What we collect, and what we do with it.

Who is responsible

BrisAI is the trading name of Art Wieczorkowski, Bristol, UK. Art Wieczorkowski is the data controller for the information described on this page. Questions and requests go to hello@brisai.co.uk.

What we collect

When you send an enquiry: your name, email address, and whatever you choose to tell us about your business — its name, website, size, the tools you use, and your description of the problem. Only name, email and the message are required.

On every visit, the website host keeps short-lived technical logs of the request — your IP address, the page requested, timing and browser type — for security and to keep the site running. BrisAI does not use advertising trackers. Cloudflare Turnstile processes technical information to protect the forms from automated abuse.

Optional aggregate website counts

We count page views and actions such as service links, booking-link clicks and form success or error states to improve this website. Counts describe website interactions, not unique visitors, confirmed bookings or qualified leads.

When enabled, our first-party endpoint adds to daily totals for a recognised page, event, optional service and broad error category. We store no individual event history, visitor identifiers, fingerprints, IP addresses, contact details, message text or full URLs in these counters. Technical hosting and security logs remain separate.

The counters are stored in our existing Neon database in Frankfurt and removed after ninety days by protected maintenance. An outage can delay deletion until maintenance resumes. The host handles the counting request. Data is not shared with advertising partners or used to profile visitors.

You can stop optional counting at any time using Analytics preferences in the footer. Your browser stores only that preference, not an analytics identifier. Global Privacy Control and Do Not Track also stop counting. With JavaScript disabled, no optional counts are sent.

This limited measurement is used solely to improve the website. It is designed around the statistical-purposes exception, with clear information and a simple, free way to object. Totals cannot be linked back to a particular enquiry or person.

The AI Opportunity Snapshot

While you are answering the questions, your answers stay in your own browser and are not sent to us. They are held in session storage so that refreshing the page does not lose your progress, and they are discarded when you close the tab.

Your answers do not leave your browser unless you ask for the report. The results are calculated and shown on your own device, and we receive no part of them until you fill in the form. The results page does load Cloudflare’s verification widget, described below, ready for that form: it sees technical information about your connection, never your answers.

If you ask for the full written report, we receive your name, work email, business name and any optional role or phone number you add, together with your answers and the scores calculated from them. We use these to produce the report, to send it, and to follow up about it. Your scores are calculated by fixed rules on our own server, and the report is assembled from those results by fixed templates. No language model is involved in producing your Snapshot report.

Please do not paste confidential customer records, personal data about other people, or internal documents into the free-text question. It is not needed, and a sentence in your own words is more useful than a document.

Why we collect it, and our lawful basis

To review and reply to your enquiry and, if you choose to work with BrisAI, to prepare and deliver that work. Enquiry details are not used for advertising or added to a marketing list.

• Replying to an enquiry or sending a Snapshot report — our legitimate interest in responding to a request you made, and where relevant the steps needed before entering into a contract with you.
• Protecting the forms and the website — our legitimate interest in keeping the site secure and free of automated abuse.
• Keeping business records — where an enquiry becomes paid work, our legal obligations under UK tax and accounting rules.

To help us reply in a sensible order, each Snapshot request is also given an internal score against a fixed set of criteria — for example the size of the business and how clearly the problem is described. The score is for our own planning only: it is never shown to you, and a person reads every enquiry regardless of it.

We do not rely on consent for any of the above, so there is nothing to withdraw; you can instead object to the processing, as described under your rights below.

Who else sees it

These providers process data only to host, protect and deliver the enquiry or report. BrisAI does not sell or rent personal data.

• Vercel

  Hosts the website and handles the request that submits a form. Keeps short-lived technical logs (IP address, request path, timing) for security and reliability.

  Applies to: every visit. Where: Pages are served from Vercel's edge network; form requests are processed in Paris, France (eu-west-3). Safeguard: Vercel's data processing agreement and standard contractual clauses.

• Cloudflare Turnstile

  Checks that a form submission comes from a person rather than a script. Sees connection and browser information, never the form fields.

  Applies to: enquiries and Snapshot reports. Where: Cloudflare's global network; may include processing outside the UK. Safeguard: Cloudflare's data processing addendum and standard contractual clauses.

• Neon (website intake)

  Stores enquiry and Snapshot submissions and individual email delivery jobs for thirty days, for delivery recovery and duplicate prevention. Separately stores optional daily aggregate website counts for ninety days, without visitor identifiers or form content.

  Applies to: enquiries, Snapshot reports and optional aggregate website counts. Where: Frankfurt, Germany (AWS eu-central-1), verified for the separate website intake databases on 5 November 2026. Safeguard: Neon’s data processing agreement and standard contractual clauses.

• cron-job.org

  Calls a protected maintenance endpoint every fifteen minutes. Receives only a generic health status, never form fields, contact details or assessment answers.

  Applies to: delivery monitoring only. Where: Provider-managed hosting; no visitor submission content is transferred.

• Microsoft 365 (BrisAI's mailbox)

  Where the enquiry notification lands and where the acknowledgement and Snapshot report emails are sent from, so that a person can read, reply and keep a record.

  Applies to: enquiries and Snapshot reports. Where: BrisAI's mailbox is hosted in the United Kingdom (Microsoft Exchange geography GBR), verified 5 November 2026.

Enquiries and Snapshot reports do not use a language model and are not sent to a CRM. A person reads your original enquiry.

When your enquiry is received we also send you a short automated acknowledgement with a reference number, so you know it arrived.

Where it is processed

BrisAI is based in the UK. Some of the providers above process data outside the UK; where they do, the transfer relies on the safeguard named against them — a UK-recognised adequacy decision or standard contractual clauses in the provider’s data processing terms. You can ask us for details of the safeguard that applies to your data.

How long we keep it

Enquiries are kept while they are being considered and for as long as needed to maintain an appropriate business record. If an enquiry becomes paid work, relevant records are kept for the engagement and for any period required by UK tax or company law. Records are reviewed and deleted when they are no longer needed for those purposes.

Enquiry and Snapshot submissions and their email delivery records are deleted from the website database thirty days after submission, or sooner on request. A scheduled task performs deletion; an outage can delay it until processing resumes. Database recovery history may retain a copy for the provider’s configured recovery window. Emails and subsequent correspondence are separate business records in our Microsoft 365 mailbox and are reviewed and deleted when no longer needed. If you saw your results but never asked for the report, we hold no record of your assessment answers: they were never sent to us. The only trace of your visit is the website host’s short-lived technical log described above, which is not linked to your answers. Answers to questions you abandoned before reaching the results are never sent to us at all.

Hosting and security logs are retained by the website host for a short, fixed period and then discarded automatically.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that is inaccurate or incomplete;
• delete your data, where we no longer need it;
• restrict how we use it while a question about it is resolved;
• stop processing that relies on our legitimate interests, where your situation gives you grounds to object;
• provide the data you gave us in a portable format, where the processing is based on a contract with you.

Email hello@brisai.co.uk and we will respond within one month. We do not make decisions about you by automated means. If you are not satisfied with how we have handled a request, you can complain to the Information Commissioner’s Office at ico.org.uk.

Contact

BrisAI is the trading name of Art Wieczorkowski, Bristol, UK. Questions about this notice go to hello@brisai.co.uk.

Last reviewed 9 November 2026. If what we do changes, this page changes in the same release.