Introduction

Generative AI Solutions Limited, a company registered in England and Wales under company number 06673667, whose registered office is at HLB House, 68 High Street, Tarporley, Cheshire, United Kingdom, CW6 0AT ("Generative AI Solutions", "GAIS", "we", "us", or "our"), is committed to protecting your privacy and personal data in accordance with applicable data protection legislation.

We operate three distinct business divisions: (i) a Product Development Division providing AI-enabled products including ALICE (Automated Language Inference & Cognitive Evaluation) and Harry, our AI-powered candidate screening and recruitment workflow platform; (ii) a Consulting Division providing AI adoption strategy and HR transformation services; and (iii) a Talent Placement Division providing specialist recruitment services.

Harry is a product of Generative AI Solutions Limited, accessible at genai-harry.com or such other URL as we may designate.

This Privacy Policy sets out how we collect, use, store and protect personal data across all our business activities and explains your rights in relation to that personal data. Please read this Policy carefully, together with any other privacy notices we may provide, so that you understand how we will treat your personal data.

1. Clarification of Our Role as Data Controller and Processor

1.1 Data Controller Role. We act as a data controller when we determine the purposes and means of processing personal data. This includes when we process: (a) personal data of our employees, contractors and business contacts; (b) website visitor data and analytics information; (c) marketing communications data where we have a lawful basis to do so; (d) business contact information for our own commercial purposes; (e) usage analytics for service improvement purposes (in anonymised or aggregated form only); and (f) Harry and ALICE subscriber account information (name, email, payment details) for account management and billing purposes.

1.2 Data Processor Role. We act as a data processor when we process personal data on behalf of and under the instructions of our clients. This includes: (a) processing candidate application data through our ALICE platform on behalf of hiring organisations; (b) processing Anonymised Screening Data through our Harry platform on behalf of subscribing users; (c) processing client data during consulting projects under client instructions; and (d) processing candidate data for talent placement services on behalf of hiring clients.

1.3 Processing Principles. When acting as a data processor, we process personal data solely in accordance with our clients' documented instructions and do not use such data for our own purposes.

1.4 Harry Users as Data Controllers. If you use Harry Services, you are the data controller for any candidate personal data you process through the platform. You are responsible for ensuring you have a lawful basis for collecting and processing candidate data, including CVs, cover letters, and any other candidate materials you upload to or process through Harry.

2. Information We Collect

2.1 General Collection. We may collect personal data when you: (a) use our websites or download our applications; (b) register for or use our services, including creating a Harry account; (c) subscribe to a Harry Subscription Plan or Free Tier; (d) contact us for support, information or assistance; (e) participate in surveys, webinars, demonstrations or marketing events; (f) apply for positions through our talent placement services; or (g) submit applications through our ALICE platform.

2.2 Categories of Personal Data

2.2.1 Personal Identifiers: name, email address, telephone number, postal address, job title, company name, LinkedIn and other professional social media profiles, and IP addresses.

2.2.2 Professional Information: CVs, resumes, cover letters, work history, education details, professional qualifications, salary information, and employment preferences.

2.2.3 Account Information: for Harry and ALICE subscribers, this includes account credentials, subscription plan details, billing information, and authentication data. Payment card details are processed by our third-party payment provider (currently Stripe, Inc.) and are not stored on our systems.

2.2.4 Technical Information: browser type, operating system, device information, website usage data, log files, and information collected through cookies and similar technologies including application observability tools for diagnosis of user experience issues and for the provision of technical support.

2.2.5 Communication Data: records of communications with us, including emails, phone calls, and support tickets.

2.2.6 Special Category Data: where explicitly provided and with appropriate consent, this may include diversity and inclusion information, accessibility requirements, or right to work status.

2.3 Data We Do Not Collect Through Harry

It is important to understand what Harry does not collect or store:

2.3.1 Original candidate documents (CVs, cover letters, and supporting materials) are processed entirely within the user's web browser. These documents are never transmitted to or stored on our servers.

2.3.2 Candidate personally identifiable information (names, email addresses, telephone numbers, and physical addresses) is automatically stripped from candidate text before any AI processing occurs. Only anonymised text is transmitted to our servers for AI analysis.

2.3.3 Personal details entered by users into candidate reports (candidate name, email, phone number) exist only in the user's browser session and are never transmitted to or stored on our servers. These details are combined with the AI-generated report content only at the point of PDF generation, which occurs entirely within the user's browser.

2.3.4 For the avoidance of doubt, Harry stores only: (a) user account information; (b) job specifications and screening criteria entered by users; (c) Anonymised Screening Data (scores, anonymised summaries, strengths, concerns, and AI-generated content that refers to candidates only as "the candidate"); (d) candidate names as entered by users for identification within the platform; and (e) AI-generated content including feedback email drafts, interview questions, and report content.

