This privacy notice explains how Avanti Mind Ltd ("we", "us", "our") collects, uses, stores and shares your personal data when you use Avanti Brief ("the Service"). It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Avanti Mind Ltd is the data controller for personal data processed through the Service.

As at 13 October 2026, Avanti Brief is not yet open to the public. This notice describes how we handle personal data in the Service and applies to anyone who uses it, including during testing.

This notice covers the Service only. How we handle the personal data we collect through this website (the contact form, early-access requests and cookies) is explained in our website privacy notice.

1. Who We Are

Avanti Mind Ltd
The Venture Centre Sir William Lyons Road, University Of Warwick Science Park, Coventry, England, CV4 7EZ, United Kingdom
Company number: 16049394

Data protection enquiries and rights requests: use our contact page and say that it is a privacy request.

We do not currently have a statutory obligation to appoint a Data Protection Officer (DPO). For all data protection enquiries, please use the contact page.

2. Data We Collect

We collect and process the following categories of personal data.

2.1 Account Data

Name and email address (provided at registration)
Password hash (your password is never stored in plain text)
The versions of these Terms and this notice you have accepted, and when you accepted them

2.2 Email Account Data

Avanti Brief connects to Gmail and Microsoft 365 mailboxes only. We do not connect to any other email provider.

For each connected mailbox we hold:

the OAuth access token and refresh token, encrypted in our database;
the mailbox's email address and provider.

2.3 What We Store About Each Email

For each email the Service synchronises, we store:

the subject line;
the snippet, the short preview of the opening text that your email provider itself supplies;
sender and recipient metadata: the sender's name and address, the recipients' addresses, the date received, message and thread identifiers, read and starred status, your provider's labels or folders, and whether the message has attachments;
attachment metadata only: file name, file type and size (we do not download or store attachment contents);
AI-generated analysis: a summary, a category, a priority score, action items, deadlines, key entities, sentiment, and whether the email looks urgent or needs a reply;
an embedding: a numerical representation of the email's subject and its AI summary, used for semantic search. It is not generated from the email body;
items derived from the analysis: commitments and deadlines, "waiting on" follow-ups, and per-contact interaction statistics (for example how often you and a contact write to each other and how quickly you reply). For the "Going cold" reminder in your brief, this is limited to the times of the last message received from and sent to a contact, your typical reply time, and, if you choose "Not important" for a contact, the time until which that contact is muted; it does not use message content.

2.4 What We Never Store

The body of your email is never stored. When the Service analyses an email, it fetches the body from your email provider on demand, holds it in memory only for the duration of that analysis, and then discards it. The body is never written to our database, our queues or our files.

Our read-only guarantee. Avanti Brief requests read-only access to your email account, and only that. For Gmail, the only mail scope we request is gmail.readonly; alongside it we request userinfo.email and userinfo.profile, which tell us which Google account you connected and its display name. We never request, and our code base is architecturally unable to use, gmail.modify, gmail.send, gmail.compose, or any scope that would let us alter, label, archive, delete or send email on your behalf. For Microsoft 365, we request only Mail.Read (plus User.Read and offline_access to keep the connection alive), never Mail.ReadWrite or Mail.Send. If you choose to add your calendar (§2.4A), we additionally request one read-only calendar permission for that account, and no other. You can review the scopes granted for each connected account at any time in your provider's own account permissions page (for example Google's "Third-party apps with account access").

2.4A Calendar Data (only if you add your calendar)

Adding a calendar is optional and separate from connecting a mailbox. It is not part of the default connection. Where it is offered, you add it yourself for one connected Microsoft 365 or Gmail account at a time, from Settings > Email Accounts, by choosing "Add my calendar". Until you do, we do not request any calendar permission, and we hold no calendar data.

What we ask for. Read-only access only: Calendars.ReadBasic for Microsoft 365, and calendar.events.readonly for Google. We never request a permission that would let us create, change, accept or delete a calendar event.

What we read. For each event we read its identifier, title, start and end time, organiser, attendees, whether it has been cancelled, whether it lasts all day, whether it is an online meeting (for Microsoft 365 the provider's online-meeting flag, for Google the presence of a video-conference link or a conference identifier; Google's own video-meeting link is received only to set that flag and is then discarded, and we never request dial-in details) and your own reply to the invitation (accepted, tentative, declined or not yet answered). We read your main calendar only, and we ask only for events close to today. We never request the event description or body. Cancelled events and events you have declined are not stored.

