Legal
Privacy policy
Last updated: 23 October 2026
1. Who we are
Pimzo Ltd is a company registered in England and Wales under company number 17491921, with its registered office at 82a James Carter Road, Mildenhall, IP28 7DE ("Pimzo", "we", "us").
Pimzo is an AI consultancy and technology partner for real estate. We build bespoke AI tools in clients' own systems or on our platform at app.pimzo.io that read documents and turn them into structured data.
Contact us about this policy or your data at hello@pimzo.io.
2. What this policy covers
This policy explains how we handle personal data about: visitors to our website, pimzo.io; people who use our tools; our clients' staff and other business contacts; and people named in documents or data that our clients give us.
3. Our role
When we decide how data is used, we are the controller. This covers website visitors, users' account details and business contacts.
When we read documents for a client, the client is the controller and we are its processor. Documents and data that clients give us (for example leases, brochures, reports or invoices) often name individuals, such as agents, signatories, witnesses and other contacts. We process that data only on our client's instructions. If you are named in a document that one of our clients has given us, the client is responsible for that data, and we will pass any request you send us to that client. When we build a tool that runs in a client's own systems, the client is responsible for the data that tool processes, and the client's own privacy notice applies.
4. The data we collect and why
| Who | What we collect | Why | Legal basis |
|---|---|---|---|
| Website visitors | Pages visited, approximate location, device and browser information, and your IP address (see section 10, Cookies) | To run and protect the website, and to understand how it is used | Legitimate interests |
| Users of our tools | Name, work email address, organisation; sign-in records; the projects and documents an account has worked with | To provide the service, keep it secure and support you | Performance of our contract with you or your organisation; legitimate interests |
| Clients and business contacts | Name, job title, organisation, business email and phone number, and our correspondence | To manage our relationship, provide services, and send occasional relevant updates | Legitimate interests; performance of a contract |
| People named in documents or data our clients give us | Names, job titles, contact details, addresses, signatures and other details, where they appear | To carry out the work our client has asked for | We act as processor; our client decides the legal basis |
You can opt out of any updates we send at any time, using the link in the email or by contacting us.
We do not use personal data for automated decisions that have legal or similarly significant effects on individuals.
5. How long we keep it
- Uploaded files: our hosted tools read uploaded files and then discard them. We do not keep a copy of the original file.
- Text and data extracted from documents: kept in the client's account while it is open, so results stay available and the same document does not need to be read again. Deleting a project removes it from view but keeps the stored text, so that uploading the same file again does not need a new read. Closing the account deletes all of it within 30 days.
- Account details: kept while the account is open, then deleted within 30 days of closure, except where we need to keep records for legal or accounting reasons.
- Contracts, invoices and related correspondence: kept for 6 years after the end of the relationship, to meet legal and accounting requirements.
- Website visit statistics: held by our website platform. We only look at them as totals, such as numbers of visits and pages viewed.
Our AI provider, currently Anthropic, processes each request on its own and does not use it to train its models. Under its commercial terms, it keeps request data for up to 30 days, or longer if its safety systems flag the content for review.
6. Who we share data with
We do not sell personal data or share it for others' marketing. We use a small number of service providers to run Pimzo. Each acts on our instructions under a written contract:
| Provider | What they do | Where |
|---|---|---|
| Anthropic | Reads each document and extracts the data fields | United States |
| Supabase | Database, sign-in and storage | London, United Kingdom |
| Railway | Hosts the application | Netherlands (EU) |
| Resend | Sends sign-in emails | Ireland (EU) |
| Lovable, with Cloudflare | Hosts and protects the website, and provides its visit statistics | EU and Cloudflare's global network |
| Google Fonts | Supplies the website's fonts | United States |
We may also disclose data where the law requires it, or to professional advisers and insurers under a duty of confidentiality. If we sell or restructure our business, data may transfer to the new owner under the same protections.
We keep this list up to date as our tools change. We will update this policy, and tell our clients in advance, before a new provider handles their data.
7. Transfers outside the UK
Some providers process data outside the UK. Anthropic processes data in the United States under the EU Standard Contractual Clauses with the UK International Data Transfer Addendum, which form part of Anthropic's data processing terms. Our other providers are in the UK or the EU, which UK law recognises as giving adequate protection, or rely on safeguards set out in their own terms. You can ask us for more information about these safeguards.
8. Keeping data secure
Data is encrypted in transit and at rest. Each client's data is kept separate from every other client's data, and we test this automatically: our tests try to reach one account's data from another account, and pass only when that attempt returns nothing. In our hosted tools, the AI that reads documents has no access to the internet or to any other system. Bespoke tools that connect to a client's own systems do so only with the access the client grants, and changes to the client's data need the client's approval unless agreed otherwise.
9. Your rights
Where we are the controller of your data, you have the right to: ask for a copy of it; ask us to correct it; ask us to delete it; object to or ask us to restrict how we use it; and ask for it in a portable format. Where we rely on consent, you can withdraw it at any time.
To use these rights, contact hello@pimzo.io. We will reply within one month.
You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to deal with your concern first.
10. Cookies
Cookies are small files that a website stores on your device. Similar technologies, such as browser storage, work in the same way, and this section covers them too.
| Name | Where | Purpose | How long | Type |
|---|---|---|---|---|
| sb-…-auth-token (may be split into parts ending .0, .1) | app.pimzo.io | Keeps you signed in | Until you sign out, and at most 400 days | Strictly necessary |
| sb-…-auth-token-code-verifier | app.pimzo.io | Completes sign-in securely when you use a sign-in link | Only while signing in | Strictly necessary |
| __cf_bm | pimzo.io | Set by Cloudflare to protect the website from automated attacks | 30 minutes | Strictly necessary |
| session-id | pimzo.io | Counts visits and pages viewed, so we can see how the website is used | 30 minutes | Analytics |
We do not use advertising or social media tracking cookies. Our website loads its fonts from Google Fonts. This sets no cookies, but your browser sends your IP address to Google to fetch them.
Strictly necessary cookies are needed for the website and app to work. You can block or delete cookies, including the analytics cookie, in your browser settings. Blocking the analytics cookie does not affect how the website works.
11. Changes
We will update this policy when our services change, and show the date of the latest version at the top.