bubble.io account, connected to your own tools. Your data is not copied into systems we control.

AI only sees what each task needs

Each AI step receives only the fields it needs to do its job. If an assistant needs a booking date, it does not need a medical history or a bank account.

People approve what matters

Anything with real consequences, such as legal, medical or financial decisions, payments or messages on sensitive topics, is drafted by AI and approved by a person.

Every AI action is logged

You can see what the AI read, what it produced and who approved it, so mistakes can be traced and fixed quickly.

AI tools chosen to fit your data

We are tool-agnostic, so we choose AI providers and settings for how sensitive your data is, including options that do not use your data to train their models and regional processing, where available.

You control access

We work through collaborator access that you grant and can remove at any time. Secrets such as API keys are stored on the server, never in the browser.

How data flows in a typical automation

From your tools to the AI and back, with you in control at each step.

Your toolsEmail, WhatsApp, your CRM or accounting software send in new work.
Your Bubble.io appIn your own account, privacy rules decide what each part of the system can see.
The AI stepOnly the fields the task needs are sent to the chosen AI model, from the server.
Review and recordA person approves where it matters, every action is logged, and the result goes back to your tools.

Documented before we build

Your Discovery Sprint sets out how your data will be handled, in writing.

A data map: which data each automation touches, where it lives and who can see it.
AI provider choices: which model handles each step, why, and how it treats your data.
Where data is processed: including any regional requirements your business has.
Retention: how long AI inputs, outputs and logs are kept, and how they are deleted.
Human review points: exactly where a person approves AI output.
Agreements: a data processing agreement where UK or EU GDPR requires one, and, for US healthcare, agreements such as a Business Associate Agreement where HIPAA applies.

You see all of this before anything is built, as part of the Discovery Sprint. See a sample AI Opportunity Map for how risks and safeguards are set out.

Regulated industries

Extra care where the law and professional rules demand it.

Legal

Client confidentiality and legal professional privilege shape every design decision, and AI never gives legal advice. AI for law firms

Healthcare

Health information is special category data under UK and EU GDPR, AI stays out of clinical decisions, and HIPAA agreements are checked where they apply. AI for clinics

Finance and accounting

Financial records stay in your own ledgers, extraction is reviewed before posting, and professional obligations stay with your qualified staff. AI for accounting firms

When our work ends

You keep everything. We remove our access.

Our work ends the same way for every client: your accounts, your data, your automations and their documentation stay with you, credentials are handed over or rotated, and our access is removed. If you later move to another developer, everything they need is already yours.

Read more about how we handle personal data in our privacy policy.

Six questions to ask any AI vendor

Whoever you work with, ask these before sharing your data.

Where will our data be processed and stored, and who can access it?
Does the AI provider use our data to train its models, and can that be switched off?
What exactly does each AI step see, and why does it need it?
Where does a person review AI output before it reaches a customer or a record?
How are AI actions logged, and how long are the logs kept?
When we stop working together, what do we keep and how is access removed?

Any AI partner should be able to answer all six clearly. We answer them in writing during the Discovery Sprint.

Questions about data and AI

Straight answers.

Do you use our data to train AI models?

No. We do not train models on client data, and we choose AI providers and settings that do not use your data to train their models, where available. The Discovery Sprint documents exactly how each provider in your project treats your data.

Where is our data stored?

In the accounts and tools you own, such as your own Bubble.io account, your CRM and your email. AI steps receive only the fields each task needs, and we document where that processing happens.

Can you work with sensitive data such as health or financial records?

Yes, with the right design. We minimise what AI sees, keep a person in charge of decisions, log every action and put the agreements your situation requires in place, such as a data processing agreement under UK or EU GDPR, or a Business Associate Agreement where HIPAA applies.

Can we remove your access?

Yes, at any time. We work through collaborator access that you grant, and when our work ends we remove our access and hand everything over.

Is AI ever fully automatic?

Only where the risk is low, such as sorting messages or sending reminders. Anything with real consequences, including payments, legal, medical or financial decisions and sensitive messages, is approved by a person.

Talk to us about your data

Have a specific requirement, regulation or concern? Book a free call and we will walk you through how we would handle it, before you commit to anything.

Book a free call Calculate my AI savings