Privacy Policy

1. Who We Are

AutomationHire.co.uk is an online directory and marketplace connecting businesses with AI automation agencies and freelancers. We also run Jarvis Academy, an AI learning service for students and families, which has its own rules for children’s data (see section 10). We are the data controller for personal data collected through this website.

Our Details

• Website: automationhire.co.uk
• Contact email: privacy@automationhire.co.uk
• Registered in: England and Wales

If you have any questions about how we handle your personal data, please contact us at the email address above before raising a complaint with the Information Commissioner's Office (ICO).

2. Data We Collect

We collect different data depending on how you use our website. We only collect what is necessary for the purpose stated.

2.1 — Visitors (Browsing the Directory)

• IP address and approximate location (via server logs)
• Browser type, device type, operating system
• Pages visited, time spent, referral source
• Search queries entered on the directory

This data is collected automatically and is used only for analytics and security purposes. It is not used to identify you personally.

2.2 — Clients (Requesting Quotes or Getting Matched)

• Full name
• Email address
• Company name (optional)
• Phone number (optional)
• Project description, budget and timeline
• Tools and platforms you currently use

2.3 — Providers (Listing Your Business)

• Full name and business name
• Email address and password (encrypted)
• Phone number (optional)
• Business description, services, tools and industries
• Website URL and LinkedIn profile
• Location (city and country)
• Pricing information
• Portfolio content and case studies
• Certifications uploaded
• Billing information (processed by Stripe — we do not store card details)

2.4 — Newsletter Subscribers

• Email address
• Date of subscription and source page

2.5 — Reviews

• Reviewer name, company and role
• Email address (not published publicly)
• Review text and star rating

2.6 — Jarvis Academy (Students and Parents)

• Account: email address, first name or nickname, education level (primary, secondary or university), account type (student or parent) and whether the age/guardian declaration was ticked
• Learning records: for each topic practised, the subject, topic, a confidence score, the number of attempts and correct answers, and a short note about a common mistake
• Session records: a random session ID, the education level, the number of questions asked, and start and last-activity times
• Family links: which parent account is linked to which student account, and any unused one-time link code
• Try Jarvis (no account): the questions you type are sent to our AI provider to produce a reply. We do not store them. Your IP address is held in server memory for up to an hour to limit abuse

We do not store the text of Jarvis Academy conversations. Details are in section 10.

3. How We Use Your Data

Purpose	Data Used	Who It Applies To
Display your listing in the directory	Business name, description, services, location, pricing	Providers
Forward lead requests to providers	Client name, email, project description	Clients & Providers
Send transactional emails	Email address, name	All users
Process subscription payments	Email, billing name (card handled by Stripe)	Providers
Send the weekly newsletter	Email address	Subscribers
Improve the website and detect fraud	IP address, browser data, usage data	All visitors
Comply with legal obligations	Any data required by law	All users
Respond to enquiries and support requests	Name, email, message content	All users
Provide Jarvis Academy tutoring and personalise it from past practice	Account details, learning records, session records, the messages you type (sent to our AI provider, not stored)	Students
Show a progress summary to a linked parent or guardian	First name, level, session counts, subject and topic scores	Students & Parents

We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.

4. Legal Basis for Processing

Under UK GDPR, we must have a lawful basis for processing personal data. We rely on the following bases:

Processing Activity	Legal Basis
Creating and maintaining a provider listing	Contract — necessary to perform our service agreement with you
Forwarding lead requests to providers	Legitimate interests — core purpose of the directory service
Processing subscription payments via Stripe	Contract — necessary to fulfil your subscription
Sending transactional emails (quote confirmations, lead alerts)	Contract / Legitimate interests
Sending the newsletter	Consent — you opted in via our subscription form
Analytics and site improvement	Legitimate interests — understanding how the site is used
Jarvis Academy accounts, tutoring and learning records (students aged 13 and over)	Contract — necessary to provide the service you asked for
Jarvis Academy for children under 13	Consent of the parent or guardian who sets up and supervises the account
Sharing a progress summary with a linked parent or guardian	Consent — the student creates the link code and can stop sharing at any time
Compliance with legal obligations	Legal obligation

5. Who We Share Your Data With

We only share your data with trusted third-party service providers that help us operate AutomationHire. All processors are bound by data processing agreements and comply with UK GDPR.

