Privacy Notice

1. Who we are

Stepping Stones AI helps UK businesses use AI well, through training, coaching and building AI tools.

• Controller: Scott Mitchell, trading as Stepping Stones AI (sole trader), based in Liverpool.
• Contact for anything in this notice: scott@steppingstonesai.com, or our complaint and request form at steppingstonesai.co.uk/privacy/complaint.
• Information Commission registration: ZC102056

When the business becomes Stepping Stones AI Ltd, the company takes over as controller (section 14).

2. Who this notice covers

• people who visit our website, book a call or take our online assessment;
• people who email or message us, including on WhatsApp and LinkedIn;
• people we meet, or hear about through a client, partner or contact;
• our clients and the people who work for them;
• people whose business contact details we find in public sources;
• people whose public posts, videos or articles we analyse for our own content research.

When we build or host AI tools that hold our clients' customer data, our client is the controller of that data and we act on their instructions. Their privacy notice covers those people, not this one.

3. What we collect and why

Legitimate interests means running and growing our business, responding to people, improving our service and keeping it secure. We have weighed these against your interests, and you can ask to see that assessment.

If someone tells us about you. When a client, partner or contact mentions you to us in a business context, we may keep a short note: your name, business, where we heard of you and one line of context. If we have a way to reach you, we tell you within one month that we hold it, or we delete it. If we do not, we keep it for at most 12 months, never use it for marketing, and this notice is how we tell you. We add fuller notes only once we are in touch with you.

Sensitive information. We do not ask for special category information (such as health, ethnicity or religion). If you mention it on a call, it stays only in the recording and transcript until they are deleted under our retention periods. We do not copy it into our notes or act on it. If you would like us to take it into account, for example to adjust how we teach, we will ask for your explicit consent first and record it.

Recordings made before 13 October 2026. Until then, our privacy page said that recording training sessions was based on consent. We treat those recordings as held on consent: you can withdraw it at any time and we will delete your recordings, transcripts and any notes that still identify you. We use them only for the purposes we gave at the time, and delete them under the 12-month rule. On 12 October 2026 we removed names, quotes and contact details from the notes we had made from those calls, so they no longer name anyone.

4. Do you have to give us your information?

No law requires you to give us your details. To book a call or work with us, we need your name and email address; without them we cannot book, deliver or invoice our services. Once you are a client, the law requires us to keep invoice and payment records for tax. Everything else is your choice. Saying no to recording or marketing does not change what we offer you or the price.

5. Recording and AI

• Recording. Our Google Meet calls, including first calls and client sessions, are recorded on video, and Google's Gemini writes a transcript and notes. We tell you when you book and again at the start of the call. Clients receive their recording.
• AI tools. We use AI tools, mainly Google Gemini and Anthropic's Claude, to write notes, follow-up emails and session plans, and a dictation tool (Wispr Flow) to turn speech into text. Model training is switched off on the AI tools we use with personal data (checked 12 October 2026).
• Reviewing our calls. Once a month, we review the notes from recent calls to learn what helps clients and what does not. We do not keep a bank of your words for marketing, we do not score or profile you, and we never publish anything that identifies you without your written permission.
• No automated decisions. We make no decision about you based solely on automated processing that has a legal or similarly significant effect.

6. Your right to object

You have the right to object to anything we do with your information on the basis of legitimate interests: recording our calls, reviewing call notes, keeping notes about you in our contact records, and researching your business before a call. Tell us and we will stop, unless we have compelling grounds or need the information for a legal claim, and we will tell you which. If you object to recording, say so when you book or at the start of a call and we will not record you; we will also delete a recording we hold.

You can object to direct marketing at any time, and we will always stop.

Email scott@steppingstonesai.com, reply to any email from us, or tell us on a call.

7. Who we share it with

We do not sell personal data. We share it with providers that help us run the business, under their terms and data protection commitments:

We also share data with professional advisers, HMRC and others where the law requires it. If a referral partner introduced you to us, or we introduce you to one, we share only what is needed for that introduction. Anyone who helps deliver our work does so in our own systems and on our instructions.

8. International transfers

Some providers process data outside the UK, mainly in the US. For each transfer we rely either on UK adequacy regulations (for the EEA, and for US organisations certified to the UK Extension to the EU-US Data Privacy Framework), or on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses in the provider's terms, together with our own check that your information stays protected to UK standards. You can ask us for a copy of any safeguard we rely on by emailing scott@steppingstonesai.com.

9. How we keep it safe

• Accounts: named accounts only, never shared logins. Our Google account, which holds our email, calls and files, is protected by a passkey and two-step verification.
• Devices: the laptop we work on is encrypted, and so is our phone.
• Systems: our client and sales database is locked so that only approved accounts can read it, and sign-up to our internal app is closed. Our main providers (Google, Supabase, Vercel, Stripe) encrypt data in transit and at rest.
• AI: model training is switched off on the AI tools we use with personal data (section 5), and we never put passwords or other secrets into an AI tool.
• Less data: we keep only what we need, delete it on the schedule in section 10, and remove names from call notes when they are no longer needed.
• If something goes wrong: we record every incident, report it to the Information Commission within 72 hours where the law requires, and tell you without delay if it puts you at high risk.

10. How long we keep it

The full retention schedule is available on request.

11. Your rights

You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, move it to another provider, or withdraw consent at any time. You can object as section 6 explains. Email scott@steppingstonesai.com, or use the complaint and request form at steppingstonesai.co.uk/privacy/complaint. We reply within one month.

12. Cookies

Our website sets no cookies today. It keeps one setting in your browser for the current visit only, so the welcome animation does not replay. Our booking calendar is provided by Google and loads only when you click "Show available times"; Google may then set its own cookies, including for its spam check. Details are in our cookie policy.

13. Complaints

You have the right to complain to us, and we would like the chance to put things right: email scott@steppingstonesai.com or use the complaint and request form at steppingstonesai.co.uk/privacy/complaint. We acknowledge complaints within 5 working days and aim to respond in full within 30 days. You also have the right to complain to the Information Commission at any time: ico.org.uk/make-a-complaint, 0303 123 1113.

14. Changes, including our move to a limited company

When the business becomes Stepping Stones AI Ltd, the company becomes the controller of the data in this notice, uses it for the same purposes, and tells clients directly. We will tell you about any other material change before it takes effect.