What we collect, and what we do with it.

Who is responsible

BrisAI is the trading name of Art Wieczorkowski, Bristol, UK. Art Wieczorkowski is the data controller for the information described on this page. Questions and requests go to hello@brisai.co.uk.

What we collect

When you send an enquiry: your name, email address, and whatever you choose to tell us about your business — its name, website, size, the tools you use, and your description of the problem. Only name, email and the message are required.

On every visit, the website host keeps short-lived technical logs of the request — your IP address, the page requested, timing and browser type — for security and to keep the site running. BrisAI does not use website analytics or advertising trackers. Cloudflare Turnstile processes technical information to protect the forms from automated abuse.

The AI Opportunity Snapshot

While you are answering the questions, your answers stay in your own browser and are not sent to us. They are held in session storage so that refreshing the page does not lose your progress, and they are discarded when you close the tab.

Your answers do not leave your browser unless you ask for the report. The results are calculated and shown on your own device, and we receive no part of them until you fill in the form. The results page does load Cloudflare’s verification widget, described below, ready for that form: it sees technical information about your connection, never your answers.

If you ask for the full written report, we receive your name, work email, business name and any optional role or phone number you add, together with your answers and the scores calculated from them. We use these to produce the report, to send it, and to follow up about it. Your scores are calculated by fixed rules on our own server, and the report is assembled from those results by fixed templates. No language model is involved in producing your Snapshot report.

Please do not paste confidential customer records, personal data about other people, or internal documents into the free-text question. It is not needed, and a sentence in your own words is more useful than a document.

Why we collect it, and our lawful basis

To review and reply to your enquiry and, if you choose to work with BrisAI, to prepare and deliver that work. Enquiry details are not used for advertising or added to a marketing list.

• Replying to an enquiry or sending a Snapshot report — our legitimate interest in responding to a request you made, and where relevant the steps needed before entering into a contract with you.
• Protecting the forms and the website — our legitimate interest in keeping the site secure and free of automated abuse.
• Keeping business records — where an enquiry becomes paid work, our legal obligations under UK tax and accounting rules.

To help us reply in a sensible order, each enquiry and Snapshot request is also given an internal score against a fixed set of criteria — for example the size of the business and how clearly the problem is described. The score is for our own planning only: it is never shown to you, and a person reads every enquiry regardless of it.

We do not rely on consent for any of the above, so there is nothing to withdraw; you can instead object to the processing, as described under your rights below.

Who else sees it

These providers process data only to host, protect and deliver the enquiry or report. BrisAI does not sell or rent personal data.

• Vercel

  Hosts the website and handles the request that submits a form. Keeps short-lived technical logs (IP address, request path, timing) for security and reliability.

  Applies to: every visit. Where: Pages are served from Vercel's edge network; form requests are processed in Paris, France (eu-west-3). Safeguard: Vercel's data processing agreement and standard contractual clauses.

• Cloudflare Turnstile

  Checks that a form submission comes from a person rather than a script. Sees connection and browser information, never the form fields.

  Applies to: enquiries and Snapshot reports. Where: Cloudflare's global network; may include processing outside the UK. Safeguard: Cloudflare's data processing addendum and standard contractual clauses.

• n8n Cloud

  Runs BrisAI's intake workflows: records the submission, sends the acknowledgement or report email, updates the CRM and alerts BrisAI.

  Applies to: enquiries and Snapshot reports. Where: European Union (Microsoft Azure, Frankfurt, Germany), as published by n8n. Safeguard: n8n's data processing agreement.

• OpenAI

  When you send an enquiry, the business details and your message — not your name or email address — are passed to OpenAI's API to draft a short structured summary that helps a person reply. The summary is advisory; a person reads your original message.

  Applies to: enquiries. Where: United States. Safeguard: OpenAI's API data-processing terms, under which API inputs are not used to train models.

• HubSpot

  BrisAI's customer-relationship system, where the enquiry or Snapshot request is recorded so that follow-up is tracked.

  Applies to: enquiries and Snapshot reports. Where: European Union (Germany) — the account's data-hosting location. Safeguard: HubSpot's data processing agreement.

• Microsoft 365 (BrisAI's mailbox)

  Where the enquiry notification lands and where the acknowledgement and Snapshot report emails are sent from, so that a person can read, reply and keep a record.

  Applies to: enquiries and Snapshot reports. Where: United Kingdom / European Union.

The one place a language model is used is enquiries: to help us reply well, the business details and message from an enquiry are passed to OpenAI, which returns a short structured summary. Your name and email address are not sent, a person reads your original message regardless, and OpenAI’s API terms do not permit our data to be used for training. If you would rather your enquiry were not summarised this way, email us directly instead of using the form.

When your enquiry is received we also send you a short automated acknowledgement with a reference number, so you know it arrived.

Where it is processed

BrisAI is based in the UK. Some of the providers above process data outside the UK; where they do, the transfer relies on the safeguard named against them — a UK-recognised adequacy decision or standard contractual clauses in the provider’s data processing terms. You can ask us for details of the safeguard that applies to your data.

How long we keep it

Enquiries are kept while they are being considered and for as long as needed to maintain an appropriate business record. If an enquiry becomes paid work, relevant records are kept for the engagement and for any period required by UK tax or company law. Records are reviewed and deleted when they are no longer needed for those purposes.

Snapshot submissions are kept for up to twenty-four months so that a later conversation or audit can start from what you already told us, and are deleted sooner on request. If you saw your results but never asked for the report, we hold no record of your assessment answers: they were never sent to us. The only trace of your visit is the website host’s short-lived technical log described above, which is not linked to your answers. Answers to questions you abandoned before reaching the results are never sent to us at all.

Hosting and security logs are retained by the website host for a short, fixed period and then discarded automatically.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is inaccurate or incomplete;
• delete your data, where we no longer need it;
• restrict how we use it while a question about it is resolved;
• stop processing that relies on our legitimate interests, where your situation gives you grounds to object;
• provide the data you gave us in a portable format, where the processing is based on a contract with you.

Email hello@brisai.co.uk and we will respond within one month. We do not make decisions about you by automated means. If you are not satisfied with how we have handled a request, you can complain to the Information Commissioner’s Office at ico.org.uk.

Contact

BrisAI is the trading name of Art Wieczorkowski, Bristol, UK. Questions about this notice go to hello@brisai.co.uk.

Last reviewed 13 September 2026. If what we do changes, this page changes in the same release.