Privacy Policy

1. About this Policy

1.1. This Privacy Policy explains how Dwel AI Ltd ("Dwel", "we", "us"), a company registered in England and Wales (company number 15899996), registered office 45 Albemarle Street, Mayfair, London, England, W1S 4JL, collects, uses, and protects personal data.

1.2. It applies to three groups of people: visitors to our marketing website; visitors who use a Dwel-powered AI guide ("Guide") at a venue or location ("Place"); and the people who set up and manage Teams, Places and Guides on the Dwel platform, whether for a Place or for an organisation acting for it ("platform users").

1.3. Guide visitors are also bound by our Visitor Terms; Customers (the organisations using the platform) are also bound by our Platform Terms - this Policy is incorporated into both.

2. Information We Collect

2.1. From website visitors: name and contact details, company/organisation, industry, communication preferences, and demo request details you provide voluntarily; and automatically collected data such as IP address, device and browser information, pages visited, and referring site.

2.2. From Guide visitors: the text or voice content of your questions and the Guide's responses, and de-identified copies of those conversations (see Section 14.4); device, browser, and approximate session data; and, where you pay to access a Guide, payment data as described in Section 9.

2.3. From platform users: your name and email address; how you sign in (an emailed link with password and two-factor authentication, or Google); your organisation's legal name, company or charity number, address and VAT status; details of the Places you create (venue name, map location and subdomain); invitations you send or receive; a record each time you accept our terms (the document and version, the date and time, your user account, and your IP address and device information); activity in the platform, including test and preview usage; and content you upload to build your Guide ("Customer Content"). Payout and billing details are collected and held by Stripe (see Section 9); we receive only limited information from Stripe, such as verification and payment status.

2.4. We don't require or knowingly collect special category data (e.g. health, religious belief, biometric data used for identification); Customers shouldn't include it in Customer Content.

2.5. If you sign in with Google, Google shares your name, email address and Google account identifier with us. We don't receive your Google password and we don't access other Google data.

3. Voice and Microphone Data

3.1. If you choose to speak to a Guide, your browser will request microphone access.

3.2. Audio is captured only while you actively hold or trigger the talk controls.

3.3. Raw audio recordings are not retained after transcription.

3.4. You can use typed input instead of voice, and can revoke microphone permissions in your browser or device settings at any time.

4. How We Use Your Information

4.1. To operate and deliver Guides: generating AI responses from Customer Content, processing voice input, and running the visitor payment gate.

4.2. To provide the platform: account access and sign-in security, content management, analytics on Guide usage, verifying your organisation, setting up payouts and billing, and recording your acceptance of our terms.

4.3. To respond to demo requests, inquiries, and support requests.

4.4. To analyse and improve our services, including creating de-identified copies of Guide conversations (see Section 14.4) and producing aggregated usage analytics.

4.5. To comply with legal obligations and to prevent fraud and ensure security.

4.6. We monitor test and preview activity and Guide usage to detect abuse, automated traffic and attempts to bypass the visitor payment gate (see Platform Terms, Section 14). We don't make decisions with legal or similarly significant effects solely by automated means: any suspension is reviewed by a person.

5. Our Legal Bases for Processing

5.1. We process personal data to perform our contract with you (delivering a Guide you've started, or the platform service a Customer has signed up for).

5.2. We process personal data based on our legitimate interests in improving the service (including creating and analysing de-identified copies of conversations), preventing fraud, and maintaining security, balanced against your rights.

5.3. We process personal data to comply with our legal obligations, including tax and accounting requirements.

5.4. Where we rely on consent (for example, for marketing communications or microphone access), you can withdraw it at any time.

5.5. We keep records of your acceptance of our terms because we have a legitimate interest in being able to show what was agreed, and to establish, exercise or defend legal claims.

6. Who Is the Data Controller

6.1. Dwel is the data controller for website-visitor data, Guide-visitor data (Section 2.2), and platform user account data (Section 2.3, excluding Customer Content itself).

6.2. Where a Customer uploads Customer Content that contains personal data of an identifiable individual (for example, a name or photo in exhibit material), the Customer is the data controller for that data and Dwel processes it on the Customer's behalf, under the terms of our Data Processing Agreement.

6.3. If your query relates to data inside Customer Content uploaded by a Customer, contact that Customer directly in the first instance; if it relates to your own use of a Guide or our website, contact us using Section 13.

7. Information Sharing and Disclosure

7.1. We don't sell, trade, or rent your personal information to third parties.

7.2. We share information with trusted service providers who help us operate the website, deliver Guides, and process payments - see Section 8.

7.3. We may share information where required by law, court order, or government regulation.

7.4. We may share information in connection with a merger, acquisition, or sale of assets.

7.5. We may share information to protect our rights, safety, or property, or that of our users.

8. Sub-processors and Third Parties

8.1. We use third-party providers to deliver the service, including AI model providers, speech (speech-to-text and text-to-speech) providers, hosting and infrastructure providers, email delivery providers (for sign-in links and notifications), Google (if you choose to sign in with Google), and payment processors.

