DELLI AI — Privacy Policy

Version 1.0 · Effective 27 October 2026

1. Who we are

DELLI AI Maker Hub (the Service) is provided by DELLI Limited (DELLI, we, us), a company registered in England and Wales with company number 13063011. Our registered office is 9th Floor, 107 Cheapside, London EC2V 6DN. We are registered with the UK's data protection regulator, the Information Commission (ICO), under number ZB313119.

This policy explains what personal information we collect when you use the Service, visit our sign-up pages or deal with us, how we use it, and the choices and rights you have.

2. What this policy covers

This policy applies to information we hold as a controller: about the people who sign up for and use Maker Hub on behalf of a business, people who contact us or receive our emails, and visitors to our sign-up and log-in pages.

Information makers put into the Service. Makers use the Service to manage their orders, customers and business records. When they do, the maker decides what information goes in and how it is used, and we process it on their behalf as a processor, under our agreement with them. If your details appear in a maker's orders or messages (for example, because you buy from them), the maker's own privacy notice applies, and you should contact them about your information. If you contact us instead, we will pass your request to the maker.

Other DELLI services. The delli.market marketplace, Discovery Hub and DELLI Growth have their own privacy policies. Services you connect to Maker Hub, such as your email provider, store or accounting software, handle information under their own policies.

3. The information we collect

Information you give us

• Account details: your name, business email address, phone number, password, business name and website, and your role.

• Billing details: billing contact and address, VAT number, the plan you choose and your payment history. Card details are entered directly with our payment provider, Stripe, and we do not store them.

• What you send us in the Service: messages and files you share with the AI Assistant, in the app or by WhatsApp, and feedback you give us.

• Communications: support requests, survey answers, and notes or recordings of calls with our team. We will tell you before we record a call.

We need your email address, a password and your business name to create an account, and billing details to start a paid plan. Without them we cannot provide the Service. Other details are optional.

Information we collect automatically

• Usage and device information: your IP address, browser and device type, the pages and features you use, the time and date of your visits, and error and diagnostic information. If you agree, we also record how pages behave during your visit, with on-screen text and typed entries hidden, so we can find and fix problems. We collect some of this with cookies and similar technologies (see section 12).

Information from other sources

• Services you connect: when you connect an email account, WhatsApp, a store or a business system, we receive information that identifies that account and lets us access it with your permission.

• Your colleagues: when someone at your business invites you to their account.

• Stripe: confirmation of payments and payment status.

• Public and business sources: if we think your business may be interested in DELLI, we may collect your name, job title and business contact details from your company's website, public professional profiles and business contact data providers.

4. How we use your information

We use your information to:

• create and manage your account, confirm your email address and sign you in;

• provide the Service and its features, including the AI Assistant and the services you connect;

• run your free evaluation, suggest a plan, take payments and send invoices;

• send you service messages, such as sign-in codes, reminders about your plan, receipts and security alerts;

• provide support and onboarding, and respond to your questions;

• keep the Service and accounts secure, and prevent fraud and misuse, including more than one free evaluation per business;

• understand how the Service is used, fix problems and improve our features;

• send you news and offers about DELLI, where the law allows (see section 13);

• contact businesses we think may be interested in DELLI; and

• comply with the law, and establish, exercise or defend legal claims.

We do not sell your personal information or use it for third-party advertising.

5. Our legal bases

UK data protection law requires a legal basis for each use of your information. Ours are:

6. AI features

Some features of the Service use artificial intelligence, including models from third-party providers, for example to read orders, answer questions in the AI Assistant and summarise activity. Our AI providers process information only to deliver these features, under contracts that do not allow them to use it to train their models. We do not use your information to train AI models.

To keep the features accurate, we check AI results and the feedback you give us. When we use information from the Service to improve our features for all customers, we do so as a controller, on the basis of our legitimate interests, and only in a limited and secure way.

AI can make mistakes, so makers review its results before relying on them. We do not make decisions about people based solely on automated processing that have legal or similarly significant effects on them.

7. Who we share your information with

• Service providers who help us run the Service and our business, such as hosting, data storage, AI processing, analytics, error monitoring, customer support, messaging and email. They may use your information only to provide services to us. We will provide our current list of sub-processors on request.

