Privacy

EIIƎ is operated by IPGN Solutions (a trading name of Nirst Ltd, registered in Scotland under company number SC710095, with registered office at 4 Rubislaw Terrace, Aberdeen, AB10 1XE, United Kingdom) ("we", "us", or "our"). We are the controllers of any personal data collected and processed in relation to the EIIƎ platform and the services we provide. The privacy and security of your data is of utmost importance to us. Please review this Privacy Policy to understand how we handle your information. By using or accessing our Services, you acknowledge and accept the practices described below. You consent to our collection, use, and sharing of your information as described in this Privacy Policy.

Last updated: 2026-05-07

Collection of Information

We collect and process personal data in compliance with applicable data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the EU GDPR.

Account and profile data

When you sign up for EIIƎ we collect:

• First name and last name
• Email address
• Profile information (name and profile picture, where supplied via your authentication provider)
• Password (stored only as a one-way hash) or, where you sign in with a third-party identity provider (Google or Microsoft), authentication tokens issued by that provider
• Contact information you provide

Your account is associated with an organisation. Your organisation administrator may also see your name and email address as part of user management.

Email Integration Data

When you connect your email account (Google Gmail or Microsoft) to EIIƎ, we access:

• Your email messages and settings (including filters and labels)
• Your primary email address
• Your profile information (name and profile picture)
• Additional profile data provided by the authentication provider (such as gender and language preferences, which we do not store or use)

CRM content

When you use EIIƎ you provide content, including:

• Customer, business, contact, and location records
• Enquiries, proposals, orders, requests, and reminders
• Survey templates (your custom forms, including questions, field types, and instructions)
• Survey responses captured during a session (text input, voice-derived text, photos, signatures, notes)
• News articles, internal notifications, and feedback

You retain ownership of this content. We process it solely to provide the platform and services to you.

Voice and audio data

When you choose to use the voice-driven survey mode, your speech is recorded in real-time and converted to text by a third-party speech-to-text service (Soniox). Real-time audio is streamed directly to the speech-to-text provider and is not stored by default. Soniox does not retain audio after processing and does not use your data to train its models.

If your organisation's administrator has enabled the optional voice audio log, the platform additionally stores per-utterance audio clips and transcripts for up to 14 days. The audio log is disabled by default and is only available where an organisation administrator opts in. When enabled, you are shown a consent disclosure before voice mode begins. You can withdraw consent at any time by declining the consent prompt or by switching to manual text entry.

Audio log recordings are stored on AWS S3 in the eu-central-1 region (Frankfurt, Germany) under the survey-utterances/ prefix and are automatically deleted by S3 lifecycle rule after 14 days. Transcripts and AI extraction metadata associated with utterances are linked to the survey session and are deleted when the session is deleted. You can also delete the stored audio for an individual session at any time from the session audit page within the platform.

When you record a voice note against a contact record, the audio file is uploaded to AWS S3 (eu-central-1, Frankfurt) and is automatically deleted after 30 days. The audio is transcribed using Mistral AI (Voxtral Mini), a third-party AI service based in the EU. Transcriptions derived from voice notes are retained as part of the contact record until the contact is deleted or you request erasure.

Voice features are entirely optional. You may always use manual text entry instead. Your voice data is not used for biometric identification, speaker recognition, or authentication.

Photos and media

Where you capture photographs as part of a survey session, the image files are uploaded to AWS S3 in the eu-central-1 region (Frankfurt, Germany) under the survey-sessions/ prefix. Images are linked to the survey session, group instance, or field that they were captured against, and are retained for the lifetime of the survey session — they are deleted when the session is deleted.

Signatures

Where a survey field requests a signature, the signature is captured on-screen and stored as a small image embedded directly in the survey session record. Signatures evidence acceptance or sign-off of a completed report and are not used for biometric identification or authentication. Signatures are deleted when the associated survey session is deleted.

Generated reports (PDFs)

Survey reports and other PDF outputs are generated on-demand from your data when you request a download or share. We do not maintain a separate stored copy of the generated PDF; each download regenerates the report from the current source record.

Usage data

We collect operational telemetry that helps us run and improve the service:

• Application logs (timestamps, route paths, user identifier, error messages)
• Authentication events (sign-in attempts, session creation)
• Service usage metrics (number of surveys started, messages exchanged with the voice assistant, sub-processor invocations for cost management)
• Device and browser information that you submit by virtue of using the application

Cookies

We use both session cookies, which expire after you close your browser, and persistent cookies, which remain on your device until they expire or you delete them. We use cookies to authenticate you, remember your preferences, and analyse your usage of our services. You can control the use of cookies through your browser settings. However, please note that disabling cookies may limit your ability to use certain features.

Use of Information

The information collected is used for the purpose of providing and improving the platform. We may use your personal data to:

• Provide the platform and its features
• Authenticate you and protect the security of your account
• Process voice input and other AI-assisted input you have consented to use
• Generate reports, exports, and customer-facing communications from your data
• Communicate with you about service availability, important changes, security notices, and (with your consent) product updates
• Analyse aggregated usage trends to improve the platform
• Enforce our Terms and comply with our legal obligations

Lawful Bases for Processing

Data Sharing and Disclosure

We are committed to safeguarding your personal data and ensuring transparency in our data practices.

Email Provider Data Handling

We do not share, transfer, or disclose email provider data (Google or Microsoft) to third parties for purposes other than providing our services to you. Your email account information (including messages, settings, profile information, and email address) is used solely within the EIIƎ application to provide email integration features.