3. Service-Specific Data Processing

3.1 Product Development Division: ALICE

3.1.1 Data Processed. For ALICE services, we process: (a) application questions configured by hiring organisations; (b) candidate responses to application questions; (c) system-generated metadata including timestamps and identifiers; and (d) optional personal data (first name and email address only, which may be excluded at client request).

3.1.2 UK Data Sovereignty. All ALICE data processing occurs exclusively within UK-based AWS infrastructure with no international data transfers unless explicitly consented to in writing.

3.1.3 Personal Data Protection. All personally identifiable information is automatically redacted using enterprise-grade AWS redaction technology before any AI processing occurs.

3.1.4 Prohibited Uses. We do not and will not: (a) use candidate application data for marketing purposes; (b) use customer data to train or improve AI models; (c) make automated decisions that produce legal effects without human oversight; or (d) transfer data outside the UK without explicit written consent.

3.2 Product Development Division: Harry

3.2.1 Purpose. Harry is an AI-powered candidate screening and recruitment workflow platform designed for independent recruiters, recruitment agencies, and organisations without established recruitment or HR functions. Harry assists users with job specification optimisation, candidate screening, decision management, communication drafting, interview preparation, candidate reporting, and reverse candidate-to-job matching.

3.2.2 Data Anonymisation Architecture. Harry is built on a privacy-by-design architecture: (a) Browser-side document processing — candidate documents (CVs, cover letters) are read and processed entirely within the user's web browser using client-side technology. The original documents are never uploaded to, transmitted to, or stored on our servers or any third-party servers. (b) Automatic PII stripping — before any text is transmitted from the user's browser for AI analysis, personally identifiable information including names, email addresses, telephone numbers, and physical addresses is automatically removed. Only anonymised text is sent for AI Processing. (c) Anonymised AI output — all AI-generated screening output (scores, summaries, strengths, concerns, and recommendations) refers to candidates exclusively as "the candidate" and never by name or identifying detail. (d) Client-side report personalisation — when users generate candidate reports, personal details (candidate name, email, phone number) are entered in the browser and combined with the AI-generated report content only at the point of PDF generation. This occurs entirely within the user's browser. These personal details are never transmitted to or stored on our servers. (e) No document retention — candidate document text is not retained after AI Processing is complete. Only the resulting Anonymised Screening Data is stored.

3.2.3 Data Stored. For Harry Services, the following data is stored on our servers: (a) user account information (name, email, authentication credentials, subscription details); (b) job specifications, screening criteria, and cover letter guidance entered by users; (c) candidate names as entered by users for identification within the platform; (d) Anonymised Screening Data (overall scores, sub-scores, anonymised summaries, strengths, concerns); (e) AI-generated content (feedback email drafts, interview questions, follow-up email drafts, candidate report content excluding personal details); (f) candidate decision status (shortlisted, not progressing, or pending); (g) progress checklist status; and (h) platform usage data and metadata.

3.2.4 Anti-Bias Safeguards. Harry's AI screening: (a) explicitly excludes assessment based on the nine protected characteristics under the Equality Act 2010; (b) excludes spelling and grammar from scoring criteria; (c) evaluates each candidate independently in isolated AI Processing calls; and (d) provides all outputs as recommendations requiring human review.

3.2.5 Data Processing Location. Harry Services data processing occurs on AWS infrastructure. Data may be processed in AWS regions outside the United Kingdom, subject to appropriate safeguards under applicable data protection legislation. The UK-only data sovereignty guarantees applicable to ALICE (section 3.1.2) do not apply to Harry unless explicitly agreed in writing.

3.2.6 AI Infrastructure. Harry utilises third-party AI infrastructure providers for AI Processing. Anonymised candidate text (with PII already removed) is transmitted to these providers solely for the purpose of generating screening output, feedback drafts, interview questions, and report content. We maintain contractual restrictions preventing these providers from using any data processed through Harry for AI model training or any other purpose.

3.2.7 Payment Processing. Subscription payments for Harry are processed by our designated third-party payment provider (currently Stripe, Inc.). We do not store payment card details on our systems. Stripe's processing of your payment information is governed by Stripe's own privacy policy, available at stripe.com/privacy.

3.3 Consulting Services Division

3.3.1 Processing Approach. For consulting services, personal data is processed: (a) solely in accordance with documented client instructions; (b) within the UK unless client specifically requests otherwise; (c) only for the duration necessary to deliver agreed consulting services; and (d) with deletion occurring within 90 days of project completion unless extended retention is specifically agreed.

