AIAI-BDR
← Back to AI-BDR

AI-BDR Legal

Privacy Policy

Effective date: 18 October 2026

This policy explains how personal information is handled when you visit the AI-BDR website, use the platform, contact us or connect a service.

1. Who is responsible

BCS Digital is the technical division of the independent business behind Body Cast Studio, based in Northern Ireland, United Kingdom.

Tomas Jurksaitis, trading as Body Cast Studio, is the controller for AI-BDR account administration, billing, service security and our own customer communications.

Business correspondence address: Brownstown Business Centre, Brownstown Road, Portadown, Craigavon, BT62 4EA, Northern Ireland, United Kingdom. Privacy contact: [email protected].

For personal information placed in a customer workspace, the customer generally determines why it is processed. We process that information on the customer's behalf to provide the selected service. The applicable role depends on the activity; this privacy notice does not replace the contractual arrangements required for customer-controlled processing.

2. Information and sources

Information comes from you, authorised workspace members, customer imports, connected services and public business sources used by research features. Depending on the selected function, sources may include company websites, public professional pages and connected business-data providers. Public availability does not remove data-protection rights. Customers are responsible for the lawfulness of their prospecting sources and purposes. Do not submit sensitive personal information that is unnecessary for the service.

3. Purposes and lawful bases

Where we act as controller, we use account and service information to perform our contract with an individual customer. Business-account administration, team access, support, fraud prevention and service reliability may rely on our legitimate interests in providing and protecting the service. Financial records and responses to legal or privacy requests are retained or processed to meet applicable legal obligations. Optional advertising technologies rely on consent.

Basic website measurement supports our legitimate interest in understanding and improving the service, subject to applicable privacy and communications requirements. Where we rely on legitimate interests, those interests must be balanced against individuals' rights. A customer's lawful basis for their own contact records and outreach is their responsibility; enabling an integration does not itself establish a lawful basis for contacting a person.

Information needed for account security, payment and service delivery may be necessary to provide the corresponding function. Optional integrations and advertising consent are not required to create a standard account.

4. Sign-in, email and other integrations

Google sign-in and Gmail are separate connections. Google sign-in identifies your account; it does not by itself connect your mailbox. A separately enabled Gmail integration requests Gmail read-only and send permissions for the selected email functionality, including sending and matching replies or delivery-related messages.

Microsoft 365 email uses delegated permissions to identify the connected account, read email and send messages. Refresh access allows an enabled connection to continue without a new login for each operation. Calendar, CRM, messaging and other connections use their own permissions and transfer information when their selected functionality is used.

Disconnecting a supported integration removes its saved credentials from AI-BDR's active connection store. This is separate from revoking permission at the provider. The disconnect result states whether provider revocation was confirmed; otherwise, review the provider's app permissions or revoke/rotate an API key or webhook there. Microsoft organisational permissions may require your administrator. Google revocation may affect other connections to the same application.

Disconnecting does not automatically delete previously imported workspace records or remove credentials from existing restricted backup archives. You can separately request deletion of applicable information.

Google account data is not sold or used by AI-BDR for advertising. AI-BDR's use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including the Limited Use requirements. See Google Data Use.

5. AI-assisted processing

When you use an AI-assisted function, its relevant context may be sent to the configured AI provider. Depending on the function, this can include business records, research, contact information or message content. AI-BDR uses OpenAI, using a workspace connection or configured platform service. Information used in an external AI operation does not remain exclusively on the AI-BDR application server.

AI results may be inaccurate or incomplete. Review generated content and recommendations before relying on them or using them in communications. Provider processing is governed by the terms and settings applicable to that connection.

6. Recipients and providers

Information is shared as needed for the selected service with:

Authorised workspace members see information according to their role. Authorised platform operators may access information where necessary for administration, support, security or legal obligations. We do not sell personal information. Providers may also act as independent controllers for processing described in their own notices, such as their security or regulatory obligations.

7. Analytics and advertising technologies

AI-BDR records basic first-party, cookieless website measurements for service operation and product improvement. This includes page and conversion-event totals, traffic source/UTM values, country code supplied by our edge provider, and broad device/browser categories. This measurement does not set an analytics cookie and continues when optional advertising technologies are rejected.

For approximate daily visitor counts, the server transforms the connection address and browser category into a rotating one-way daily hash. The raw address is used only transiently to receive and protect the request and is not stored in Website Analytics. The rotating value is not used to identify a person across days. Authenticated CRM records are never sent to Website Analytics.

If you select “Accept”, AI-BDR may additionally store a random first-party visitor identifier and a session identifier so that the public-site funnel can be measured more accurately through account creation. Accept also enables the LinkedIn Insight Tag, which measures advertising conversions and campaign performance and may support audience measurement or retargeting.

You can change or withdraw your optional choice at any time through Cookie settings in the footer. Rejecting removes the optional AI-BDR visitor identifier and prevents LinkedIn Insight Tag from loading on future page views. Basic cookieless totals continue without those identifiers.

For more information about the advertising tag, see LinkedIn's Privacy Policy.

Daily measurement hashes are pseudonymous, not a guarantee of anonymity. Separate infrastructure and security logs may process or retain connection addresses. Google Analytics is not loaded by the current public-site implementation.

8. International processing

UK hosting does not mean every operation remains in the UK. External services and their subprocessors may process information elsewhere, including the United States. The relevant arrangements depend on the provider, service and contracting entity.

Published provider terms describe mechanisms such as applicable adequacy arrangements and Standard Contractual Clauses with a UK Addendum. The existence of a published document does not by itself establish the arrangement applicable to every customer-connected account. Contact [email protected] for information about relevant recipients and transfer arrangements, including how to obtain copies of applicable safeguards.

9. Retention and deletion

We retain information according to its purpose, the active service relationship, applicable legal obligations, unresolved disputes and security needs. Retention decisions consider whether the information is still needed, whether a request for deletion applies, and whether a legal or security reason requires continued storage.

Supported final account closure disables access and starts deletion of applicable active-store data. Shared ownership, ambiguous references or unresolved dependencies may require review. A minimal record without login credentials may remain to prevent a deleted identity being unintentionally restored. Financial/security records and restricted backups are retained separately.

Ordinary subscription cancellation stops renewal according to the billing terms; it does not itself delete your account. See Data Deletion and Terms of Service.

10. Your rights and choices

Depending on the processing and applicable law, you may request access, correction, erasure, restriction or portability. You may withdraw consent where processing relies on consent; withdrawal does not affect earlier lawful processing.

You have the right to object to processing based on legitimate interests, and to the use of your personal information for direct marketing. Contact [email protected]. We may need to verify your identity and clarify the request, and will respond within applicable legal deadlines. Where a customer controls the information, we may direct the request to them or assist their response.

You may complain to the UK Information Commissioner's Office at ico.org.uk. You do not need to contact us first.

11. Security, changes and contact

We use technical and organisational safeguards, including access controls, workspace boundaries and protection for supported credentials. No system is completely secure. See Security & Data for further information.

We may update this policy when the service or processing changes. Material updates will show a revised effective date. For privacy enquiries, contact [email protected].