Privacy Policy

Centrus is the AI and automation platform for UK field service: Train, Chat, Agent Builder and Front Desk. This Privacy Policy describes how we process personal data in connection with centrus.ai (opens in a new tab), app.centrus.ai (opens in a new tab), and related services (together, the “Services”).

It should be read with our Cookie Policy, which covers cookies and similar storage and access technologies, and our Terms of Service. Where we process personal data on a customer’s instructions, the data processing terms in clause 6 of the Terms of Service also apply.

This policy was last updated on 16/10/2026. We will update it when our processing, subprocessors or the law changes.

Centrus AI Ltd is a company registered in England and Wales under company number 15822500. Our registered office is 10-12 Mulberry Green, Old Harlow, Essex, CM17 0ET, United Kingdom.

Jack Oliver Melluish is our Data Protection Officer. You can contact the DPO at support@centrus.ai, which is also the address for day-to-day privacy requests, or by post at our registered office, marked for the attention of the Data Protection Officer.

In this policy, “we”, “us” and “our” mean Centrus AI Ltd.

This notice applies to:

• Website visitors and people who book a demo, fill in a form or email us
• Customers, including the people they authorise as Users of the platform
• Suppliers, partners and other business contacts
• People who send us a note about working here. We keep those notes for 6 months, then delete them

If you are an employee, engineer, customer or supplier of one of our business customers, that customer is usually the controller of your data inside Centrus. You should contact them first. We will support them where we act as their processor.

The distinction matters. It decides who you should contact, and which contract sits behind the processing.

We are the controller for personal data we collect for our own business: website enquiries, accounts and billing, support tickets we hold as a supplier, security logs we keep to run the service, marketing to business contacts, and supplier records.

We are the processor for Customer Data. That is the content, documents, job records, messages, call recordings, transcripts and other information a customer or its Users upload, sync or otherwise make available to the platform, including data retrieved from Connected Systems on the customer’s instruction. We process that data only to provide, maintain, secure and support the Services, and to comply with law, as set out in clause 6 of the Terms of Service, or in a signed data processing agreement where we have one.

Our data processing terms are part of the Terms of Service, clause 6, for every customer. A signed data processing agreement, with the full list of subprocessors, is available on request: ask us at support@centrus.ai.

The categories we handle depend on how you use Centrus.

Account and business contact data. Name, job title, business email, phone number, company name, role in the account (administrator or user), and billing details. Payment card data is collected and processed by our payment provider; we do not store full card numbers.

Customer Data. Documents, messages, job records, call recordings, transcripts and other content the customer or its Users put into Centrus, or authorise us to retrieve from systems the customer connects, including a Google account, WhatsApp and telephone calls answered by Front Desk. What we access from a Google account is set out under “Google account data”.

Usage data. Technical information generated when the website or application is used, so we can operate, secure and improve the Services.

Website data. While analytics is on, Google Analytics records the pages you view, the site that referred you, your browser and device type, your approximate location (country and city, worked out from your IP address), and actions such as scrolling, clicking a link to another site, starting a form or playing a film. Google Analytics does not store your IP address. In the UK, analytics is on unless you turn it off. Everywhere else, it only runs if you accept it. While it is off, none of this is collected. If you send us a form while analytics is on, we save the campaign tags and referring site of your visit with it, so we can see which campaigns bring enquiries. See the Cookie Policy.

Website enquiries. When you book a demo or send us a message: the details you type in (such as your name, work email, company and message), the page you came from, your browser type, and whether you ticked the box to hear from us. We need the fields marked as required to reply to you.

Support and sales data. The content of demos, emails, calls and tickets, including recordings of meetings where we have told you we are recording for quality and staff training.

We do not routinely collect special category data (for example health, trade union membership or biometric data), payment card primary account numbers, or data that is subject to sector-specific regulation. Customers must not upload that data unless we have agreed in writing in advance.

• Directly from you, when you create an account, book a demo, email us or use the Services
• From the customer organisation that invites you as a User
• From systems the customer connects to the platform
• Automatically, from use of the website and the application
• From publicly available business sources such as Companies House or LinkedIn, where we are building a legitimate B2B relationship

Under UK GDPR we only process personal data where we have a lawful basis. For the processing we control, those bases are as follows.

Contract. To set up and run an account, provide the Services, bill, authenticate Users, deliver support, and take steps before a contract (for example a demo you have asked for).

