Privacy Policy

Last updated: 22 September 2026

1. Introduction

Goldsmiths.ai ("we", "us", "our") is operated by Goldsmith & Co Ltd. We provide an AI-powered membership platform offering chat, website building, and development tools. This Privacy Policy explains how we collect, use, and protect your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Data We Collect

We collect the following personal data when you register and use our services:

• Account information: Your name, email address, and password (stored as a cryptographic hash).
• Payment data: Processed securely via Stripe. We do not store your full card details — Stripe handles all payment processing.
• Usage data: Chat messages, build history, credit transactions, and interaction logs with our AI services.
• Device data: IP address, browser type, and basic device information collected automatically.
• Vetting information: If you submit a vetting application, we collect employer, job title, and reference details as part of our membership approval process.
• Face data: If you use the G-Lock HomeGuard app, see the "Face Data (Biometric Information)" section below for exactly how facial images and face profiles are handled.

3. How We Use Your Data

• Provide and maintain the Goldsmiths.ai platform and AI chat services
• Process subscription payments and manage credit balances
• Review and approve membership applications through our vetting process
• Communicate with you about your account, updates, and support
• Monitor and improve our services and AI performance
• Prevent misuse, fraud, and unauthorised access

4. AI Chat Data

Chat messages you send to our AI service are processed to generate responses. Your chat history is stored securely and is only visible to you and the platform owner. We do not share your chat data with third parties.

5. Data Storage and Security

• Passwords stored using bcrypt hashing
• All payment processing handled by Stripe (PCI DSS compliant)
• SSL/TLS encryption for all data in transit
• Row-level security ensuring members cannot access other members' data

Face Data (Biometric Information)

G-Lock HomeGuard uses facial recognition to control access to your own G-Lock hardware. This section explains exactly how your face data is handled.

• Collection: When you voluntarily enroll your face in the app, we capture a short series of facial images using your device's camera. From these images the system creates a mathematical face profile (a "template") — a set of numeric measurements derived from 468 facial landmark points. A single profile photograph is retained as your enrollment thumbnail. During verification, the app briefly captures camera frames to perform a liveness check (a blink or wink challenge) that confirms a live person is present. These check frames are processed in the moment and are not retained.
• Use: Your face profile is used only to (a) recognise you at your own G-Lock unit so it can arm, disarm, or unlock for you, (b) record security events for your own account, and (c) send you security alerts. Face data is never used for advertising, profiling, or any purpose other than the security functions of your own system.
• Storage: Your face profile and enrollment thumbnail are stored on secure servers and access-controlled cloud infrastructure, and access is restricted to your own account. Recognition is performed on your own device, and on your own G-Lock unit wherever the hardware supports it. Face data is encrypted in transit.
• Sharing: We do not sell, rent, or share your face data with any third parties, and we never send your face data to third-party face-recognition services.
• Retention and deletion: We keep your face profile only while your account is active and your enrollment exists. You can delete your face enrollment at any time in the app without deleting your account. Deleting your account (via "Delete My Account" in the app) permanently deletes your face profile, enrollment images, and associated security event history, normally within 24 hours and in all cases within 30 days. You can also request deletion at any time by emailing info@g-lock.co.uk.
• Choice: Enrollment is entirely voluntary — the app functions without face enrollment, and you can delete your face profile at any time.

6. Legal Basis for Processing

• Contract: To provide the services you signed up for
• Legitimate interest: To prevent misuse and maintain platform security
• Legal obligation: To comply with UK law
• Consent: For optional communications

7. Data Sharing

We do not sell your personal data. We share data only with Stripe (payments), GoDaddy (domain/email hosting), and law enforcement if required by UK law.

8. Your Rights

• Access your personal data (Subject Access Request)
• Request correction of inaccurate data
• Request deletion of your data
• Restrict or object to processing
• Data portability
• Withdraw consent
• Lodge a complaint with the ICO (ico.org.uk)

To exercise these rights, contact us at info@g-lock.co.uk

9. Data Retention

We retain your data for as long as your account is active. If you cancel, data is retained for 90 days then permanently deleted. Vetting applications from rejected applicants are retained for 30 days then auto-purged. Credit transaction logs are retained for 7 years for accounting compliance.

10. Children's Privacy

Goldsmiths.ai is not available to anyone under 18.

11. International Transfers

Your data is stored in the United Kingdom and is not transferred outside the UK.

12. Changes to This Policy

We may update this Privacy Policy. We will notify members of significant changes via email.

13. Contact

• Email: info@g-lock.co.uk
• Company: Goldsmith & Co Ltd