3.3.2 Types of Data. This may include client business information, HR process documentation, employee survey data, and implementation materials.

3.4 Talent Placement Division

3.4.1 Candidate Protections. For talent placement services: (a) candidate personal data is never used for marketing without explicit consent; (b) candidate information is never sold or shared beyond agreed placement activities; (c) candidates retain the right to withdraw consent and request data deletion; and (d) transparent communication is provided about data sharing with potential employers.

3.4.2 Data Types. This includes candidate CVs, interview records, reference information, client job specifications, and placement documentation.

4. Lawful Basis for Processing

4.1 Contract Performance. We process personal data where necessary for the performance of a contract to which you are party or to take steps at your request prior to entering into a contract. This includes processing your account information and subscription details for Harry Services.

4.2 Legitimate Interests. We may process personal data where necessary for our legitimate interests, including: (a) providing and improving our services; (b) ensuring the security and integrity of our systems; (c) conducting business development and marketing activities; (d) complying with legal and regulatory requirements; (e) protecting our business interests and those of our clients; and (f) analysing anonymised and aggregated usage data to improve Harry and other products.

4.3 Legal Obligation. We process personal data where necessary to comply with legal obligations to which we are subject.

4.4 Consent. Where required by law, we will obtain your explicit consent before processing personal data, particularly for marketing communications and special category data.

4.5 Harry Users' Lawful Basis. If you use Harry Services to process candidate data, you are responsible for establishing and maintaining your own lawful basis for that processing. This may include legitimate interests in assessing candidate suitability for employment, or such other basis as may be appropriate in your circumstances. We recommend you seek independent legal advice if you are unsure about your obligations.

5. How We Use Personal Data

5.1 Service Delivery. We use personal data to: (a) provide contracted services in accordance with agreed terms; (b) manage customer accounts and relationships; (c) provide customer support and technical assistance; (d) process payments and manage billing; and (e) communicate about service-related matters.

5.2 ALICE-Specific Uses. For ALICE services, personal data is used to: (a) conduct AI-powered analysis of candidate application responses; (b) generate evaluation reports and scoring recommendations; (c) manage recruitment campaigns and reporting; (d) facilitate integration with client systems; and (e) provide transparent reasoning for all AI-generated outputs.

5.3 Harry-Specific Uses. For Harry services, data is used to: (a) optimise job specifications for candidate screening; (b) conduct AI-powered screening and scoring of anonymised candidate text against job specifications; (c) generate candidate decision management tools; (d) draft feedback emails, follow-up questions, and interview preparation materials; (e) generate candidate reports combining screening data with user-provided interview notes; (f) conduct reverse candidate-to-job matching (Spec Ops); (g) manage job lifecycle including archiving and revival; and (h) provide account management, billing, and customer support. For the avoidance of doubt, all AI processing of candidate data occurs on anonymised text from which personally identifiable information has been removed.

5.4 Business Operations. We may use personal data for: (a) service improvement and development; (b) analytics and performance measurement (in anonymised or aggregated form); (c) security monitoring and fraud prevention; (d) legal compliance and regulatory reporting; and (e) protecting our legitimate business interests.

5.5 Marketing Communications. We may use business contact information to send: (a) service updates and product information; (b) industry insights and thought leadership content; (c) event invitations and webinar notifications; and (d) customer satisfaction surveys. For the avoidance of doubt, candidate application data processed through ALICE, candidate data processed through Harry, and candidate personal data from talent placement services are never used for our marketing purposes.

6. Data Sharing and Disclosure

6.1 Service Delivery Partners. We may share personal data with trusted third parties who assist in delivering our services, subject to appropriate data protection agreements. These include: (a) Cloud infrastructure providers (currently Amazon Web Services) for hosting and data processing; (b) AI infrastructure providers for AI Processing of anonymised candidate text through Harry and ALICE; (c) Payment processing providers (currently Stripe, Inc.) for Harry subscription billing; (d) Authorised independent consultants engaged in service delivery; and (e) Customer support and communication tools.

6.2 Legal Requirements. We may disclose personal data where required by law, court order, or regulatory authority, or where necessary to protect our rights, property, or safety or that of others.

6.3 Business Transfers. In the event of a merger, acquisition, or sale of assets, personal data may be transferred as part of the business, subject to appropriate protections for data subjects.

6.4 Client Instructions. When acting as a data processor, we share personal data only in accordance with client instructions and documented agreements.