Legitimate interests. To secure the platform, prevent abuse, understand how the product is used in aggregate, measure how visitors in the UK use our website (you can turn this off at any time), improve reliability, keep business records, and tell existing customers about similar Centrus services, with a way to opt out in every email. We only rely on legitimate interests where they are not overridden by the individual’s rights. You can object: see “Your rights” below.

Consent. For Google Analytics outside the UK and any other non-essential cookies and similar technologies, and for marketing emails to people who are not existing customers, including anyone who ticks the box to receive them on our demo or contact form. The box is never ticked for you, and booking a demo or sending a message does not depend on it. You can withdraw consent at any time: for marketing emails through the unsubscribe link in every email or by emailing support@centrus.ai, and for cookies through Manage cookie settings on the Cookie Policy page. Withdrawing consent does not affect processing that already happened.

Legal obligation. To keep accounting records, respond to lawful requests, and meet other duties that apply to a UK company.

Where we are the processor, the customer determines the purposes and means. Our lawful basis as processor is the contract with that customer, and the customer is responsible for having its own lawful basis for the Customer Data it instructs us to process.

The customer retains all rights in Customer Data. Nothing in our Terms transfers ownership of it to us. We use it only to host, process, transmit and display it so we can provide, maintain, secure and support the Services, and to comply with law.

Your data is not used to train AI models, ours or anyone else’s, and training is switched off on our AI provider account. That covers Customer Data and Outputs. Sharing of inputs and outputs for model training or service improvement is disabled.

AI outputs are generated from the customer’s inputs, knowledge and Connected Systems. They are not verified by us as a matter of course. Customers are responsible for reviewing outputs before relying on them, and for configuring human approval where an agent performs an action with commercial consequences. See the Terms of Service and the Security page.

We may generate anonymised, aggregated statistics about platform usage which do not identify the customer, its Users or its clients. We use those statistics to operate and improve Centrus.

Access inside an organisation is limited by the roles and permissions the customer sets. We provide the controls; the customer decides how they are applied.

When a customer connects their own Google account, Centrus accesses only what that connection requests, and only on the customer’s instruction. That can include the Google Account email address, Gmail (reading and searching messages, drafts, labels, sending, and moving a message to the bin), Google Drive files and folders, Google Docs, Google Sheets, and Google Calendar (the list of calendars, events, and free/busy times).

We use that data only to carry out an action a user asks for in chat, or an action an agent the customer has configured is set to do. For example, finding a file, saving a document the assistant has produced, reading or drafting an email, or creating or moving a calendar event. We do not sell it. We do not use it for advertising. We do not use it to train AI models, ours or anyone else’s.

People at Centrus do not read this data unless the customer has asked us to for support, it is necessary to keep the service secure or to investigate abuse, or the law requires it. The customer can disconnect the Google account in the application at any time.

We keep it as Customer Data: for as long as the subscription is active and we need it to provide the Services, then we delete it within 90 days of termination or of a documented deletion request, unless the law requires us to keep it. We share it only with the service providers listed under “Who we share data with”, so we can carry out that request.

Centrus’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (opens in a new tab), including the Limited Use requirements.

We do not sell personal data. We share it only as needed to run the Services, with the customer’s instructions, or where the law requires it.

Service providers. We use these kinds of providers to host, operate, bill for and support the Services:

• Hosting and database

  What they do for us

  Host the platform, its database, file storage and application logs, in the UK and EU

• AI processing

  What they do for us

  Process questions, files and answers so Centrus can reply, with training switched off

• Sign-in

  What they do for us

  Run accounts and secure sign-in

• Email and form delivery

  What they do for us

  Send our emails and deliver website enquiries to our team

• Spam protection

  What they do for us

  Check that our website forms are sent by a person, not a bot. This sets no cookies

• Payments: Stripe

  What they do for us

  Take card and Bacs Direct Debit payments. We never see full card numbers

• Website analytics: Google

  What they do for us

  Google Analytics, while analytics is on. In the UK it is on unless you turn it off; elsewhere only if you accept it

The full list of subprocessors, by name, is available on request in our data processing agreement. Ask us at support@centrus.ai.

Website analytics. While analytics is on, Google (Google Ireland Limited and Google LLC) provides Google Analytics to us and receives the website data described above. Our tag switches off Google signals and advertising personalisation, and we do not use the data to target advertising. Google explains its own use of this data in How Google uses information from sites that use our services (opens in a new tab).

