Privacy Statement

1. Who We Are (Data Controller)

The data controller for the demo site is Yantra Works Ltd, a private limited company incorporated in England and Wales.

• Company number: 16952672
• Registered office: 128 City Road, London, EC1V 2NX, United Kingdom
• Contact: rajiv@yantra.works
• ICO registration: registration in progress

This statement covers personal data processed by demo.socialhomes.ai. It does not cover the SocialHomes.AI production platform when deployed for a housing association customer - that processing is governed by a separate Data Processing Agreement between Yantra Works and the customer.

2. What Personal Data We Collect

We do not use cookies for advertising, profiling, or analytics. The session token is stored in your browser's session storage, not as a cookie, and clears when you close the tab.

3. Lawful Basis for Processing

We rely on the following lawful bases under UK GDPR Article 6(1):

• Legitimate interests - controlling access to a confidential commercial demo, protecting our intellectual property, and auditing access. We have balanced this against your rights and freedoms and consider it proportionate given the limited data we collect.
• Contract - where you have requested the demo and our processing is necessary to provide it to you.
• Consent - where you submit an access request form, your submission of that form constitutes consent to our review of your details for the purpose of granting or declining access.

We do not process special category data through the demo site.

4. Who We Share Data With (Sub-Processors)

We use the following third-party sub-processors to operate the demo. Each is bound by their own data protection terms and processes your data only on our instructions:

We do not sell your personal data. We do not share it with marketing networks, ad networks, or data brokers.

5. International Transfers

The demo web server is hosted in the United States (Google Cloud Run, us-central1). Anthropic Claude AI processes inference requests in the United States. These transfers are protected by:

• The UK Information Commissioner's Office adequacy decision for transfers to the US under the UK-US Data Bridge (where applicable);
• Standard Contractual Clauses (SCCs) and the UK International Data Transfer Addendum;
• Each sub-processor's published data processing addendum.

6. How Long We Keep Data

7. Your Rights Under UK GDPR

You have the following rights in respect of your personal data:

• Access - to obtain a copy of the personal data we hold about you;
• Rectification - to have inaccurate data corrected;
• Erasure ("right to be forgotten") - to have your data deleted;
• Restriction - to limit how we process your data;
• Portability - to receive your data in a structured, machine-readable format;
• Objection - to object to processing based on legitimate interests;
• Withdraw consent - where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, email rajiv@yantra.works. We aim to respond within one calendar month. There is no charge for reasonable requests.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

8. Cookies and Similar Technologies

The demo site uses minimal browser storage:

• Session storage - holds your authentication token while you use the demo. Cleared when you close the tab.
• Cache storage - the demo page actively clears any cached video content on each load to ensure you always see the latest version.

We do not use tracking cookies, analytics cookies, advertising cookies, or any third-party tracking technology on the demo site. We do not need a cookie banner because we do not use non-essential cookies.

9. Security

We protect your data with:

• TLS 1.3 encryption for all traffic to and from the demo site;
• AES-256 encryption at rest for stored data on Google Cloud;
• HMAC-signed session tokens with 10-hour expiry;
• Time-limited signed URLs (4-hour expiry) for the demo video, served from a private Cloud Storage bucket - direct access without a valid session is blocked;
• Rate limiting on authentication endpoints to prevent brute force attacks;
• One-time access codes rather than persistent passwords;
• Comprehensive access logging with audit trail.

10. Children

The demo site is intended for professional users in social housing, technology, investment, and adjacent sectors. It is not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Automated Decision-Making

The demo site does not make any automated decisions producing legal or similarly significant effects on you. Access requests submitted by non-whitelisted users are reviewed manually by a human administrator before access is granted or declined.

12. Changes to This Statement

We may update this statement from time to time. The current version is shown at the top of this page. Material changes will be communicated by email to whitelisted users where practicable.