6.5 Harry Data Sharing Limitations. For Harry Services specifically: (a) Anonymised Screening Data is never shared with third parties other than the AI infrastructure providers necessary to generate the screening output; (b) candidate data processed through Harry is never sold, licensed, or made available to any third party for any purpose; (c) data from one Harry subscriber is never accessible to or shared with any other Harry subscriber; and (d) we do not aggregate candidate data across Harry subscribers for any purpose.

7. International Transfers

7.1 UK Processing Commitment. For ALICE clients specifically requesting UK-only processing, we guarantee that all personal data processing occurs exclusively within UK-based infrastructure with no international transfers.

7.2 Harry Data Processing. Harry Services data may be processed in AWS regions outside the United Kingdom. Where data is transferred to countries outside the UK, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements. The UK-only processing guarantee in section 7.1 applies to ALICE Services only and does not extend to Harry Services unless explicitly agreed in writing and subject to additional fees.

7.3 Transfer Safeguards. Where international transfers are necessary, we implement appropriate safeguards including: (a) adequacy decisions recognised by UK authorities; (b) standard contractual clauses approved by UK authorities; (c) additional technical and organisational measures; and (d) transfer impact assessments where required.

7.4 AI Provider Transfers. Anonymised candidate text processed through Harry may be transmitted to AI infrastructure providers whose servers may be located outside the United Kingdom. We maintain contractual protections with these providers and note that only anonymised text (from which personally identifiable information has already been removed) is transmitted.

7.5 Subprocessor Management. We maintain a list of approved subprocessors and provide 30 days' notice of any changes, with clients having the right to object to new subprocessors.

8. Your Rights

8.1 Data Subject Rights. Under UK data protection law, you have the following rights:

8.1.1 Right of Access: to obtain confirmation that we are processing your personal data and, if so, to obtain a copy of that personal data together with certain information about the processing.

8.1.2 Right to Rectification: to require us to rectify inaccurate personal data and to complete incomplete personal data.

8.1.3 Right to Erasure: to require us to erase your personal data in certain circumstances.

8.1.4 Right to Restrict Processing: to require us to restrict our processing of your personal data in certain circumstances.

8.1.5 Right to Data Portability: to receive personal data concerning you in a structured, commonly used and machine-readable format and to transmit that data to another controller.

8.1.6 Right to Object: to object to our processing of your personal data where we are relying on legitimate interests as the lawful basis for processing.

8.2 Exercising Rights. To exercise any of these rights, please contact us using the details set out in Section 15. We will respond to valid requests within one month of receipt.

8.3 Processor Data. Where we process personal data on behalf of our clients (including through ALICE and Harry), please contact the relevant client or Harry subscriber directly to exercise your rights regarding candidate data. We will provide reasonable assistance to our clients in responding to such requests.

8.4 Harry Account Data. If you are a Harry subscriber, you may: (a) access and update your account information at any time through the platform; (b) request deletion of your account and all associated data by contacting us; and (c) export your Anonymised Screening Data in a commonly used format upon request.

8.5 Candidate Rights Regarding Harry. If you are a candidate whose data has been processed through Harry by a recruiter or employer, please note: (a) the recruiter or employer who processed your data is the data controller and your primary point of contact for exercising your rights; (b) original candidate documents are processed in the recruiter's browser and are never stored on our servers; (c) only anonymised data (which does not identify you) is stored on our servers; and (d) you may contact us if you have concerns about how your data has been processed, and we will assist where we are able.

9. Automated Decision-Making and Profiling

9.1 ALICE AI Processing. Our ALICE platform uses artificial intelligence to analyse candidate application responses. However: (a) no solely automated decisions are made that produce legal effects or similarly significant effects; (b) all AI-generated recommendations require human review and decision; (c) full reasoning and scoring rationale is provided for transparency; (d) human reviewers may override AI recommendations; and (e) affected individuals may request human review of AI analysis.

9.2 Harry AI Processing. Our Harry platform uses artificial intelligence to screen and assess anonymised candidate text against job specifications. The following safeguards apply: (a) All AI-generated screening scores, summaries, and recommendations are provided as advisory output only and are never used to make automated decisions with legal or similarly significant effects; (b) All employment decisions (shortlisting, rejection, progression, offers) are made by the human user, not by the AI; (c) AI screening explicitly excludes assessment based on the nine protected characteristics under the Equality Act 2010; (d) Spelling and grammar are excluded from scoring criteria to avoid disadvantaging candidates with dyslexia or other conditions; (e) Each candidate is evaluated independently in isolated AI Processing calls to prevent comparative bias; (f) AI-generated communications (feedback emails, interview questions, follow-up emails, candidate reports) are generated as editable drafts for human review before use; and (g) Users are responsible for reviewing all AI-generated content before reliance or use, and for ensuring that employment decisions are made by appropriately qualified humans.