What we store. For each event we store the title, the start and end time, the organiser's email address, the attendees' email addresses, whether it is an online meeting, whether it lasts all day, and your own reply to the invitation as a single word. We do not store the event description or body, the join link or dial-in details: there is nowhere in our database to hold them. Attendees are other people, whose addresses are held only so that your brief can show who a meeting is with. An invitation you have not accepted is left out of your brief unless its organiser is someone you already correspond with.

How long we keep it. Stored calendar events are deleted 14 days after the event starts. The retention period is never shorter than one day. If you delete your account, they are erased with it (see §8). They are included when you download your data (§11).

How we use it. Calendar events are used to build the "Today's meetings" section of your brief. That section is built without any AI analysis: no calendar data is sent to Anthropic, to OpenAI for analysis, or to any other AI provider (§5). The section is shown in the brief on the channels you use, so the times and titles of your meetings today (and, on the web, by email and on Slack, the latest thread subject and open commitments or replies for attendees you already correspond with) appear in the brief itself. If you receive your brief on WhatsApp, Meta receives the start times and titles of up to three of today's meetings in the message (§6). If you receive it on Slack, Slack receives the times and titles of today's meetings and the same attendee context lines as the web brief, as it receives the rest of your digest. If you use audio briefs, the number of meetings and the first meeting's time and title are part of the script sent to our speech provider, OpenAI, to be turned into audio (§5). An all-day event is shown as "All day". We never use a calendar event for anything else.

Removing it. You can withdraw your consent at any time, as easily as you gave it, from Settings > Email Accounts: choose "Remove calendar" for the account. Brief then stops reading that account's calendar and deletes the calendar events it has stored for that account straight away. Your email access is not affected. You can also remove Avanti Brief's access at your provider (see §4.1 for where); that removes our access to your mail as well as your calendar, because the provider treats it as one connection. Disconnecting the mailbox or deleting your account deletes our copy of the tokens and the stored events.

2.5 Digest Data

The content of each digest we deliver to you, and a record of when and on which channel it was delivered.

2.6 WhatsApp Notification Data

While WhatsApp delivery is enabled for the Service, and only if you opt in:

your phone number, in international format;
the date and time you gave consent to receive WhatsApp messages;
a hashed one-time verification code and its expiry (the plain code is never stored, only its hash);
the date and time your number was successfully verified.

2.7 Slack Connection Data

If you connect a Slack workspace, we hold the Slack access token and delivery details for that connection, encrypted in our database.

2.8 Notification Preferences and Quiet Hours Data

your notification channel choices (email, Slack and, while it is enabled, WhatsApp) and which are enabled;
your timezone and configured quiet-hours window;
whether genuinely urgent notifications are allowed to override your quiet hours.

2.8A Mobile Push Notification Data (only if you allow notifications in the app)

While mobile push notifications are enabled for the Service, if you use the Brief mobile app and allow it to send you notifications, the app registers your device with us and we hold, for each registered device:

the device's push token, which is the address Google's Firebase Cloud Messaging uses to reach that handset. We store it encrypted in our database and look it up by a one-way hash;
the platform (Android, or iOS where that is enabled);
when the device was last registered or refreshed, when the record was created, and, if Google tells us the token is no longer valid, when we stopped sending to it.

We keep at most 10 devices per account; registering an eleventh removes the device that was seen longest ago. A push notification is a signal, not a copy of your email. It carries fixed wording ("Your brief is ready" or "An urgent email needs you", with a line telling you to open Avanti Brief) and an internal identifier for the brief or email, which only the app can use once you have signed in. It never carries a subject, sender name or snippet. You can switch push notifications off for your account, and you can decline or withdraw the notification permission in your device's settings.

2.9 Feedback and Personalisation Data

When you give feedback on an email (for example "More like this", "Less", "VIP" or "Not urgent") from within the app or via a one-click link in a digest email, we record:

the action you took and the channel you took it on (in-app or email link);
the sender's email address and domain the feedback relates to;
the date and time of the action.

This is used solely to tailor how future emails from that sender are prioritised for you (see §4).

2.10 Session and Security Data

Session records, including your IP address and browser user agent
Audit log entries recording security-relevant actions on your account, which can include the IP address and browser user agent the action came from and, for some actions, your email address

2.11 Billing Data

Paid plans are not open yet: nothing is sold and no payment is taken. Once they open, we hold:

Your Stripe customer identifier and subscription status
The brand of your payment card (for example Visa) and its last four digits, so that you can recognise the card on file
We do not store your full card number, expiry date or security code. These are held by Stripe.

2.12 Usage and Interaction Data

Digest email opens (only if you opt in). Open tracking is off unless you turn it on. If you switch on 'Let Brief see which digests you open, to improve your brief' in your notification settings, each digest email we send you contains a small invisible image (an open-tracking pixel). When your email program loads it, we record that the digest was opened and when. The event we store does not include your IP address or device details. If you have not opted in, your digest emails contain no pixel and no opens are recorded. You can switch it off again at any time; from then on no further opens are recorded, including from digests you have already received. If your email program blocks images, no open is recorded.
Engagement with individual emails. When you open an email from your digest in the app, or skip it, we record that event against the digest and the email it relates to, and when it happened.
Feature usage records. We record which features are used (for example that a digest was sent, a mailbox synchronised or an AI analysis ran), with counts and costs, linked to your account by an internal identifier only. These records contain no email content, name or email address.

We use this data to measure whether digests are useful to you, to tailor prioritisation (see §4), and to understand and manage the cost of running the Service.

3. Legal Bases for Processing

We process your personal data on the following legal bases under UK GDPR Article 6:

Data category	Legal basis
Account data	Contract performance (Art. 6(1)(b)): necessary to provide the Service
Email account data and email data	Contract performance (Art. 6(1)(b)): core functionality of the Service
Calendar data (§2.4A)	Consent (Art. 6(1)(a)), given by choosing "Add my calendar" for an account; you can withdraw it by choosing "Remove calendar" for that account in Settings (your email is unaffected), or by removing Brief's access at your provider or disconnecting the account
Digest data	Contract performance (Art. 6(1)(b)): delivering the digests you asked for
WhatsApp notification data	Consent (Art. 6(1)(a)): only collected once you actively opt in and verify a number
Slack connection data	Contract performance (Art. 6(1)(b)): only held once you connect Slack
Notification preferences and quiet hours	Contract performance (Art. 6(1)(b)): you configure these to control how the Service delivers to you
Mobile push notification data (§2.8A)	Consent (Art. 6(1)(a)): only collected if you allow notifications in the app; you can withdraw it by switching push notifications off for your account or by withdrawing the notification permission on your device
Feedback and personalisation data	Legitimate interests (Art. 6(1)(f)): improving the relevance of prioritisation for you; you can stop giving feedback at any time
Session and security data	Legitimate interests (Art. 6(1)(f)): security and fraud prevention, and keeping an accountable record of actions taken on your account
Digest email opens (§2.12)	Consent (Art. 6(1)(a)), given by switching open tracking on in your notification settings; you can withdraw it there at any time
Other usage and interaction data	Legitimate interests (Art. 6(1)(f)): measuring whether digests are useful, tailoring prioritisation, and managing the cost of the Service
Billing data	Contract performance (Art. 6(1)(b)) and Legal obligation (Art. 6(1)(c))

4. How We Use Your Data

We use your personal data to:

create and manage your account;
connect to and synchronise your email accounts via OAuth, on a strictly read-only basis (see §2.4);
analyse your email using AI to provide the core Service features;
deliver digest notifications through the channel or channels you choose (email, Slack and, while they are enabled, WhatsApp and mobile push), respecting your quiet-hours preferences;
learn from the feedback you give on individual emails, and from which digests and emails you open or skip, to adjust future prioritisation;
process payments and manage subscriptions once paid plans open;
send transactional emails (account notifications and security alerts);
detect, investigate and prevent fraud and security incidents;
comply with our legal and regulatory obligations.

We do not use your email content or personal data for advertising.

4.1 Google user data and the Limited Use requirements

Avanti Brief's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the same policy, including the Limited Use requirements, and to the Google Workspace API user data and developer policy.

In practice, for the data we receive from your Gmail account (the messages we read with gmail.readonly, and your Google account's email address and name):

we use it only to provide and improve the features you see in Avanti Brief: your prioritised brief, email summaries and analysis, search, "Ask your Brief" and the digests you choose to receive;
we transfer it only to the sub-processors listed in §5 and §6 and, if you choose to connect a Slack workspace, to Slack, which receives your digests (§2.7), and only to provide those features; for security purposes, such as investigating abuse; to comply with applicable law; or as part of a merger, acquisition or sale of our assets, after first obtaining your explicit consent;
our staff do not read it unless you have agreed to it, it is necessary for security purposes, such as investigating abuse or a compromised account, or it is necessary to comply with applicable law (see "Staff access to your account" below);
we never sell it, never transfer it to advertising platforms, data brokers or other information resellers, and never use it for advertising (including retargeting and personalised or interest-based advertising) or to determine creditworthiness or for lending;
we do not use it to create, train or improve general artificial intelligence or machine learning models, and we send it to our AI providers (§5) only through their commercial APIs, whose terms do not allow them to train their models on it.

Staff access to your account. Our staff can view your account, and so the information Brief has derived from your email (subjects, snippets, summaries and analysis), only by signing in to it through an audited support session, and only in one of these cases:

You have allowed it. Under Settings > Privacy, the "Allow Avanti Brief support to view your account for 72 hours" switch is off by default. Switching it on lets our support staff open a session on your account for the next 72 hours, after which the permission ends on its own. You can switch it off at any time. When you switch it off, or the 72 hours end, no new session can be opened and any support session already in progress ends at once. We cannot switch it on or off for you, even from within a support session. Each time you switch it on or off, we record it in your account's audit trail.
A security reason. For example, investigating abuse of the Service or a compromised account.
A legal reason. Where it is necessary to comply with applicable law.

In a security or legal case, the staff member must choose the category and write down the specific reason before the session can start, and the session ends automatically after at most 2 hours. Every support session is recorded in the audit trail with who opened it, when it started and ended, and on what basis: your permission, or the security or legal reason given. When you download your data (§11), it includes your support access setting, each time you switched it on or off, and each support session opened on your account: when it started and ended, and whether it relied on your permission or on a security or legal reason. The download does not include the staff member's identity or the written reason, which we keep as internal security records. Your support access setting is cleared when your account is deleted.

Revoking our access. When you disconnect a Gmail account, or delete your Avanti Brief account, we ask Google to revoke the access you granted us, and then delete our copy of the access and refresh tokens. If Google cannot be reached at that moment, we still delete our tokens, so we can no longer use the access, and we record the failure so that we can follow it up. You can also remove Avanti Brief yourself at any time from the "Third-party apps and services" page of your Google Account (myaccount.google.com/connections).

For Microsoft 365, Microsoft does not provide a way for an app holding the permissions we request to withdraw its own access for a single user. When you disconnect a Microsoft 365 account, or delete your Avanti Brief account, we delete our copy of the access and refresh tokens, so we can no longer obtain new access to your mailbox, but Avanti Brief may remain listed among your apps until you remove it. You can remove it at any time: for a work or school account at myapps.microsoft.com, and for a personal Microsoft account at account.live.com/consent/Manage. If your organisation's administrator approved Avanti Brief for everyone in your organisation, you cannot remove it yourself at myapps.microsoft.com; ask your administrator to remove it.

5. AI Processing

The Service uses the commercial APIs of two AI providers. It does not use their consumer products.

Anthropic (Claude)

Anthropic PBC, USA

Data sent: the email's subject, sender address and body (fetched on demand, see §2.4) for analysis; for the optional "Ask your Brief" chat, your question, the earlier messages in that conversation, and the stored summaries, commitments, "waiting on" items and digest text relevant to your question; for suspicious-email checks, the sender's address and the stored subject and snippet (never the body)
Purpose: analysing, summarising and prioritising your email, answering "Ask your Brief" questions, and checking suspicious emails (Anthropic is our primary provider for all three)

OpenAI

OpenAI, LLC, USA

Data sent: the email's subject and AI summary to generate embeddings; the subject and snippet for a low-cost first-pass classification of routine mail; and, only when Anthropic is unavailable, the same data described for Anthropic above, including your "Ask your Brief" questions and the data sent for suspicious-email checks (OpenAI is our fallback provider)
Audio briefs: if you use audio briefs, the script that is turned into speech is sent to OpenAI's text-to-speech service. It is built from your brief's stored content: counts, the time, sender name and subject of each email that needs you, and, if you have added your calendar (§2.4A), the number of meetings today and the first meeting's time and title. It does not hold attendees, thread subjects for meetings or event descriptions, and never an email body.
Purpose: generating embeddings for semantic search, first-pass classification, fallback for analysis, "Ask your Brief" and suspicious-email checks, and, for audio briefs, text-to-speech

6. Sub-Processors

We use the following sub-processors to run the Service:

Provider	Purpose	Data processed	Location
Scaleway	Application hosting, database hosting and object storage	All Service data described in §2	France (EU)
Cloudflare	Network edge, TLS and traffic protection in front of the Service	Web requests to the Service, including IP address	Global network (Cloudflare, Inc., USA)
Backblaze	Off-site database backups	Database backups	Netherlands (EU)
Amazon Web Services (Simple Email Service)	Transactional and digest email delivery	Your email address and the content of emails we send you	United Kingdom (London region)
Anthropic	AI analysis (see §5)	Email data described in §5	USA
OpenAI	Embeddings, classification, fallback AI analysis and text-to-speech for audio briefs (see §5)	Email data described in §5, and the audio brief script	USA
Stripe	Payment processing and subscriptions, once paid plans open	Billing name, email address, subscription and payment data. Where VAT is calculated through Stripe Tax: the IP address you subscribe from (used only to work out your tax location) and, for some paid plans, any VAT number you give us	USA
Meta (WhatsApp Business Platform)	WhatsApp digest delivery, only while WhatsApp delivery is enabled for the Service and only if you opt in	The phone number you verified and the text of the digest being delivered	USA
Google (Firebase Cloud Messaging)	Delivering mobile push notifications, only while push notifications are enabled for the Service and only if you allow notifications in the Brief mobile app	Your device's push token and the notification sent to it: the fixed notification wording and an internal brief or email identifier, never a subject, sender or snippet	Global network (Google LLC, USA)
Google (Cloud Pub/Sub)	Real-time change notifications for connected Gmail mailboxes	Your Gmail address and notifications that your mailbox has changed	Global network (Google LLC, USA)

Meta never receives the body of your emails. It receives the phone number you supplied and the digest message: the digest's name, how many emails it covers, and a one-line highlight, which is either the digest's AI summary or the subject line and sender name of your top email. If you have added your calendar (§2.4A), the message can also carry the start times and titles of up to three of today's meetings. If WhatsApp delivery is not enabled for the Service, or you have not opted in, nothing is sent to Meta.

Google Firebase Cloud Messaging carries push notifications from the Service to your device. It receives your device's push token and the notification we send (the fixed wording and an internal identifier), and it contains no email content. If you have not allowed notifications in the app, nothing is sent to Google for this purpose.

Google Cloud Pub/Sub carries Gmail's "your mailbox has changed" notifications to the Service so that new mail is picked up promptly. Each notification contains your Gmail address and a change marker; it contains no email content.

The following are services you choose to connect, not our sub-processors: Google (Gmail) and Microsoft (Microsoft 365) are the providers we read your email from, and Slack receives your digests only if you connect a Slack workspace.

7. International Transfers

Our hosting, database, backups and email delivery are in the UK and the EU. Anthropic, OpenAI, Stripe, Meta, Google and Cloudflare are United States companies, so personal data processed by them may be transferred outside the UK. Transfers to the EU rely on the UK's adequacy regulations for the EU. Transfers to the United States rely on the transfer safeguards set out in each provider's data processing terms. You can ask us for details of the safeguard that applies to any provider through our contact page.

8. Data Retention

Data category	Retention period
Email data (subject, snippet, sender and recipient metadata, attachment metadata) and everything derived from it (AI analysis, embedding, "waiting on" follow-ups, contact interactions)	90 days from the date the email was received. After 90 days the email is marked for deletion, and it is permanently deleted, together with everything derived from it, 7 days later.
Email body content	Never stored. Fetched on demand, held in memory only during analysis, then discarded.
Calendar events (§2.4A)	14 days after the event starts (never less than one day), or at once when you choose "Remove calendar" for the account.
Digest records, and the open and engagement events recorded against them (§2.12)	30 days
Data exports you request	Download link and file expire after 72 hours
Audit log entries	365 days. If you delete your account, the entries are kept for the rest of that period as a record of what happened, but your IP address, browser user agent, email address and name are removed from them.
Feature usage records (§2.12)	Kept after you delete your account, with the link to your account removed. They contain no name, email address or email content.
Mobile push notification data (§2.8A)	Until the device is removed from your account, it is replaced because you have registered more than 10 devices, or you delete your account. We do not otherwise delete stale device records automatically, so a device you have stopped using keeps its record until one of those happens.
Account data, connected-account tokens, commitments, contact statistics, preferences, feedback, Slack data and, while WhatsApp delivery is enabled, WhatsApp data	Until you delete them or your account