5.1 — Supabase (Database & Authentication)

We use Supabase to store all user accounts, Jarvis Academy learning records and directory data, and to send account confirmation emails. Supabase is hosted on AWS infrastructure in the EU (Ireland). Supabase Privacy Policy →

5.2 — Stripe (Payment Processing)

All subscription payments are processed by Stripe, Inc. We never receive or store your card details — they go directly to Stripe. Stripe is PCI DSS Level 1 compliant. Stripe Privacy Policy →

5.3 — Resend (Transactional Email)

We use Resend to deliver transactional emails such as lead notifications, quote confirmations and welcome emails. Resend processes your email address and the email content on our behalf. Resend Privacy Policy →

5.4 — Vercel (Website Hosting)

Our website is hosted on Vercel Inc. servers. Vercel processes server logs including IP addresses as part of normal web hosting operations. Vercel Privacy Policy →

5.5 — Anthropic (AI Tutor)

Jarvis Academy replies are generated by AI models provided by Anthropic, PBC. When you ask Jarvis something, your message (and recent messages in the same conversation, plus your first name and a short summary of topics you find hard if you are signed in) is sent to Anthropic to produce the reply. Under Anthropic’s commercial terms, data sent through its API is not used to train its models, and it may be kept for a limited time for safety and abuse monitoring. See Anthropic Privacy Policy →. Please do not type personal details such as your full name, address or school into Jarvis.

5.6 — Legal Disclosure

We may disclose your personal data if required to do so by law, court order, or government authority, or if we believe disclosure is necessary to protect the rights, property or safety of AutomationHire, our users, or others.

5.7 — Business Transfer

In the event of a merger, acquisition or sale of all or part of our business, your data may be transferred to the acquiring entity. You will be notified by email of any such change and your rights under this policy will be maintained.

6. Data Retention

We retain your personal data only for as long as necessary for the purpose it was collected, or as required by law.

Data Type	Retention Period
Provider account and listing data	Duration of account + 2 years after account deletion
Lead request data	3 years from submission date
Payment and billing records	7 years (required by UK tax law)
Newsletter subscriber email	Until you unsubscribe or request deletion
Reviews	Until you request removal or the provider listing is deleted
Server logs and analytics	90 days
Support correspondence	2 years from last interaction
Jarvis Academy account, learning records and family links	While the account is active. Deleted within one month of a deletion request from the account holder or, for a child, a parent or guardian
Jarvis Academy one-time link codes	7 days, or until used

When data reaches the end of its retention period, it is securely deleted or anonymised so it can no longer be linked to an individual.

7. Your Rights Under UK GDPR

You have the following rights regarding your personal data. To exercise any of them, contact us at privacy@automationhire.co.uk. We will respond within 30 days.

Right of Access

You have the right to request a copy of the personal data we hold about you (commonly called a Subject Access Request or SAR). We will provide this free of charge in a commonly used electronic format.

Right to Rectification

If any personal data we hold about you is inaccurate or incomplete, you have the right to have it corrected. Providers can update most data directly from their dashboard.

Right to Erasure ("Right to be Forgotten")

You have the right to request deletion of your personal data where there is no compelling reason for us to continue processing it. Note that we may need to retain some data for legal or contractual reasons (e.g. payment records for 7 years).

Right to Restrict Processing

You can ask us to restrict how we use your data while a dispute is being resolved — for example if you contest the accuracy of your data or have objected to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used and machine-readable format (e.g. JSON or CSV) and to transmit it to another service.

Right to Object

Where we rely on legitimate interests as our legal basis, you have the right to object to processing. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where processing is based on your consent (e.g. newsletter), you can withdraw consent at any time by clicking "Unsubscribe" in any email or contacting us directly. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right to Lodge a Complaint

If you believe we have not handled your data properly, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Phone: 0303 123 1113
• Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We do ask that you contact us first so we have the opportunity to resolve your concern directly.

8. Cookies

Cookies are small text files placed on your device when you visit a website. We use the following types:

Cookie Type	Purpose	Duration
Essential	Required for the site to function — authentication sessions, security tokens	Session / 7 days
Functional	Remember your preferences (e.g. filter settings, billing toggle)	30 days
Analytics	Understand how visitors use the site (page views, traffic sources). We use privacy-first analytics that do not track individuals across sites.	90 days
Stripe	Fraud prevention and payment processing on checkout pages	Session / 1 year

We do not use advertising or tracking cookies. We do not share cookie data with social media platforms for advertising purposes.

You can control cookies through your browser settings. Disabling essential cookies will prevent you from logging in or using interactive features. Jarvis Academy also keeps your sign-in token in your browser’s local storage so you stay signed in; it is strictly necessary for the service and is removed when you sign out. You can also use a browser extension such as uBlock Origin to block non-essential cookies.

