Privacy Policy

RETAIN is a trading style of CX Advisory Ltd, a company registered in England and Wales (Company No. 16469923). We operate the platform at cxretain.co.uk and provide an AI-native customer experience platform as a Software-as-a-Service (SaaS) product to B2B SaaS businesses.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, CX Advisory Ltd is the Data Controller in respect of personal data processed through our website and platform.

CX Advisory Ltd is registered with the Information Commissioner's Office (ICO) as a Data Controller. Registration reference: ZB912842.

For questions about this Privacy Policy, contact us at support@cxretain.co.uk.

Data you provide directly:

• Name, email address, and company name when registering for RETAIN or requesting a demo
• Payment information when subscribing (processed securely by Stripe — we do not store card details)
• Customer account data you enter into the platform (company names, contacts, health scores, activity logs, QBR content)
• Communications you send us via support forms or email

Data collected automatically:

• IP address and browser/device information
• Platform usage data (pages visited, features used, session duration)
• Cookie and analytics data (see our Cookies section)

Data you manage within the platform:

As a platform user, you will enter and manage data about your own customers (accounts, contacts, activity). You are the Data Controller for this customer data. RETAIN acts as a Data Processor in respect of your customers' data. Our Data Processing obligations are set out in our Terms of Service.

We use your personal data to:

• Create and manage your RETAIN account and subscription
• Deliver the platform features you have subscribed to
• Process payments and maintain billing records
• Provide customer support and respond to enquiries
• Send product updates, feature announcements, and relevant communications (you can unsubscribe at any time)
• Improve the platform based on usage analytics
• Comply with our legal obligations
• Detect and prevent fraud or unauthorised access

We will never sell your personal data to third parties for their own marketing purposes.

We process your personal data under the following UK GDPR legal bases:

• Contract: Processing necessary to deliver the RETAIN subscription service you have purchased
• Legitimate interests: Contacting prospects who have expressed interest in RETAIN, platform security monitoring, and product improvement analytics — where these do not override your rights
• Consent: Where you have opted in to marketing communications or demo requests
• Legal obligation: Retaining financial records and complying with applicable law

We share data with trusted service providers only where necessary:

• Stripe — payment processing and subscription management
• Supabase — database and authentication infrastructure
• Resend — transactional email delivery
• Vercel — platform hosting and deployment
• Anthropic— AI features (INTEL layer) powered by Claude API. Query data is processed to generate responses. See Anthropic's privacy policy at anthropic.com/privacy
• Analytics providers — to understand platform usage

All providers handle data in compliance with applicable data protection law. We do not sell, rent, or trade your personal data.

• Account and subscription records: 7 years from account closure (legal/financial obligation)
• Customer data entered into the platform: Retained for the duration of your subscription, deleted within 90 days of account closure upon request
• Support communications: Up to 2 years from last contact
• Marketing/demo enquiry data: Up to 2 years, or until you unsubscribe
• Platform analytics: As per third-party provider settings

Under UK GDPR, you have the right to:

• Access: Request a copy of personal data we hold about you
• Rectification: Ask us to correct inaccurate or incomplete data
• Erasure: Request deletion of your data in certain circumstances
• Restrict processing: Ask us to pause processing in certain circumstances
• Data portability: Receive your data in a structured, machine-readable format
• Object: Object to processing based on legitimate interests
• Withdraw consent: Where processing is consent-based, withdraw at any time

To exercise any right, email support@cxretain.co.uk. We will respond within 30 days. You may also lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.

RETAIN uses cookies on its public website and within the platform:

• Essential cookies: Required for authentication and platform security. Cannot be disabled.
• Analytics cookies: Used to understand usage and improve the platform. Set with consent where required.
• Preference cookies: Remember your platform settings and preferences.

You can manage cookies through your browser settings. Disabling non-essential cookies will not affect core platform functionality.

We implement appropriate technical and organisational measures to protect your data including:

• HTTPS encryption for all data in transit
• Row-Level Security (RLS) on all database tables ensuring organisations can only access their own data
• Secure authentication via Supabase Auth
• Payment processing handled entirely by PCI-DSS compliant Stripe

No internet transmission is completely secure. If you have security concerns, contact support@cxretain.co.uk immediately.

Some service providers may process data outside the UK or EEA. Where this occurs, we ensure appropriate safeguards are in place (Standard Contractual Clauses or adequacy decisions) in line with UK GDPR requirements. Anthropic processes AI query data in the United States under appropriate transfer mechanisms.

We may update this Privacy Policy periodically. The "Last updated" date reflects the most recent revision. For material changes, we will notify active subscribers by email.

CX Advisory Ltd (Company No. 16469923), trading as RETAIN

support@cxretain.co.uk

For privacy queries, rights requests, or complaints, we aim to respond within 30 days. For unresolved concerns, contact the ICO at ico.org.uk.