AI-PNA Privacy Notice
Last updated 12 October 2026
This notice explains how Depth 2 Surface Limited ("AI-PNA", "we", "us") uses personal data when you visit www.ai-pna.com, register, subscribe to or use the AI-PNA service, or contact us.
1. Who we are
Depth 2 Surface Limited, trading as AI-PNA, is a company registered in England and Wales under number 15363600, with its registered office at Flat 4 The Orangery, 19 Hogarth Way, Hampton, TW12 2EL, UK. We are registered with the Information Commissioner's Office under number [ICO registration number].
For anything about your personal data, email support@ai-pna.com with "Privacy" in the subject line.
2. Our role
- Controller. We decide how and why we use the personal data in sections 3.1 to 3.4 (your account, billing, support and website use).
- Processor. The questions, files and outputs your company sends through the service ("Inputs" and "Outputs") belong to your company. For any personal data in them, your company is the controller and we act on its instructions, under Schedule 2 of our Terms and Conditions. Questions about that data should go first to your employer.
3. What we collect and why
3.1 Account data. Your name, business email address, company name, your role (admin or user) and your sign-in records. We use it to create and secure your account, check that your company's subscription allows access, and send account emails such as email verification and password resets.
3.2 Subscription and billing data. The plan and bundles chosen, number of users, billing contact and address, VAT number, payment status, invoices and the version of the Terms you accepted. Card details are entered on Stripe's payment page and go directly to Stripe; we never see or store them.
3.3 Support and correspondence. Emails and messages you send us, and our replies.
3.4 Technical data. Security and error logs created when you use the website (time, page or action, and the result). We do not use advertising or analytics cookies.
3.5 Service content (as processor). Inputs and Outputs, and records of each run, used only to provide the service to your company (see section 2).
3.6 Cloud storage connections. If you connect Google Drive or Microsoft OneDrive, we store a connection token so the service can save outputs to, and read files you choose from, your storage. We do not store your storage password. You can disconnect at any time in Settings, and you can also remove AI-PNA's access in your Google or Microsoft account settings.
4. Our lawful bases
| Purpose | Lawful basis (UK GDPR Article 6) |
|---|---|
| Providing your account and the subscription | Contract with your company, and our legitimate interest in providing the service to the people your company authorises |
| Billing, invoices, VAT and accounting records | Legal obligation |
| Account security, fraud prevention and keeping the service working | Legitimate interests |
| Answering support requests | Legitimate interests |
| Service emails (verification, password reset, billing, important changes) | Contract and legitimate interests |
| Occasional product news to business contacts | Legitimate interests; you can opt out at any time |
We do not sell personal data and we do not use it for advertising. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.
5. Who we share it with
We use the following service providers, who process personal data for us under contract:
| Provider | What they do for us | Location |
|---|---|---|
| Google (Firebase, Google Cloud, Google Workspace) | Website hosting, sign-in, sessions, account emails and our email | United States [confirm Firestore location] |
| n8n GmbH (n8n Cloud) | Running the AI-PNA workflows | [EU] |
| Airtable | Customer and user registry, usage records | United States |
| Stripe | Subscription payments, invoices | United States / EU |
| OpenAI | Summarising and drafting replies to emails sent to AI-PNA | United States |
Your own providers. AI-PNA runs your questions through your company's own Anthropic API account. Anthropic processes that content under your company's agreement with Anthropic, not ours. Google Drive and OneDrive are likewise your company's own services.
We may also share personal data with professional advisers, with authorities where the law requires it, and with a buyer of our business, who would be bound by this notice.
6. International transfers
Some providers process data outside the UK, mainly in the United States and the EU. Transfers to the EU rely on the UK's adequacy regulations. Transfers to the United States rely on the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. Ask us for details of the safeguard for a particular provider.
7. How long we keep it
| Data | Kept for |
|---|---|
| Account data | While your company subscribes, then up to 12 months so an account can be restored, unless you ask us to delete it sooner |
| Billing and VAT records | 6 years after the end of the financial year they relate to (UK tax law) |
| Inputs, Outputs and run records | While your company subscribes; deleted within 30 days after it ends (Terms clause 11.5). Workflow run records are deleted after [30] days |
| Support emails | 2 years after the matter is closed |
| Security logs | Up to 90 days |
| Storage connection tokens | Until you disconnect, or your account is closed |
8. Cookies and browser storage
We only use storage that is strictly necessary for the website to work, so no consent banner is needed:
| Name | Purpose | Duration |
|---|---|---|
| __session | Keeps you signed in, securely (cannot be read by page scripts) | 8 hours |
| aipna_oauth_nonce_google, aipna_oauth_nonce_microsoft | One-time security check while you connect Google Drive or OneDrive | 10 minutes |
| Firebase sign-in data (browser storage) | Remembers your sign-in on this device | Until you sign out |
| aipna-pending-company (browser storage) | Remembers the company name you typed while you verify your email | Until you subscribe |
| Airtable settings (browser storage, optional) | Your own Airtable details, if you enter them in Settings; kept only in your browser | Until you clear them |
9. Your rights
You have the right to access your personal data, to have it corrected or erased, to restrict or object to how we use it, and to data portability. You can also object at any time to product news. To use these rights, email support@ai-pna.com. We will reply within one month. For data in Inputs and Outputs, we will pass your request to your company, as the controller, and help it respond.
If you are unhappy with how we have used your data, please contact us first. You also have the right to complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.
10. Security
We use encrypted connections, server-side session checks, access limited to authorised staff, secrets kept outside the code, and providers with recognised security certifications. No online service is risk-free; if a breach is likely to affect you, we will tell you and the ICO as the law requires.
11. Children
AI-PNA is a business service and is not intended for anyone under 18.
12. Changes to this notice
We will update this notice when our practices change and show the date of the latest version below the title. For significant changes, we will also email account admins.