EdenTouch CoLab Ltd ("we", "us", "our") is committed to protecting your privacy and handling your personal data with transparency and care. This Privacy Policy explains how we collect, use, store, protect, and share personal data across our website, services, and our proprietary clarity framework and platform, UxAi-ClarityForge®.

We operate as a UK-registered company and a registered Data Controller with the ICO (Registration: ZC047648).

We comply with:

• UK GDPR
• The Data Protection Act 2018
• PECR
• ICO guidance on AI, data processing, and transparency

1. Who We Are

EdenTouch CoLab Ltd
Registered in the United Kingdom
Email: support@edentouchcolab.com
ICO Registration Number: ZC047648

We provide UX/service design consulting, coaching, digital clarity workflows, and the UxAi-ClarityForge® framework — a guided, AI-supported system that helps founders map visions, personas, user journeys, and service blueprints.

2. What This Policy Covers

This Privacy Policy applies to:

• The EdenTouch CoLab website
• UxAi-ClarityForge® platform tools
• Booking pages, onboarding forms, and workshop registrations
• Any AI-powered features (e.g., interactive guidance, automated summaries)
• Communications via email, chat, or embedded tools
• Paid services processed through Stripe
• Microsoft 365 and Microsoft Teams communications
• Miro collaborative boards
• Cloud systems used to deliver our services (Microsoft, Xano, WeWeb, IBM, Google)

3. What Data We Collect

We collect two categories of data:

A. Information you provide

Examples include:

Account & Identity Information

• Name
• Email address
• Phone number (optional)
• Business/organisation details
• Role, industry, and service needs
• Login credentials via Microsoft, Google, or email/password
• Preferences and communication choices

B. Information we collect automatically

Technical & Usage Data

• IP address
• Browser and device type
• Country/location (approximate)
• Pages viewed
• Features used within UxAi-ClarityForge®
• Log files and diagnostic reports

AI Interaction Data

When interacting with AI features (e.g., assistant guidance, auto-generation):

• Prompts
• Written inputs
• Uploaded text
• System actions (e.g., "Generate persona summary")

AI models process data only to generate your requested output, not for training external models.

3.1. Google OAuth & Google User Data Disclosure

Google Sign-In (OAuth)

UxAi-ClarityForge® allows users to sign in using Google OAuth.

When you choose to sign in with Google, we may access the following Google user data:

Data Accessed

• Your Google account email address
• Your basic profile information (such as name and profile image)

We do not access:

• Gmail content
• Google Drive files
• Google Contacts
• Calendar data
• Any sensitive or restricted Google APIs

Data Usage

We use Google user data strictly to:

• Authenticate you into the UxAi-ClarityForge® platform
• Create or link your user account
• Maintain secure login sessions

Google user data is never used for advertising, profiling, or training public AI models.

Data Sharing

Google user data is not sold or shared with third parties.

It is only processed internally to provide authentication and account access.

Data Storage & Protection

• Authentication data is stored securely using encrypted systems
• Access is restricted to authorised systems only
• Industry-standard security controls are applied

Data Retention & Deletion

• Google account data is retained only while your account is active
• You may request deletion of your account and associated data at any time
• Deletion requests can be made via: support@edentouchcolab.com

UxAi-ClarityForge® complies with the Google API Services User Data Policy, including the Limited Use requirements.

3.2. Microsoft Sign-In (Microsoft Entra ID / Microsoft OAuth)

UxAi-ClarityForge® also allows users to sign in using Microsoft authentication services (Microsoft OAuth / Microsoft Entra ID).

Data Accessed

When you choose to sign in with Microsoft, we may access:

• Your Microsoft account email address
• Basic profile information (such as name and profile image, where available)
• A unique account identifier used for authentication

We do not access:

• Outlook or email content
• Microsoft Teams messages
• OneDrive files
• Calendar data
• Any Microsoft Graph data beyond basic identity

Data Usage

Microsoft account data is used strictly to:

• Authenticate you into the UxAi-ClarityForge® platform
• Create or link your user account
• Maintain secure login sessions

Microsoft user data is not used for advertising, profiling, or external analytics.

Data Sharing

Microsoft user data is not sold or shared with third parties.

It is processed only for authentication and account management within the platform.

Data Storage & Protection

• Authentication identifiers are stored securely using encrypted systems
• Access is limited to authorised services only
• Industry-standard security controls are applied

Data Retention & Deletion

• Microsoft account data is retained only while your account remains active
• Users may request deletion of their account and associated data at any time
• Deletion requests can be made via: support@edentouchcolab.com

UxAi-ClarityForge® follows Microsoft identity platform policies and applicable data protection regulations.

Platform Data

When using UxAi-ClarityForge®:

• Vision statements
• JTBD personas
• Journey maps
• Service blueprints
• Notes, reflections, and uploaded files
• Miro board URLs or files you import
• AI-generated summaries, snapshots, or insights

Payment Information

Handled securely by Stripe.

We never store card numbers.

4. How We Use Your Information

We use personal data to deliver clarity-first guidance and improve your experience.

We process your data for:

• ✓ Delivering access to UxAi-ClarityForge® tools
• ✓ Improving service design workflows (visions, personas, maps, sprints)
• ✓ Providing AI-powered clarity insights at your instruction
• ✓ Communicating with you about sessions, updates, or support
• ✓ Processing payments through Stripe
• ✓ Running Miro-based workshops and co-design activities
• ✓ Maintaining platform security and reliability
• ✓ Sending resources, training materials, or updates (optional)
• ✓ Compliance with UK GDPR and ICO requirements

5. Legal Basis for Processing

We rely on one or more of the following:

1. Contract — To deliver services you sign up for.
2. Consent — When you join a mailing list, submit optional data, or request AI-generated content.
3. Legitimate Interest — For analytics, support, security, fraud prevention, and improving our services.
4. Legal Obligation — Compliance with tax, accounting, and data protection laws.

6. How AI Is Used (Transparency Statement)

UxAi-ClarityForge® uses AI to support clarity-focused workflows. Examples include:

• Vision summarisation
• Persona synthesis
• Journey map pattern detection
• Service blueprint insight generation
• Sprint planning suggestions
• Data structuring for founder clarity

AI Transparency & Safety

• AI processes your data only to fulfil your instruction.
• Data is not used to train public AI models.
• We maintain human oversight ("human-in-the-loop").
• You control your inputs and may delete them at any time.
• You decide which data is added to your clarity framework.

We follow ICO guidance on the safe and fair use of AI.

7. How We Store & Protect Your Data

Your data is stored securely using encrypted systems, including:

• Microsoft 365 (UK/EU servers where applicable)
• Xano (backend processing)
• WeWeb (app interface)
• Stripe (PCI-DSS compliant)
• Miro (workshop content)
• Microsoft Entra ID (identity & login security)
• Microsoft Defender (threat protection)
• IBM watsonx Orchestrate (optional workflow automation)

Security includes:

• ✓ Encrypted data at rest and in transit
• ✓ Role-based access
• ✓ Multi-factor authentication
• ✓ Regular access reviews
• ✓ Secure deletion policies

8. Data Sharing

We do not sell your data.

We only share it with trusted third parties who support our services:

Essential Service Providers

• Microsoft 365 (email, identity, Teams, Defender)
• Stripe (payments)
• Xano (backend logic)
• WeWeb (app interface)
• Miro (collaboration boards)
• IBM watsonx Orchestrate (automation flows)
• Google (optional OAuth login)

Legal Requirements

We may share data if required by law, court order, or ICO instruction.

9. International Data Transfers

Some service providers store data outside the UK/EU.

We ensure protection through:

• UK Standard Contractual Clauses
• Adequacy decisions
• ICO-recommended safeguards
• Provider compliance (Microsoft, Stripe, Miro, Google all meet high standards)

10. Data Retention

We keep your data only as long as necessary:

• Account data: while your account is active
• Workshop or project data: until you request deletion
• Payment records: 6 years (legal requirement)
• AI inputs and outputs: controlled entirely by you
• Email communications: until you unsubscribe

You may request deletion at any time.

11. Your Rights

Under UK GDPR you have the right to:

• ✓ Access your data
• ✓ Correct inaccurate information
• ✓ Request deletion
• ✓ Restrict processing
• ✓ Object to certain uses
• ✓ Data portability
• ✓ Withdraw consent at any time

To exercise these rights:

Email: support@edentouchcolab.com

12. Cookies & Analytics

We use minimal cookies to improve performance and security.

Types include:

• Strictly necessary cookies
• Analytics cookies (e.g., website usage insights)
• Authentication cookies (Microsoft, Google logins)

You may opt out where required.

13. Children's Privacy

UxAi-ClarityForge® is not intended for individuals under 16.

We do not knowingly collect children's data.

14. Changes to This Policy

We may update this policy to reflect:

• Service improvements
• Legal compliance updates
• AI transparency changes
• New security or platform features

The most recent version will always be available on our website.

15. Contact Us

For questions or data requests:

EdenTouch CoLab Ltd
Email: support@edentouchcolab.com
ICO Registration Number: ZC047648