9. International Data Transfers

Our primary infrastructure is located within the European Economic Area (EEA) or in countries that the UK has deemed to provide adequate data protection. Specifically:

• Supabase — AWS EU (Ireland)
• Vercel — Edge network with data processing in the EU where selected
• Stripe — Operates under EU–US Data Privacy Framework and UK adequacy decision
• Resend — EU infrastructure
• Anthropic — processes Jarvis Academy requests in the United States, relying on appropriate safeguards such as the UK International Data Transfer Addendum or an adequacy mechanism

Where any transfer occurs to a country without a UK adequacy decision, we ensure appropriate safeguards are in place such as UK International Data Transfer Agreements (IDTAs) or Standard Contractual Clauses.

10. Children's Privacy and Jarvis Academy

The directory, quotes and provider features of AutomationHire are a business-to-business service for adults aged 18 and over. Jarvis Academy is different: it is a learning service designed for students, including children. This section applies to Jarvis Academy and takes priority over the rest of this policy for it.

10.1 — Who can use Jarvis Academy

• Aged 13 and over: may create their own student account.
• Under 13: may use Jarvis only through an account that a parent or guardian sets up and supervises, who consents on the child’s behalf.
• We ask each new user to confirm this with a tick box. We do not independently verify age or identity. If we learn that a child under 13 has an account without a parent or guardian’s involvement, we will delete it.
• Parent or guardian accounts are for adults aged 18 and over.

10.2 — What we keep, and what we don’t

• We keep the account, learning, session and family-link data listed in section 2.6.
• We do not store the text of conversations with Jarvis. The messages are sent to our AI provider to generate a reply (section 5.5) and are not saved in our database.
• We do not sell children’s data, show advertising in Jarvis Academy, or use it to build marketing profiles.

10.3 — Scores and automated assessment

After you answer one of Jarvis’s questions, an AI model estimates whether your answer was right and updates a confidence score for that topic. This is used only to personalise tutoring and to build the progress summary. It has no legal or similarly significant effect on anyone, is not used for grading, selection or discipline, and can be wrong. You can ask us for a human review, to correct it, or to object to it by emailing privacy@automationhire.co.uk.

10.4 — Parent and guardian view

• A student can create a one-time code (valid for 7 days) and give it to a parent or guardian, who enters it on their own parent account. A parent can link up to 4 children.
• A linked parent sees a summary only: the child’s first name and level, how many sessions and questions this week, the last active date, and subject and topic scores. They never see the child’s conversations.
• The student’s own screen shows how many parents can see their summary. Either side can stop sharing at any time.

10.5 — Safety and supervision

• Jarvis is instructed to keep content age-appropriate, to stay on learning topics, and to encourage a student who seems upset or at risk to talk to a trusted adult.
• Because we do not store or monitor conversations, we cannot see or step in if a child raises a safety concern with Jarvis. We recommend that children under 13 use Jarvis with an adult nearby.
• AI can make mistakes. Check important facts with a teacher or textbook.
• If a child is in immediate danger, call 999. Children can talk to Childline on 0800 1111, and adults worried about a child can call the NSPCC helpline on 0808 800 5000.

10.6 — Access, correction and deletion

A student, or a parent or guardian on a child’s behalf, can ask us to give a copy of, correct or delete Jarvis Academy data by emailing privacy@automationhire.co.uk from the account email address. We will reply within one month. Deleting an account removes its learning records, sessions and family links. Rights under UK GDPR are described in section 7.

11. Security

We take the security of your personal data seriously and implement appropriate technical and organisational measures including:

• All data in transit encrypted via TLS 1.2+ (HTTPS)
• All data at rest encrypted using AES-256 encryption
• Passwords stored as bcrypt hashes — we cannot see your password
• Row-level security (RLS) policies ensure providers can only access their own data. Jarvis Academy tables allow no direct public access and are reached only through our server
• Payment card data handled exclusively by Stripe — we never touch it
• API keys and secrets stored as environment variables, never in code
• Access to the production database limited to essential personnel only

Despite these measures, no method of transmission or storage is 100% secure. If you discover a security vulnerability, please report it responsibly to security@automationhire.co.uk.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, and notify affected individuals without undue delay as required under UK GDPR Article 34.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or for other operational reasons. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Display a notice on our homepage for 14 days after the change
• Send an email notification to registered providers

Your continued use of AutomationHire after a policy update constitutes acceptance of the revised policy. We encourage you to review this page periodically.

13. Contact Us

For any questions, concerns or requests relating to your personal data or this Privacy Policy, please contact our Data Controller: