Privacy notice

Last updated: 8 October 2026 · Applies to The Networking App beta

1. Who we are

The Networking App (“the app”, “we”, “us”) is provided by Gilchrist & Co Consultants, [TO COMPLETE: full legal name of the business and company number, or “sole trader” if applicable], of [TO COMPLETE: registered or business address], Belfast, Northern Ireland.

For the personal data described in this notice we are the data controller, which means we decide how and why it is used. We are registered with the UK Information Commissioner's Office (ICO) under registration number [TO COMPLETE: ICO registration number].

You can contact us about privacy at [TO COMPLETE: privacy contact email]. [TO COMPLETE: If a Data Protection Officer is appointed, add their name and contact details here; otherwise remove this sentence.]

2. The short version

• Your network is private to you. Other users can't see your contacts, tiers, notes, recordings, tasks or events.
• We collect only what's needed to run the app. We don't sell personal data, and we don't use it for advertising.
• Connecting Google or Microsoft is optional and read-only. We never ask for access to your mailbox.
• AI suggestions are never saved without your review, and AI providers may not use your data to train their models.
• Voice recordings are deleted automatically (after 30 days by default, or sooner if you choose).
• You can export or delete all your data at any time from Settings.
• “Discovery” (being findable by other professionals) is off unless you switch it on, and you choose exactly which fields are shown.

3. What we collect

3.1 Information you give us

• Account details: your name, email address, password (stored only as a one-way bcrypt hash, never in readable form), timezone and preferences such as networking style, reminder settings and retention choices.
• Your network: the contacts you add or import and what you record about them. That can include name, company, job title, profession, email, phone, LinkedIn profile URL, location, interests, tags, where and when you met, relationship tier, conversation notes, action points, interactions, commitments and follow-ups. See section 4.
• Voice recaps and written recaps: audio you record in the app, its transcript, and the structured suggestions extracted from it.
• Events: event names, dates and locations you create, and which of your contacts you link to them.
• Discovery profile (optional): headline, profession, skills, general location (city or neighbourhood only), professional interests and what you're looking for. Only the fields you switch on are shown to others.
• Introduction requests (optional): the message you send another opted-in user, and their decision.

3.2 Information from services you connect (optional)

• Sign in with Google or Microsoft: your name, email address and an account identifier. Nothing else.
• Google Contacts / Microsoft Contacts: read-only access to your address book: names, email addresses, phone numbers, organisation, job title, city, website or LinkedIn URLs and whether a contact is starred. Imported people are shown to you as suggestions and are only added to your network if you accept them.
• Google Calendar / Outlook Calendar: read-only access to the start time and attendee names and email addresses of events from the last 12 months. We do not read event titles, descriptions or locations. We use this only to show how often you've met someone. Meetings with more than 12 attendees, meeting rooms and automated addresses are ignored.
• Access tokens for these connections are encrypted (AES-256-GCM) and deleted when you disconnect. On disconnect we also ask Google to revoke access.
• Files you upload (CSV or vCard exports, including LinkedIn's own “Connections” export) are processed to create suggestions. The file itself is not kept. We keep a fingerprint (hash) of it so the same file isn't imported twice.

3.3 Information from people who share their details with you

If someone uses your QR code or share link, we collect what they choose to enter (name, and optionally email, phone, company, job title, LinkedIn URL and a short note) together with their confirmation that they're happy to share it with you. It is held for your review and only becomes a contact if you accept it. For spam protection we also store a one-way hash of the submitter's IP address, never the address itself.

3.4 Information collected automatically

• Session data: a secure session cookie (see section 11) and, for your active sessions, your browser's user-agent string so sessions can be identified.
• Security records: a log of security-relevant actions on your account, such as sign-ins, password changes, imports, merges, exports, deletions and connection changes. These records contain no note contents.
• Rate-limiting counters: to prevent abuse we count requests per IP address or account. Only a one-way hash of the IP address or email is stored, and counters are deleted within a day of expiring.
• Product usage statistics: the names of in-app events (for example “voice note saved” or “onboarding completed”), simple numeric properties, and a pseudonymous identifier derived from your account. They never include note contents, recordings, transcripts or contact details. You can switch this off in Settings.

We do not use advertising trackers, third-party analytics scripts or tracking cookies.

4. People in your network

The app holds information about people who aren't necessarily users: the contacts in your network. We take this seriously.

• Their information is visible only to you. It is never shown to other users, never used to build profiles across accounts, and never included in discovery.
• Please record only professional information you have a genuine reason to keep, as you would in a business address book or CRM. Don't record sensitive information (for example health, religion, political opinions, sexual orientation or ethnicity) about anyone.
• If you use the app for your business, you may be a data controller for your contacts' information yourself, and responsible for having a lawful basis to hold it.
• Anyone who believes we hold their information because a user added them can contact us (see section 15). We will help them exercise their rights, which may include passing the request to the relevant user, while respecting the confidentiality of that user's account.

5. Why we use it, and our legal bases

UK data protection law requires a legal basis for each use of personal data. Ours are:

We do not send marketing emails. If we ever want to, we will ask first.

Automated decision-making: the app suggests which imported contacts may matter most and which relationships may need attention, and shows the reasons for each suggestion. These are suggestions only. You make every decision, and nothing produces legal or similarly significant effects for anyone.

6. AI, voice recordings and transcription

• Recording others: the app is designed for recording your own recap after a meeting. If you record a live conversation, you must tell the other people and get their agreement first.
• Transcription: when enabled, your recording is sent to our transcription provider (OpenAI or Deepgram) to convert speech to text. If server transcription isn't available, the app may use your browser's built-in speech recognition. In some browsers (for example Google Chrome) that sends audio to the browser maker's servers under the browser maker's own privacy terms. You can always type your recap instead.
• AI suggestions: when enabled, the text of a recap, together with the names of your existing contacts (to help with spelling), is sent to Anthropic (Claude) to suggest people, commitments and dates. Questions you ask in “Ask your network” and message drafts are handled the same way, using only the relevant records from your own network.
• You stay in control: AI output is checked against your transcript, uncertain items are flagged, and nothing is saved to a contact until you review and confirm it. Saved items are labelled as coming from a recap. The AI cannot create, change or send anything by itself, and the app never sends messages on your behalf.
• No model training: our AI and transcription providers process this data on our behalf under their business API terms, which do not allow them to use it to train their models. They may keep it briefly for abuse monitoring as described in their terms.

7. Who we share it with

We do not sell or rent personal data. We share it only with:

• Service providers (processors) that act only on our instructions under written contracts:
  • Hosting and database: [TO COMPLETE: hosting provider name and location, e.g. Fly.io / Render / AWS, region]
  • AI suggestions: Anthropic PBC (Claude), USA
  • Transcription: OpenAI, L.L.C. (USA) or Deepgram, Inc. (USA), [TO COMPLETE: state which one is used]
  • Transactional email: Resend, USA (password reset and other service emails)
• Google and Microsoft, only when you choose to connect them. They act as independent controllers for their own services under their own privacy policies.
• Other users, only what you explicitly choose: your discovery profile fields if you switch discovery on, and your name and email address only after you accept an introduction request.
• Professional advisers (lawyers, accountants, insurers) where necessary, under confidentiality.
• Authorities where the law requires it, or to protect rights, property or safety.
• A successor if the business or app is sold or reorganised. We would tell you beforehand, and this notice would continue to apply.

Event organisers never gain access to your network, and we never import or share event attendee lists.

8. International transfers

Some of our providers are based in, or process data in, the United States. Where personal data leaves the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified) or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses, together with supplementary measures where needed. [TO COMPLETE: confirm the mechanism used for each provider]. You can ask us for a copy of the relevant safeguards.

9. How long we keep it

When you delete your account, your data, including recordings, is removed from our live systems immediately.

10. How we protect it

• Encrypted connections (HTTPS) for all traffic.
• Passwords stored only as bcrypt hashes. Session and reset tokens stored only as one-way hashes. Connected-account tokens encrypted at rest.
• Strict separation between accounts, enforced on our servers and covered by automated tests.
• Protection against cross-site request forgery, rate limiting, and validation of everything submitted to us.
• Recordings stored outside the public website and served only to their owner.
• Imported content and AI output treated as untrusted. The AI has no ability to change your data.
• Security records of sensitive actions, and limited staff access on a need-to-know basis.

No system is perfectly secure. If a breach affecting your personal data is likely to put you at risk, we will tell you and the ICO as the law requires.

11. Cookies

We use only cookies that are strictly necessary for the app to work, so no consent banner is needed:

We use no advertising or analytics cookies, and the app does not use other browser storage to track you.

12. Your rights

Under UK data protection law you have the right to:

• Access your data. Settings → Your data → Export everything gives you a complete copy straight away.
• Data portability: the export is machine-readable (JSON), and contacts can be exported as CSV.
• Rectification: edit anything directly in the app.
• Erasure: delete individual contacts, entries, recordings or transcripts, or your whole account (Settings → Delete account).
• Restriction of processing in certain circumstances.
• Object to processing based on legitimate interests, including product statistics (switch them off in Settings).
• Withdraw consent at any time, for example by switching off discovery. This doesn't affect processing that happened before.

To exercise any right that isn't available in the app, or if you are someone whose details a user has stored, contact us (section 15). We'll respond within one month and may need to verify your identity. Exercising your rights is free unless a request is manifestly unfounded or excessive.

13. Children

The app is a professional tool for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, please contact us and we will delete it.

14. Changes to this notice

We'll update this notice when the app or the law changes. The date at the top shows the latest version. We'll tell you in the app or by email before any material change takes effect.

15. Contact and complaints

Questions or requests: [TO COMPLETE: privacy contact email], or write to Gilchrist & Co Consultants, [TO COMPLETE: postal address].

If you're unhappy with how we've handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113.