Legal

Privacy Notice

Effective date: September 11, 2026

1. Who we are and what this notice covers

Squidgy is a platform for building, running, and monetising AI agents. This Privacy Notice explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and the rights you have. It applies when you visit squidgy.ai, when you create and use a Squidgy account, and when you interact with agents built on the platform.

"Squidgy", "we", "us" and "our" mean 4142 Ltd, a company registered in England and Wales (company number 16433875), whose registered office is 20 Wenlock Road, London, England, N1 7GU. 4142 Ltd trades as "Squidgy". For the personal data described in this notice, 4142 Ltd is the data controller.

If you reached this notice through one of our partner or white-label brands (for example Fanatiq, YEAA, or Handled), the same controller and practices apply unless that brand tells you otherwise.

Questions, or want to exercise your rights? Email privacy@squidgy.ai.

2. The information we collect

We collect the following categories of personal information:

  • Account and profile data — your name, email address, and (if you provide it) phone number and business details, together with the consent choices you make when you register.
  • Content you put into the platform — the messages you send to and receive from agents (your conversation history), files and documents you upload, and knowledge-base material you add for your agents to use. This content is stored so your agents have context and so you can return to past conversations.
  • Billing information — your billing name, address, and subscription details, plus the card type, last four digits, and expiry held by our payment processor. We do not store full card numbers; card payments are handled by Stripe.
  • Leads and contacts you collect — where you use Squidgy to capture enquiries or run campaigns, the contact details of the people who interact with your agents (for example name, email, phone, and message).
  • Connected-account information — if you choose to connect a third-party service (such as Google, Meta/Facebook, Slack, Shopify, or a CRM), the access tokens and account identifiers needed to operate that integration on your behalf.
  • Technical and usage data — your IP address, device and browser type, and information about how you use the platform, collected through our servers and through the cookies and analytics described in §5.
  • Communications — messages you send us by email or support channels.

3. How and why we use your information

Under the UK GDPR we must have a lawful basis for each use. Ours are:

  • To provide the platform and your agents — creating your account, running your agents, storing your conversations and content, and giving you support. Basis: performance of our contract with you.
  • To take payment — processing subscriptions and invoices. Basis: performance of our contract, and compliance with a legal obligation for accounting records.
  • To keep the platform secure and working — preventing fraud and abuse, diagnosing faults, and understanding how the product is used so we can improve it. Basis: our legitimate interests in operating and improving a secure service (and your consent where analytics cookies are used — see §5).
  • To send you marketing — only where you have opted in, or where otherwise permitted by law. You can withdraw consent or unsubscribe at any time. Basis: consent (or legitimate interests for limited business-to-business messaging).
  • To meet legal obligations — responding to lawful requests and keeping records the law requires. Basis: compliance with a legal obligation.

4. AI processing of your content

Squidgy is an AI product, so it is important you understand what happens to what you type. When you send a message to an agent, or upload content for an agent to use, that content is processed by our agent engine and sent to the AI model providers that generate responses. We reach these models primarily through an AI gateway (OpenRouter) and, for some features such as speech and image understanding, directly through OpenAI. Your content may be transmitted to and processed by these providers solely to produce the response you asked for.

We do not sell your content, and we do not use the conversations and files you submit to train our own models. Our model providers process your content under their own terms; we select providers that offer business or API terms under which submitted content is not used to train their models, and we will keep the sub-processor information in §6 current as those arrangements change. When you create your account you are asked to consent to this AI processing; if you do not wish your content to be processed by AI services, the platform cannot provide its core function.

5. Cookies and analytics

We use a small number of cookies and similar technologies. Those that are strictly necessary to run the site and keep you signed in are always on. Non-essential cookies — including our product analytics (PostHog, hosted in the EU) and our marketing/attribution tracking (HighLevel) — load only after you accept them through our cookie banner, and you can change your choice at any time. We do not use Google Analytics.

For the full list of cookies and how to control them, see our Cookie Policy.

6. Who we share your information with

We do not sell your personal information. We share it only with service providers ("sub-processors") who process it on our behalf under contract, and where the law requires. The main categories are:

  • Hosting and infrastructure — Vercel (website), Render (application and agent engine), Supabase and Neon (databases, authentication, and file storage).
  • AI model providers — OpenRouter and OpenAI, as described in §4.
  • Payments — Stripe.
  • Product analytics and error monitoring — PostHog and Sentry.
  • Email, SMS, and messaging delivery — Resend, SendGrid, and Twilio.
  • Marketing and CRM — HighLevel.
  • Integrations you choose to connect — for example Google, Meta/Facebook, Slack, Shopify, or Composio. Data flows to these only when you connect them.

Some features (such as voice agents or media generation) use additional specialist providers. A current list of our sub-processors is published at squidgy.ai/legal/subprocessors. We may also disclose information if required by law, to enforce our agreements, or as part of a sale or reorganisation of our business.

7. How long we keep your information

We keep personal information only as long as we need it for the purposes above:

  • Account, profile, and content (including conversations and uploads) — for as long as your account is active. You can delete conversations in the product at any time. After you close your account we delete or anonymise this data within 90 days, unless we must keep it longer by law.
  • Billing and tax records — 6 years, as UK law requires.
  • Connected-account tokens — until you disconnect the integration or close your account.
  • Analytics data — retained in identifiable form for up to 12 months, then aggregated.
  • Marketing contact data — until you unsubscribe or object.

8. How we protect your information

We use technical and organisational measures appropriate to the risk, including encryption in transit, access controls that limit who can reach personal data, and database-level security rules. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly if something goes wrong.

9. International transfers

Some of our service providers are based outside the UK and the European Economic Area, including in the United States. Where we transfer personal information outside the UK/EEA, we rely on an adequacy decision where one applies, or otherwise on appropriate safeguards such as the UK International Data Transfer Agreement or the EU Standard Contractual Clauses. You can ask us for more detail about the safeguards we use.

10. Your rights (UK and EEA)

If the UK GDPR or the EU GDPR applies to you, you have the right to access your personal information; to have it corrected or erased; to restrict or object to how we use it; to data portability; and, where we rely on consent, to withdraw that consent at any time without affecting processing already carried out.

To exercise any of these rights, email privacy@squidgy.ai. We will respond within the time the law allows (normally one month).

If you are unhappy with how we have handled your information, you can complain to the UK's Information Commissioner's Office (ICO) at ico.org.uk, or to your local supervisory authority if you are in the EEA. We would appreciate the chance to address your concern first.

11. California privacy rights

If you are a California resident, you have the right to know what personal information we collect (set out in §2) and how we use it (§3), and to request access to, correction of, or deletion of that information. We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We will not discriminate against you for exercising these rights. To make a request, email privacy@squidgy.ai.

12. Children

Squidgy is a business tool and is not directed to children. You must be at least 18 years old, or the age of majority where you live, to create an account. We do not knowingly collect personal information from children; if you believe a child has provided us information, contact privacy@squidgy.ai and we will delete it.

13. Changes to this notice

We may update this notice from time to time. When we make a material change, we will update the effective date above and, where appropriate, tell you in the product or by email. Your continued use of the platform after a change takes effect means you accept the updated notice.

14. How to contact us

For any question about this notice or your personal information, email privacy@squidgy.ai, or write to us at:

Squidgy (4142 Ltd)
20 Wenlock Road
London, England, N1 7GU

Chat with Squidgy