The only exceptions are:

• Our infrastructure and service providers (listed in the "Third-Party Service Providers" section below) who process data solely as part of providing our services
• When required by law or legal process
• With your explicit consent

Voice and AI-Assisted Features

The platform includes AI-powered features that process your input using third-party AI services:

• Survey Voice Assistant — Your transcribed speech (not raw audio) is sent to an AI model to interpret your responses and populate survey fields. The model processes your input in real-time and does not retain it after generating a response. The default AI provider is xAI Grok (operating in the EU eu-west-1 region). Alternative providers (Google Cloud Vertex AI Gemini in Belgium, OpenAI in the EU, Mistral AI in Paris, AWS Bedrock Claude Haiku in eu-central-1) may be configured by us as alternates.
• AI Template Builder — When you upload a source document (PDF or image of a form) for conversion into an EIIƎ survey template, the document is sent to an AI model for analysis. The default provider for image-based forms is xAI Grok; the default provider for PDF analysis is Anthropic Claude Haiku, accessed via AWS Bedrock in the eu-central-1 region. Uploaded source documents are stored in our S3 bucket and retained until you delete the corresponding template.
• HAMI Help Assistant — When you use the in-app help assistant, your text queries and the assistant's responses are processed by an AI model hosted on Google Cloud (Vertex AI, Belgium). Conversation history is stored in our database to provide continuity across sessions and is automatically deleted after 6 months. You can also delete individual conversations at any time from the HAMI assistant interface.

We use AI-assisted features on the basis of contract performance (delivering the service you have signed up for) and, for voice and voice notes, consent. You are informed when interacting with an AI-powered feature.

We do not use customer data to train any AI models, and our AI sub-processors have committed not to use your data for their own model training.

Cloud Text-to-Speech

In speaker mode of the survey voice assistant, the AI assistant's text replies are converted to spoken audio using Amazon Polly Neural Text-to-Speech in the eu-central-1 region. Only the assistant's reply text is sent to Polly; your voice input is never sent to Polly. Headset mode uses on-device text-to-speech and does not call any cloud TTS service.

Third-Party Service Providers (Sub-Processors)

We use the following third-party services to deliver the platform. Each acts as a data processor on our behalf under appropriate data processing agreements.

These providers process your data solely for the purpose of delivering the relevant feature and do not use your data for their own purposes, including model training.

International Transfers

All sub-processors listed above operate within the United Kingdom or the European Economic Area, or under appropriate transfer mechanisms (UK Addendum to the EU Standard Contractual Clauses) where any element of processing falls outside the UK or EEA. We do not transfer your personal data to a country or territory outside the UK or EEA without an appropriate transfer mechanism in place.

Security of Your Data

We implement comprehensive security measures to protect your personal data, including data from email providers (Google and Microsoft):

• All data transmissions between your device and our servers are encrypted using SSL/TLS
• Access to EIIƎ is restricted to users authenticated through trusted providers (Microsoft or Google) and authorised by your organisation administrator
• We follow industry best practices for securing web and mobile applications
• We conduct regular security audits of our systems
• Your data is stored in secure database infrastructure with encryption at rest
• We limit access to your email provider data and other personal data to authorised personnel who need it to provide and improve our services
• We use secure authentication tokens and never store your account passwords in cleartext

Data Retention

We retain different types of data for different periods:

Your Rights

Under data protection law you have the following rights in respect of your personal data:

• Right of access — to obtain a copy of the personal data we hold about you
• Right of rectification — to correct inaccurate or incomplete data
• Right of erasure — to request deletion of your data, subject to any overriding legal obligations on us
• Right to restriction of processing — in certain circumstances
• Right to data portability — to receive your data in a structured, commonly used, machine-readable format
• Right to object — to processing carried out on the basis of legitimate interest, including direct marketing
• Right to withdraw consent — at any time, where processing is based on consent (this does not affect the lawfulness of processing carried out before withdrawal)
• Right to lodge a complaint with a supervisory authority — in the UK, the Information Commissioner's Office (ico.org.uk)

For voice audio log recordings specifically, you can exercise your right to erasure on a per-session basis directly from the session audit page in the platform; deletion removes the audio from S3 storage and marks the database record as deleted while retaining the survey session itself.

To request deletion of specific data without closing your account, email us at support@e2e-ipgn.com describing the data you would like removed (for example, a particular contact record, survey session, voice note, voice audio log recording, or uploaded template source document). We will action your request within 30 days, except where we have an overriding legal obligation to retain the data (for example, records required for tax, audit, or regulatory purposes).

In order to process any of these requests we may need to verify your identity for your security. If you choose to have specific account or contact data erased, you may no longer be able to use our services. To exercise any of these rights, contact us at support@e2e-ipgn.com.

Aggregated and Anonymised Data

We may compile usage statistics and other aggregated data based on platform activity. Such data is aggregated and anonymised so that it does not identify any User, Customer, or their confidential information.

Marketing Communications

We will only send you marketing communications about EIIƎ with your consent. You can withdraw consent at any time by clicking the unsubscribe link in any marketing email or by contacting us at support@e2e-ipgn.com. Withdrawing consent for marketing does not affect service emails (account notices, security alerts, billing).

Children's Use

EIIƎ is intended for use by professionals in a business context. The platform is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe we have inadvertently collected such data, please contact us so we can delete it.

Changes to this Privacy Statement

We reserve the right to update or change this Privacy Policy at any time. We will post any changes on this page with a revised "Last updated" date. Material changes will be communicated to existing users by email or in-app notice.

Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at support@e2e-ipgn.com.

For postal correspondence:

IPGN Solutions (a trading name of Nirst Ltd) 4 Rubislaw Terrace Aberdeen, AB10 1XE United Kingdom