Onwu AI is a trading name of AI-ENGAGE LTD, a company registered in England and Wales, registered office 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ ("Onwu AI", "we", "us", "our"). We operate onwuai.co.uk and provide a personal AI assistant (the "Service"). We are the data controller for personal data processed in connection with the Service.
This policy explains how we collect, use, store and disclose your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
1. Personal data we collect
- Account data - your name, email address, and a securely hashed password.
- Conversation data - the questions, prompts and text you choose to type into the assistant, and the responses generated for you.
- Billing data - records of credit purchases and balances. Card details are handled by our payment processor; we do not store full card numbers.
- Technical data - basic logs (e.g. IP address, timestamps, error logs) needed to operate and secure the Service.
We do not connect to, read, import or ingest your email, files, messages or any third-party accounts. The assistant only processes what you type into it.
2. How we use your data and our lawful bases
| Purpose | Lawful basis |
|---|---|
| Creating your account and providing the assistant | Performance of a contract |
| Processing payments and credit | Performance of a contract / Legal obligation |
| Security, fraud prevention and abuse detection | Legitimate interests / Legal obligation |
| Support and service-related emails | Performance of a contract |
| Improving reliability and quality of the Service | Legitimate interests |
| Optional marketing emails | Consent (you can withdraw it anytime) |
You can object to processing based on legitimate interests at any time (see Section 9).
3. AI processing and model training
To generate responses, the text you submit is sent to a third-party AI model provider acting as our processor under a data processing agreement, solely to produce your answer. Your conversations are not sold and are not used to train AI models - ours or anyone else's. We do not use your content for advertising.
4. Who we share data with
- Service providers (processors): hosting, our AI model provider, email delivery, and payment processing - each under contract and only as needed to run the Service.
- Regulators and law enforcement: where required by law, court order or a valid legal request (e.g. the ICO, HMRC, or the police).
We do not sell your personal data.
5. International transfers
Some providers may process data outside the UK. Where they do, we rely on appropriate safeguards such as UK adequacy regulations or the International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.
6. Data retention
| Data | Retention |
|---|---|
| Account data | While your account is active; deleted within 30 days of account closure |
| Conversation data | Until you delete it or close your account; then removed within 30 days |
| Billing records | Up to 7 years where required by law (e.g. tax/accounting) |
7. Cookies
We use only strictly necessary cookies. After you sign in we set a single session cookie so the Service can keep you securely logged in - this is essential and is exempt from consent under PECR. We do not use advertising, analytics or third-party tracking cookies. A short cookie notice is shown on your first visit; dismissing it records your acknowledgement in your browser's local storage (not a cookie). You can block cookies in your browser settings, but the Service may not work correctly without the essential session cookie.
8. Data security
Data is encrypted in transit and at rest, access is restricted on a need-to-know basis, and passwords are stored only as salted hashes. No system is perfectly secure, but we take reasonable technical and organisational measures to protect your data and will notify you and the ICO of a qualifying breach as required by law.
9. Your rights under UK GDPR
Subject to the conditions in the law, you have the right to: be informed; access your data; rectify inaccurate data; erase data; restrict processing; data portability; and object to processing (including direct marketing). To exercise any right, contact us (Section 12). We will respond within one month.
Right to complain
You can complain to the Information Commissioner's Office (ICO) if you believe we have mishandled your data:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113 · ico.org.uk
We would appreciate the chance to resolve your concern first, so please contact us before approaching the ICO.
10. Children
The Service is not directed at children under 16. We do not knowingly collect data from children under 16. If you believe a child has provided us data, contact us and we will delete it.
11. Changes to this policy
We may update this policy. Material changes will be notified by email or a prominent notice on the website. This policy was last updated on 18 May 2026.
12. Contact us
For any privacy question or to exercise your rights, contact us:
- Email: support@onwuai.co.uk
- Post: AI-ENGAGE LTD, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom