Privacy Notice
Last updated: 24 November 2025
Who we are
Xylo AI Ltd ("Xylo", "we", "us") builds AI-powered software to help local planning authorities deliver better planning services.
Contact details:
- Email: contact@buildxylo.ai
- Address: 9 Gray's Inn Square, London WC1R 5JD, United Kingdom
Our services
We operate:
- www.buildxylo.ai — our marketing website
- buildxylo.app — our web application for authorised users
Our role
We act primarily as a data processor on behalf of local planning authorities. For limited business purposes (such as responding to enquiries and improving our services), we act as a data controller. This notice covers those limited purposes.
For information about how planning application data is handled within our products, please refer to your organisation's privacy notice.
Information we collect
Information you provide:
- Name, job title, and contact details when you enquire about our services or are set up as a user
- Any information you share in correspondence with us
Information collected automatically:
- Technical data (IP address, browser type, device information)
- Usage analytics on our web application to improve the service
How we use your information
- To provide and improve our services
- To respond to enquiries
- To communicate service updates
- To comply with legal obligations
Legal basis
We process your data based on: legitimate interests (operating our business, improving our services), contractual necessity (providing services to your organisation), and legal obligations.
Who we share data with
- Service providers including cloud infrastructure, AI model providers, analytics, and logging services — all under appropriate data processing agreements
- Professional advisors where necessary
- Regulators or law enforcement where required by law
We do not sell your personal data. For details of sub-processors used when processing data on behalf of local planning authorities, please refer to your organisation's agreement with us.
International transfers
Your data is primarily stored and processed in the UK and EU. Where our service providers process data outside the UK/EEA, we ensure appropriate safeguards such as Standard Contractual Clauses are in place.
Data retention
We retain data only as long as necessary: account data for the duration of your organisation's relationship with us; enquiry data for 2 years from last contact; contractual records for 6 years.
Your rights
You have the right to access, correct, delete, restrict, or port your personal data, and to object to processing. Contact us at contact@buildxylo.ai to exercise these rights.
Complaints
If you are unhappy with how we have handled your data, contact us first. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
Changes
We may update this notice from time to time. Significant changes will be communicated through our website.
