Legal

Privacy Policy

Version v1.0 · Effective 9 July 2026 · Download PDF

David is provided by Ergonomy Limited, a company registered in England and Wales (company no. 17312959) with its registered office at 102 Crawford Street, London, England, W1H 2HR ("we", "us", "our"). This policy explains how we handle personal data. For questions, contact us at privacy@meetdavid.ai.

1. Controller and processor

Our role depends on the data:

  • For account and billing data (the information we hold to run your account and communicate with you), Ergonomy is the controller.
  • For personal data processed through the Service on your organisation's behalf (the content, documents, and records David works with via your connected tools), your organisation is the controller and Ergonomy is the processor, acting on your instructions under our Data Processing Agreement.

This distinction matters: this policy describes the data for which we are the controller. Data-subject requests about content processed on a customer's behalf are routed through that customer as controller (see section 7).

2. Information we collect

  • Account and contact data: name, email address, company name, job title, and details you provide when you sign up or contact us.
  • Billing data: where you take a paid plan, the information needed to bill you.
  • Usage and telemetry: how the Service is used, for security, reliability, and aggregate improvement.
  • Customer content (as processor): data from your connected tools (for example Microsoft Teams, WhatsApp, Xero, or Bullhorn) that David processes to provide the Service, handled under the Data Processing Agreement.

3. How we use information and our lawful bases

  • Provide and operate the Service (performance of a contract).
  • Secure the Service and prevent fraud and abuse (legitimate interests).
  • Improve the Service using aggregated and de-identified data (legitimate interests).
  • Bill you and manage payments (performance of a contract).
  • Communicate with account contacts about the Service, and market to them (legitimate interests, or consent where required).

We do not sell your personal data.

4. Third-party AI providers and sub-processors

To provide the Service we use sub-processors, including Anthropic (LLM inference) and Amazon Web Services (AWS Bedrock inference and hosting). The AI model provider engaged for a given customer depends on that tenant's configuration. Credentials and integration secrets are never sent to a model; they are used only server-side to authenticate the tools David runs for you. Model providers' API terms contractually prohibit training on customer data. Where AWS Bedrock or Google Vertex is configured with a UK or EU region, inference can be pinned to that region. Our maintained list of sub-processors, with their purpose and data location, is on our sub-processor page, and the technical detail is on our data-residency page.

5. International transfers

Where we transfer personal data outside the UK or EEA, we rely on an appropriate safeguard: the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision. Our default posture is EU/UK data residency for hosting (AWS eu-west-1) with region-pinnable inference where supported.

6. Data retention

We keep account and contact data for as long as your account is active and as needed to provide the Service, then for a limited period as required for legal, tax, and audit purposes. Billing records are kept as long as the law requires. Customer content processed as processor is retained per the Data Processing Agreement and deleted or returned at the end of the Service. Usage and telemetry are kept for as long as needed for security and aggregate analysis.

7. Your rights

Under UK GDPR you have the right to access, correct, delete, or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights for data we control, contact us at privacy@meetdavid.ai. For content processed on a customer's behalf, end users should route requests through the customer (the controller), which we will assist as processor. You may also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Data isolation

Each customer's data is logically isolated with per-tenant key prefixes, identifiers, and access boundaries. Your data is never shared with or accessible to another customer. See our security page for technical details.

9. Cookies

This website does not currently use cookies, analytics, or third-party tracking technologies, and we do not load third-party tracking scripts into your browser. If we introduce cookies or analytics in future (for example, to measure engagement and click-through so we can improve the site), we will update this policy beforehand and ask for your consent to any non-essential cookies, as the law requires.

10. Changes and contact

We may update this policy from time to time. Each version is published at its own dated, versioned address and remains retrievable, and we will notify account contacts of material changes. For any questions, contact us at privacy@meetdavid.ai.