Connected systems. If a customer connects a third-party tool, that provider processes data under its own terms, on the customer’s authority. We only access what the customer has instructed us to use. Google account data is described under “Google account data”.

Professional advisers, insurers, and prospective buyers. We may share limited information with lawyers, accountants or insurers, or with a buyer and its advisers if we sell or restructure the business, under confidentiality obligations.

Authorities. We may disclose information where required by law, a court or a regulator, or to protect the rights, property or safety of Centrus, our customers or others.

Core platform data is hosted in the UK and EU. Some processing may take place on our providers’ infrastructure outside the UK or EU.

Where personal data is transferred outside the UK or EU, we put in place appropriate safeguards. That typically means the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy regulation. Details are in our data processing agreement, available on request.

Google may process website analytics data in the United States. Google LLC is certified under the UK Extension to the EU-US Data Privacy Framework, which the UK recognises as providing adequate protection.

We keep personal data only for as long as we need it for the purpose we collected it, including to meet legal, accounting or reporting duties.

• Customer Data is retained for as long as the customer’s subscription is active and we need it to provide the Services
• On termination, or a documented deletion request, we delete Customer Data within 90 days, unless a longer period is required by law or agreed in writing
• Account, billing and contract records are typically kept for six years after the relationship ends, which is the period we need for UK tax and limitation purposes
• Support tickets and security logs are kept for as long as needed to resolve issues, secure the platform and meet audit needs, then deleted or aggregated
• Website enquiries from people who do not become customers are kept for 2 years after we last hear from them, then deleted
• Business contact details from public sources are kept for 2 years after we last contact the person, unless they become a customer
• Notes about working here are kept for 6 months, then deleted
• Marketing contacts are kept until they unsubscribe or the relationship is clearly stale, and we then suppress rather than re-contact them
• Google Analytics keeps visitor-level and event-level data for 2 months, its standard setting, then deletes it automatically. The reports we keep are aggregated and do not identify anyone

We take appropriate technical and organisational measures against unauthorised or unlawful processing, and against accidental loss, destruction or damage. That includes encryption, access controls set by the customer, and staff access only where there is a need.

We are Cyber Essentials certified (12/06/2026). Our core infrastructure providers hold SOC 2 Type 2. A formal ISO 27001 assessment with Cambridge Cyber Security is planned for 2027. More detail sits on the Security page. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Where we are the controller, UK data protection law gives you the right to:

• Access a copy of the personal data we hold about you
• Have inaccurate data corrected, and incomplete data completed
• Ask us to erase data in certain circumstances
• Ask us to restrict processing in certain circumstances
• Object to processing based on legitimate interests, including direct marketing (you can object to marketing at any time)
• Receive data you provided to us in a structured, commonly used format, and ask us to transmit it to another controller where the processing is automated and based on consent or contract
• Withdraw consent where we rely on it
• Not be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Centrus is not designed to make those decisions without a person. Customers must not use the Services for that purpose without meaningful human review

You can exercise these rights by emailing support@centrus.ai, which reaches our Data Protection Officer. We will respond within one month, or explain if we need longer. We will not usually charge a fee.

If the data sits in a customer’s Centrus workspace, we will direct you to that customer, or support them to respond, because they are the controller.

Centrus is a business platform. It is not aimed at children, and we do not knowingly collect personal data from anyone under 18. If you believe we have done so, contact us and we will delete it.

We use cookies and similar technologies on the website and in the application. Some are needed for the service to work. Google Analytics is optional: in the UK it runs unless you turn it off, and elsewhere only if you accept it in the cookie banner. You can change your choice at any time from Manage cookie settings on the Cookie Policy page.

The Cookie Policy is the detailed notice required by the Privacy and Electronic Communications Regulations (PECR), as updated by the Data (Use and Access) Act 2025.

We may update this policy to reflect the product, our subprocessors, or the law. The date at the top will change. For material changes that affect customers, we will give notice through the application or by email where we have an address.

Questions, requests and complaints should come to us first, at support@centrus.ai. Postal address: 10-12 Mulberry Green, Old Harlow, Essex, CM17 0ET, United Kingdom, marked for the attention of the Data Protection Officer.

If you remain unhappy, you can complain to the UK Information Commissioner’s Office. Under the Data (Use and Access) Act 2025 you are expected to raise the matter with us before going to the ICO, unless that would not be appropriate.

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Helpline 0303 123 1113. https://www.ico.org.uk (opens in a new tab).