9.3 AI Training Prohibition. We do not use customer data, candidate data, or any data processed through ALICE or Harry to train or improve AI models. We use third-party AI models with contractual guarantees from providers that data processed through our platforms will not be used for training purposes.

9.4 Right to Review. You have the right to obtain human intervention, express your point of view, and contest any automated decision that affects you.

10. Data Retention

10.1 Retention Principles. We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations, resolve disputes, and enforce agreements.

10.2.1 ALICE Services: Data is retained during active campaigns plus 30 days unless extended retention is specifically agreed with the client.

10.2.2 Harry Services: (a) Account information is retained for the duration of the subscription and for a period of 90 days following account termination to allow for reactivation; (b) Anonymised Screening Data (job specifications, screening scores, AI-generated content) is retained for the duration of the subscription and deleted within 90 days of account termination unless earlier deletion is requested; (c) candidate document text is never retained; it is processed in the user's browser and only anonymised output is stored; (d) candidate report personal details (name, email, phone) are never retained as they exist only in the user's browser session; (e) Free Tier account data may be subject to shorter retention periods as published on our website; (f) Archived job data within Harry is retained as part of the user's active account data and is included in deletion upon account termination.

10.2.3 Consulting Services: Project data is deleted within 90 days of project completion unless client requests extended retention.

10.2.4 Talent Placement: Candidate data is retained only with ongoing consent and is automatically deleted after 24 months of inactivity unless consent is renewed.

10.3 Secure Deletion. Upon expiry of retention periods, personal data is securely deleted using industry-standard methods, including removal from backup systems.

11. Data Security

11.1 Security Measures. We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction, including: (a) encryption of data in transit and at rest; (b) regular security assessments and testing; (c) access controls and authentication measures; (d) staff training on data protection and security; (e) incident detection and response procedures; and (f) for Harry Services, browser-based document processing to minimise data exposure and automatic PII stripping before any server-side processing.

11.2 Harry-Specific Security Measures. Harry implements additional security measures including: (a) server-side authentication with encrypted credentials; (b) no storage of original candidate documents on any server; (c) automatic anonymisation of candidate text before AI Processing; (d) production source map protection to prevent code inspection; and (e) per-account data isolation to prevent cross-account data access.

11.3 Certifications. We maintain Cyber Essentials certification and implement security standards aligned with ISO 27001 principles.

11.4 Data Breach Response. In the event of a personal data breach, we will: (a) contain and investigate the breach promptly; (b) notify the relevant supervisory authority within 72 hours where required; (c) notify affected individuals where there is a high risk to their rights and freedoms; (d) notify client data controllers within 48 hours for processor data; and (e) maintain records of all breaches and remedial actions taken.

12. Cookies and Similar Technologies

12.1 Cookie Use. We use cookies and similar technologies on our websites (including genai-harry.com) to ensure functionality, analyse usage, and provide personalised experiences. For detailed information about our cookie practices, please see our Cookie Policy.

12.2 Cookie Consent. We obtain appropriate consent for non-essential cookies and provide mechanisms for you to manage your cookie preferences.

12.3 Harry Platform. Harry may use essential cookies and local storage for: (a) maintaining your authenticated session; (b) storing your theme preference (light or dark mode); and (c) platform functionality. These are strictly necessary for the operation of the service.

13. Children's Privacy

13.1 Age Restrictions. Our services are not intended for children under 16 years of age. We do not knowingly collect personal data from children under 16.

13.2 Parental Rights. If we become aware that we have collected personal data from a child under 16 without appropriate consent, we will take steps to delete such data promptly. Parents may contact us regarding any concerns about their child's personal data.

14. Changes to This Policy

14.1 Policy Updates. We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.

14.2 Notification. We will provide at least 30 days' notice of material changes by email and by posting notice on our website. Continued use of our services after such notice constitutes acceptance of the updated Policy.

14.3 Version Control. We maintain records of previous versions of this Policy and the dates of material changes.

15. Contact Information

15.1 Data Protection Enquiries. For any questions about this Privacy Policy or our data protection practices, please contact:

Data Protection Officer: Adam Butwilowski
Email: privacy@generativeaisolutions.com
Post: Generative AI Solutions Limited, HLB House, 68 High Street, Tarporley, Cheshire, CW6 0AT, United Kingdom

15.2 Complaints. You have the right to make a complaint to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. Contact details are available at ico.org.uk or telephone 0303 123 1113. However, we encourage you to contact us first so that we may address your concerns directly.

Effective Date: 5th July 2026 · Document Version: 3.0