• Stripe, which processes our payments. Stripe also uses some payment information for its own purposes, such as fraud prevention, under the Stripe Privacy Policy.

• Services you connect. When you connect an email account, WhatsApp, a store or a business system, information passes between that service and Maker Hub as you direct.

• Your colleagues. Other users in your business's account can see your name, email address and activity in the Service.

• Professional advisers and insurers, such as lawyers and accountants, under duties of confidentiality.

• Authorities, where the law requires it or to protect our rights, our users or others.

• A buyer or investor, if we sell, merge or reorganise all or part of our business. They must protect your information in line with this policy.

Google user data. If you connect a Google account, our use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Gmail data only to provide the Service's features to you, never for advertising, and we do not let people read it unless you agree, it is needed for security or to comply with the law, or it has been aggregated and anonymised for internal operations.

8. International transfers

We host the Service in the European Economic Area, which the UK recognises as protecting personal data adequately. Some of our service providers are based in, or access information from, other countries, including the United States. When we transfer personal information outside the UK, we make sure it is protected by an approved safeguard, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework), the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Contact us for more information about these safeguards.

9. How long we keep your information

We keep personal information only for as long as we need it for the purposes in this policy, then delete or anonymise it. In particular:

• Account information is kept while your account is open and for up to 12 months after it closes or you are removed from it.

• Billing records are kept for six years after the end of the financial year they relate to, as UK tax law requires.

• Information makers put into the Service is kept and deleted as set out in our agreement with them, normally within 90 days after their account closes, and from backups as they expire.

• Marketing preferences: if you opt out, we keep a record so that we do not contact you again.

We may keep information for longer where the law requires it or to deal with a legal claim.

10. How we protect your information

We use technical and organisational measures to protect personal information, including encryption in transit and at rest, access controls that limit our staff's access to what their role needs, staff confidentiality obligations and monitoring of our systems. No system is completely secure, so please keep your password safe and tell us straight away if you think your account has been compromised. If a breach puts your information at risk, we will tell you and the ICO where the law requires.

11. Your rights

You have the right to:

• ask for a copy of the personal information we hold about you;

• have inaccurate information corrected;

• have your information deleted, or its use restricted, in some circumstances;

• object to our use of your information where we rely on legitimate interests, and to direct marketing at any time;

• receive information you gave us in a portable format, in some circumstances;

• withdraw consent where we rely on it; and

• ask for a person to review a decision made solely by automated means that significantly affects you.

To use any of these rights, email data@delli.com. We may need to confirm your identity. We will respond within one month, or within three months for complex requests, and tell you if we need longer or need more information from you. You can update most account details yourself in the Service.

If your information is in a maker's account (section 2), please contact the maker. If you contact us, we will pass your request to them.

Complaints. If you are unhappy with how we have handled your information, please tell us by emailing data@delli.com, and we will acknowledge your complaint within 30 days. You can also complain to the Information Commission (ICO) at ico.org.uk or on 0303 123 1113.

12. Cookies

We use cookies and similar technologies that are essential to sign you in and keep the Service secure. With your permission, we also use analytics and session recording to understand how the Service is used and to fix problems. We ask for your choice when you first visit, and you can change it at any time using Cookie settings, which is in the footer of our sign-up and log-in pages and in your account menu. Our Cookie Policy lists the cookies we use.

13. Marketing

We may send you news, tips and offers about DELLI by email. If you use a company email address, we do this on the basis of our legitimate interests. If you are a sole trader or partnership, we only do so if you have agreed, or if you are a customer and we are telling you about similar DELLI services. Every marketing email includes an unsubscribe link, and you can opt out at any time by emailing us.

Service messages, such as sign-in codes, plan reminders and receipts, are not marketing and continue while you have an account.

14. Children

The Service is for businesses and is not intended for anyone under 18. We do not knowingly collect information from children.

15. Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed. If we make a significant change, we will tell you by email or in the Service before it takes effect.

16. Contact us

Questions about this policy or your information: data@delli.com, or DELLI Limited, 9th Floor, 107 Cheapside, London EC2V 6DN.