Privacy notice
Who we are
AISLAND is a trading name of Universal Magic, Douglas, Isle of Man. We are the controller of the personal data described here, registered with the Isle of Man Information Commissioner under number R621220.
To ask about your data or use any of your rights, email audit@aisland.im.
What we collect, and why
When you request a report. Your email address and your business website. We use them to confirm your request, decide whether we can audit your business, run the audit and send you the result. We also keep a record of the emails we send you and whether your preview or report has been opened, so we can support you and know the report arrived. Our legal basis is taking the steps you asked for before a contract, and then the contract itself.
When you buy a report. PayPal takes the payment. We never see your card or bank details. We receive confirmation that the payment was made, the amount and a reference, and we keep these as a record of the sale. Our legal basis is the contract, and our legal duty to keep accounts.
When you write to us. Your message and email address, so we can reply. Our legal basis is our legitimate interest in answering you.
Follow-up emails. If we have sent you a preview, we may send a small number of reminders about that same preview. Every one carries a link to stop them, and they stop when you buy, reply or unsubscribe. We do not add you to a marketing list. Our legal basis is our legitimate interest in following up a request you made.
If your business is named in someone else’s report
Our reports record which businesses AI assistants name when asked for a recommendation. If you trade under your own name, or as a sole trader or partnership, that name may be personal data.
We did not collect it from you. It comes from the answers ChatGPT, Claude and Gemini gave to our questions, and from public sources we use to check that a named business exists and what it does, such as websites, business directories and Google Maps. We record the business name, what it does, where it is based and how often it was named.
We use this to give our client an accurate picture of their market. Our legal basis is our legitimate interest, and our client’s, in understanding how businesses are represented by AI assistants. The report goes to the client who commissioned it. If you want to know whether you appear in a report, to correct something, or to object, email us and we will deal with it.
Who we share data with
We do not sell personal data. We use these companies to run the service, and they handle data only on our instructions or as independent providers of their own service:
- Fly.io, which hosts the service on servers in London.
- GitHub, which stores an encrypted backup copy of our data.
- Resend, which sends our emails.
- Cloudflare, which runs our domain and forwards email sent to us.
- PayPal, which takes payments under its own privacy notice.
- Anthropic, OpenAI and Google, whose AI models answer the questions in an audit and help us check the answers. We send them the questions and the names of businesses to check. We do not send them your email address.
- Google, whose Maps service we use to check that a named business exists, and whose fonts our pages load, which means your browser contacts Google when you open a page.
Transfers outside the Isle of Man
Several of these companies are based in the United States, so some data is processed there. Where that happens we rely on the safeguards the law provides, such as an adequacy decision or standard contractual clauses in our agreement with the provider. Ask us if you would like the detail for a particular provider.
How long we keep it
- A request that is never confirmed: 30 days.
- A request we decline, or a preview that is not bought: 6 months after our last contact with you.
- A report you bought, and the details needed to deliver it and its re-check: 12 months after the date of the re-check.
- Records of payment: 6 years, as accounting rules require.
- Emails you send us: 2 years after the conversation ends.
After that we delete the data or remove what identifies you from it. We also keep encrypted backups for 30 days, so deleted data can remain in a backup for up to 30 days before it is gone.
Cookies and storage on your device
We use no advertising or analytics cookies and we do not track you across sites. While you fill in the request form your browser remembers what you typed until you close the tab. It also remembers which link brought you here, such as one of our ads or another website, and sends that with your request so we can tell which of our ads work. It says nothing else about you. If you switch a report to dark mode, your browser remembers that choice, and that is not sent to us.
Decisions made by a person
A person reviews every request and every report before it is released. We do not make decisions about you by automated means alone.
Your rights
You can ask us for a copy of your data, to correct it, to delete it, to restrict how we use it, or to send it to you in a portable form. You can object to anything we do on the basis of legitimate interest, including follow-up emails. We will answer within one month and there is no charge.
If you are unhappy with how we have handled your data, please tell us first. You also have the right to complain to the Isle of Man Information Commissioner at inforights.im.
Changes
If we change this notice we will update the date at the top. If a change matters to a report you have bought, we will email you.