8.2. A list of the third-party providers that process Visitor Data and platform user data on our behalf, including what they do, where they're based and the safeguards we rely on, is available on our third-party providers page. Providers who process personal data contained in Customer Content are listed in the sub-processor annex of our Data Processing Agreement, which we publish on our website.

8.3. We take reasonable care in selecting providers but aren't responsible for their independent actions or policies.

9. Payment Information

9.1. Where you pay to access a Guide, or a Customer pays Pro or Subscription fees, payments are processed by Stripe.

9.2. Stripe collects and handles payment details (e.g. card information) directly - we don't see or store them ourselves.

9.3. Dwel is the merchant of record for visitor Guide payments and accounts for any applicable VAT on that charge.

9.4. To pay out a Customer's share of visitor revenue we use Stripe or, where agreed, bank transfer. Stripe collects identity, business and bank details directly from the person setting up payouts, in order to verify them as the law requires. Stripe is an independent controller of that information for its own compliance purposes; we receive the verification status and the limited details needed to make payouts. See Stripe's privacy notice at stripe.com/privacy.

10. Data Security

10.1. We implement appropriate technical and organisational measures to protect personal information against unauthorized access, alteration, disclosure, or destruction.

10.2. No method of transmission or storage is 100% secure, and we can't guarantee absolute security.

11. Cookies and Tracking Technologies

11.1. We use cookies and similar technologies to operate and improve our website.

11.2. You can control cookie preferences through your browser settings, though disabling cookies may affect functionality.

11.3. The Dwel platform uses essential cookies and similar technologies to keep you signed in and to protect your account. These don't require consent.

12. Your Rights and Choices

12.1. Depending on your location, you may have the right to access, correct, delete, or port your personal information, and to object to or restrict its processing, or withdraw consent.

12.2. To exercise these rights, contact us using Section 13.

12.3. If you're unhappy with how we've handled your personal data, please contact us first at privacy@dwel.ai. You also have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113).

12.4. Once a conversation has been de-identified, we generally can't link the copy back to you, so we may not be able to act on access, correction or deletion requests relating to it.

13. Contact Us

13.1. Privacy questions: privacy@dwel.ai.

13.2. General inquiries: contact@dwel.ai.

13.3. Registered office: 45 Albemarle Street, Mayfair, London, England, W1S 4JL.

14. Data Retention

14.1. We keep personal data only as long as needed for the purpose it was collected, as set out below, unless a longer period is required by law.

14.2. Website inquiry and demo request data: 24 months from your last contact with us, then deleted or anonymised.

14.3. Website analytics data: 14 months.

14.4. Guide conversation data: identifiable transcripts of Guide conversations are kept for 7 days from the start of the conversation, for support, safety and quality purposes, and are then permanently deleted. During that period we create a de-identified copy of each conversation, removing names, contact details and other information that could identify you. We keep only that de-identified copy after the 7 days, for up to 24 months, and use it to produce analytics for Customers and to improve the service; it is then deleted. Aggregated statistics that can no longer identify anyone may be kept for longer. Copies of identifiable transcripts held in backups are removed as the backups expire, within a further 7 days. Raw audio is not retained after transcription (see Section 3.3).

14.5. Payment transaction records: 6 years, as required by UK accounting and tax law.

14.6. Platform user account data: for the duration of the account, plus 90 days after it is closed.

14.7. Customer Content is retained and deleted in accordance with the instructions of the relevant Customer and our Data Processing Agreement with them, and is not governed by this section.

14.8. Records of acceptance of our terms: 6 years after the account is closed, to deal with any contract claims.

14.9. Sign-in links expire after 30 minutes and can be used once. Details from people who start but don't complete account setup are deleted after 30 days.

14.10. Test and preview activity logs: 12 months.

15. Children's Privacy

15.1. Our website and platform accounts are for adults (18 or over) acting for an organisation, and are not directed at children.

15.2. Guides are deployed in public spaces such as galleries, museums, and town centres, and may be used by children as well as adults. We don't ask a Guide visitor's age, and we apply the same data-minimisation approach to everyone: we don't build profiles of Guide visitors, use their conversation data for targeted advertising, or nudge anyone to share more than they need to get an answer.

15.3. Where a Customer knows children are likely to be a significant part of a Place's visitors (for example, a family-oriented exhibit), we work with that Customer to apply any extra protections they require for their Guide.

15.4. A parent or guardian with concerns about a child's interaction with a Guide can contact us using Section 13, or the Place directly.

16. International Data Transfers

16.1. Your information is mainly processed in the UK. Some of our providers (for example for hosting, speech and web-import services) process it in the United States or in other countries where they operate.

16.2. Where we transfer personal data outside the UK or EEA, we put appropriate safeguards in place, such as the UK Extension to the EU-US Data Privacy Framework, Standard Contractual Clauses, the UK International Data Transfer Addendum, or a transfer to a country with an adequacy decision.

17. Changes to This Policy

17.1. We may update this Policy from time to time; material changes will be reflected by posting the new Policy on this page and updating the effective date.

17.2. For platform users, material changes will be notified by email and when you sign in. For everyone else, continued use of our services after a change takes effect means you accept the update.