Privacy Policy

Last updated: 1 September 2026

DRAFT for review. This is a starting draft, not legal advice. Please have it reviewed by a solicitor and checked against your actual data practices before publishing. Anything in [brackets] needs confirming.

This policy explains how Business Waterwheel Limited ("we", "us") collects and uses your personal data when you use the Business Waterwheel™ AI Coach and this website. We are the data controller for that information.

1. Who we are

Business Waterwheel Limited, a company registered in England and Wales (Company No. 17238111), registered office [registered address]. For any privacy question, contact us at [[email protected]].

2. The information we collect

Account details — your name, email and login credentials.
Business information you provide — sector, size, goals, your assessment answers, and any documents you choose to share.
Coaching conversations — the messages and history that let the coach remember your progress.
Payment information — handled by our payment provider [Stripe]; we do not store your full card details.
Usage & technical data — how you use the service, device and log information, and cookies (see our Cookie Policy).

3. How we use it, and our lawful basis

To provide and personalise your coaching and run your account — performance of our contract with you.
To operate, secure and improve the service — our legitimate interests.
To take payment — performance of our contract.
To send you service messages, and marketing where you've agreed — legitimate interests / your consent.
To meet legal and regulatory obligations — legal obligation.

4. How we use AI with your data

Your information is processed by our AI coaching system to personalise your coaching. Your business data is not used to train third-party AI models. Our AI processing is carried out by [AI provider], under contract terms that [confirm — e.g. prohibit training on your data]. There's more detail on how we use AI.

5. Who we share it with

We share data only with service providers who help us run the service, under contract and only as needed: [hosting provider], [AI provider], [Stripe] for payments, and [analytics provider]. We do not sell your data.

6. Where your data is held

Your data is hosted in the United Kingdom. [If any provider processes data outside the UK, we put appropriate safeguards in place — confirm and describe.]

7. How long we keep it

We keep your data for as long as your account is active and for [retention period] afterwards, unless we need to keep it longer to meet a legal obligation.

8. Your rights

Under UK data protection law you have the right to access, correct, delete, restrict or object to our use of your data, to portability, and to withdraw consent. To exercise any of these, email [[email protected]]. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

9. Cookies

We use cookies as described in our Cookie Policy.

10. Changes to this policy

We may update this policy from time to time. We'll post the new version here and update the date above.