Deleting your account. When you delete your account, erasure starts immediately. There is no waiting period. A background job permanently erases your account, your connected mailboxes and their tokens, every stored email and everything derived from it, your commitments, contact statistics, preferences, feedback, Slack connection, mobile push device records, sessions, API tokens and our local subscription records, asks Stripe to cancel any active subscription so that you are not charged again, and revokes our access to your Slack workspace and to each connected Gmail account (see §4.1; for Microsoft 365 we delete our tokens, as explained there). If Stripe cannot be reached, the cancellation is retried automatically; if it still fails, it is flagged to us and we cancel the subscription by hand. Your audit log entries, including one confirming that the erasure happened, are kept until they reach the end of their 365-day retention period, but the erasure removes your IP address, browser user agent, email address and name from them.

Backups. Our database is backed up continuously, with a full backup taken weekly and the two most recent weekly full backups kept, together with the change log between them. Data you delete, or that is erased when you delete your account, therefore remains in those backups until they age out, which takes up to about three weeks. Off-site backups are held by Backblaze and encrypted at rest by Backblaze. Backups are used only to recover the Service after a failure.

Disconnecting a single mailbox, or disconnecting WhatsApp or Slack, removes the corresponding data without deleting your account. Disconnecting a Gmail account also asks Google to revoke our access (see §4.1).

Invoices and payment records held by Stripe are kept by Stripe for as long as UK tax and company law requires.

9. Cookies

We use strictly necessary cookies to operate the Service (session management and CSRF protection). We do not use advertising or tracking cookies.

Digest emails contain an open-tracking pixel only if you have opted in to open tracking (see §2.12); it is off by default, and you can switch it on or off at any time in your notification settings. It is an image rather than a cookie, and it records only that a digest was opened and when. When your email program loads it, the response carries the same strictly necessary session cookies as any other page of the Service; they are not used to identify you or to track you. You can also prevent it by turning off automatic image loading in your email program.

10. Security

We protect your personal data with measures including:

encryption of all traffic to the Service in transit (HTTPS);
encryption of OAuth tokens and Slack tokens in our database (AES-256);
encryption of the queued background jobs, emails and notifications that carry your personal data, including sign-in and password-reset links. The one exception is the real-time alert shown in the app when an urgent email arrives (its sender, subject and a one-line reason), which passes unencrypted through our internal queue, on our own servers, on its way to your browser;
read-only access to your mailbox (see §2.4);
access controls limiting staff access to personal data, including the support access rules in §4.1.

No system is completely secure. If you become aware of a security vulnerability or incident, please tell us through our contact page.

11. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

Right	Description
Right of access (Art. 15)	Request a copy of the personal data we hold about you; you can also download an export yourself from your account settings
Right to rectification (Art. 16)	Ask us to correct inaccurate or incomplete data
Right to erasure (Art. 17)	Delete your account at any time from your account settings (see §8), or ask us to do it
Right to restrict processing (Art. 18)	Ask us to limit how we use your data
Right to data portability (Art. 20)	Receive your data in a structured, machine-readable format
Right to object (Art. 21)	Object to processing based on legitimate interests
Right to withdraw consent	Withdraw consent at any time where processing is consent-based (for example, disconnecting WhatsApp delivery, or switching off digest open tracking)

To exercise any of these rights, please use our contact page and say that it is a privacy request. You can also make a request in any other way, and we will deal with it. We will respond within one calendar month. We may need to verify your identity before processing your request.

12. Right to Complain

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk
Helpline: 0303 123 1113

We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first.

13. Changes to This Notice

We may update this privacy notice from time to time. When we make material changes, we will tell you by email or by a prominent notice in the Service or on this website.

The effective date at the top of this page identifies this version and the date it takes effect.

14. Contact

For any privacy-related questions or requests:

Avanti Mind Ltd
The Venture Centre Sir William Lyons Road, University Of Warwick Science Park, Coventry, England, CV4 7EZ

Data protection and general enquiries: our contact page