Privacy Policy

Scotland AI is operated by Hardeep Layal, trading as Scotland AI. We are the controller of the personal information described in this policy.

We may collect and process:

• Enquiry details, including your name, business name, email address, phone number, message and the service you are interested in.
• Website scan information, including submitted URLs, scan results, scores, findings, timestamps and publicly accessible content from pages assessed by the service.
• Optional scanner follow-up records, including the email address used, the website scanned, relevant scan findings, the date and wording of the consent given, the scheduled follow-up time, delivery status and any unsubscribe or suppression record.
• Order and report details, including your name, business name, email address, website address, order reference, payment status, report status and delivery records.
• Technical and security information, such as IP address, browser or device information, request time and limited server or security logs.
• Client, contractual, accounting and transaction records where you purchase or receive services from Scotland AI.

Where we assess a public business website, some information may come from that website rather than directly from the individual it relates to. This may include publicly displayed business names, contact details, staff names or other public page content.

We use information to:

• provide the website scanner and display its results;
• generate, administer and deliver purchased reports;
• respond to enquiries and discuss requested services;
• send requested service communications, reports and snapshots;
• send the optional one-off scanner follow-up where you have actively chosen to receive it;
• protect the website from spam, misuse and security threats;
• operate, maintain and improve Scotland AI services;
• manage client relationships, payments and records; and
• meet legal, tax, accounting or regulatory obligations.

The optional scanner follow-up is a one-off marketing email about the website opportunity identified in your free scan and how Scotland AI could help. It is only scheduled where you actively tick the separate optional consent box. Requesting the free snapshot on its own does not subscribe you to marketing.

Any direct marketing message we send will identify Scotland AI and provide a simple way to opt out or unsubscribe.

Depending on the circumstances, we rely on:

• Legitimate interests to operate and improve the scanner and website, respond to relevant business enquiries, keep appropriate service records, prevent abuse and maintain security. Our interests are in providing and developing Scotland AI services and protecting the service from misuse.
• Steps taken at your request before entering a contract where you ask us to discuss, quote for or prepare services.
• Contract where processing is needed to take payment, generate or deliver a report, or provide another agreed service.
• Legal obligation where records must be retained or disclosed by law.
• Consent for the optional one-off scanner marketing follow-up and for other optional marketing or non-essential tracking activities where consent is required. You can withdraw that consent at any time.

The free scanner reviews selected publicly accessible information returned by the website address submitted to it. Paid reports may assess additional publicly accessible pages within the stated product scope.

The service checks selected technical, content, accessibility, conversion and search-engine optimisation signals. Automated scores and findings are diagnostic indicators and do not make decisions that have legal or similarly significant effects on individuals.

Basic scan records such as a submitted URL, score, outcome and timestamp may be retained for service administration, security, analytics, lead management and improvement. Purchased report records are retained so we can process, deliver, support and evidence the order. We do not create a public archive or copy of the websites that are scanned.

If you choose the optional one-off scanner follow-up, we record enough information to evidence that choice and schedule the message. Before sending, we may check whether a relevant Website Action Report has already been purchased after that consent was given. If so, the follow-up may be suppressed rather than sent. The follow-up contains an unsubscribe link.

Some information is required so we can provide a requested service. For example, a valid email address and website address are needed to process and deliver a Website Action Report. If required information is not provided, we may be unable to complete the request or contract.

We use trusted suppliers to operate the website, deliver services and process payments. These currently include:

• Railway, for website, application and database infrastructure;
• Resend, for delivery of requested emails and the optional consent-based scanner follow-up;
• Stripe, for secure payment processing and payment-related records;
• 123 Reg, for domain and business email services; and
• professional advisers, insurers, service providers or public authorities where reasonably necessary or legally required.

Card details entered at Stripe checkout are handled by Stripe and are not stored by Scotland AI. Suppliers process information under their own terms and applicable data-processing arrangements. We do not sell personal information.

Some technology suppliers may process information outside the United Kingdom. Where personal information is transferred internationally, we take reasonable steps to use suppliers and transfer arrangements that provide an appropriate level of protection under applicable UK data protection law.

• Enquiry information is normally retained for up to 12 months unless it becomes part of an ongoing client relationship or is needed for another justified purpose.
• Basic scan and lead records may be retained for a reasonable period for service administration, measurement, security and legitimate business follow-up, and are reviewed periodically.
• Records showing optional scanner follow-up consent, delivery, suppression and withdrawal may be retained for a reasonable period so we can demonstrate the choice made and respect unsubscribe requests. We may retain a limited suppression record where necessary to avoid sending marketing again by mistake.
• Client, contractual, accounting, order and transaction records may be retained for longer where needed for legal, tax, insurance or dispute-resolution purposes.
• Temporary rate-limit and security information is retained only for as long as reasonably needed to protect the service.
• Hosting, email and payment suppliers may retain limited records under their own documented retention arrangements.

Depending on the circumstances, you may have the right to ask for access to your information, correction, deletion, restriction, portability or to object to particular processing. You have the right to object to direct marketing, and where consent is relied upon you may withdraw it at any time.

For the optional scanner follow-up, you can also use the unsubscribe link in the email. We may keep the minimum suppression information needed to remember that preference.

To exercise a right, email hello@scotlandai.co.uk. We may need to verify your identity before responding.

You can make a data protection complaint directly to Scotland AI by emailing hello@scotlandai.co.uk. Using the subject line "Data protection complaint" will help us identify it quickly.

We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate and tell you the outcome.

You also have the right to complain to the UK Information Commissioner's Office if you are unhappy with how your personal information has been handled.

Scotland AI does not currently use advertising or optional analytics cookies. The website or its infrastructure may use strictly necessary technical mechanisms required for security, networking, checkout, session management and delivery.

We will update this policy and introduce an appropriate consent process before adding non-essential cookies or similar tracking technologies where consent is required.

Scotland AI is a business service and is not directed at children. Please do not submit information about children through the scanner, enquiry forms or report-order forms unless this is genuinely necessary for an agreed service and has been discussed with us first.

We may update this policy when our services, suppliers or legal obligations change. The latest version will appear on this page with a revised update date.