Novee AI Customer
Privacy Notice
Updated: December 2025
This privacy notice tells you what to expect us to do with your personal information.
Data Controller and Contact details:
We are Novee AI Limited (trading as Novee.ai), a company incorporated in England with number 15877874 and a registered office at 85 Great Portland Street, Great Portland Street, London, England, W1W 7LT
Email (including for data protection queries): support@novee.ai
What information we collect, use, and why
We collect or use the following information to provide and improve products and services for clients:
Names and contact details
Occupation
Usage data (including information about how you interact with and use our website, products and services)
Website user information
We collect or use the following personal information for the operation of client or customer accounts:
Names and contact details
Technical data, including information about browser and operating systems
We collect or use the following personal information for dealing with queries, complaints or claims:
Names and contact details
Customer or client accounts and records
International transfers
If we transfer personal data outside of the UK to countries not deemed adequate we use appropriate safeguards such as the ICO’s International Data Transfer Addendum or Standard Contractual Clauses with the UK Addendum.
Who we share personal information with
We may share personal information with the following categories of recipients:
Cloud hosting and infrastructure providers
Security and monitoring service providers
Analytics and product performance tools
Customer support and ticketing systems
Professional advisers (legal, compliance, audit)
Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website. Which lawful basis we rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.
Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. Read more about the right to restriction of processing.
Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.
Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.
Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Our legitimate interests are:Our legitimate interest is the development and optimization of our AI-driven underwriting intelligence platform. Specifically, we process information to refine our product to ensure accurate extraction, analysis, and interpretation of complex specialty insurance risks. To provide a high-quality product, our models must be exposed to real-world examples of insurance submissions (e.g., broker slips and technical reports). It is not technically possible to achieve the required level of precision and “context-awareness” using only synthetic or anonymized data, and therefore, must include the specific professional terminology and complex document structures used in the London Market. Processing is limited to what is strictly necessary to ensure our product’s reliability, usability, safety, and lack of bias. We have weighed our interests against the potential impact on individuals (such as users or third parties mentioned in insurance documents) and concluded that the benefits outweigh the risks for the following reasons: Business-to-Business Context: Our platform processes professional insurance documentation where the focus is on commercial risk rather than private life. Any personal data processed is typically incidental and only used to improve the product and not used for any marketing or other use outside of product improvement. We do not use personal information to make automated decisions that have a legal or significant effect on individuals in their private capacity. The AI product supports professional underwriters in making commercial risk decisions. We implement enterprise-grade security (ISO 27001 standards) and data minimisation techniques. We aim to de-identify or pseudonymize personal data wherever possible and enforce strict access controls to ensure data is handled only by authorized personnel for specific development tasks.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
Our lawful bases for collecting or using personal information for the operation of client or customer accounts are:
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Our legitimate interests are:Our legitimate interest is the effective administration, security, and management of the business accounts provided to our clients. This includes the identity of professional users, providing technical support, and maintaining a secure environment for sensitive insurance data. The benefits include the following: Security & Auditability: Ensuring that only authorised personnel can access sensitive specialty insurance data, and maintaining a robust audit trail of who accessed what information. Seamless Communication: Facilitating professional correspondence regarding system updates, critical alerts, and service-related notifications. Personalisation: Tailoring the user interface and workspace settings to improve the workflow and productivity of underwriters. To operate a secure, multi-tenant AI platform, we must identify individual users through business contact details (e.g., name, professional email address, and job title). Without this information, we cannot provide secure login credentials, prevent unauthorised access, or attribute actions within the platform which is essential for workflows typical in London Market underwriting. Processing professional contact data is the least intrusive way to ensure the platform remains secure and functional for the client organisation. We have assessed that the impact on the individuals involved is minimal and is outweighed by the benefits for the following reasons. Professional Expectation: The individuals involved are employees or contractors of our clients using the platform in a professional capacity. They have a reasonable expectation that their business contact information will be used to manage their professional accounts. Data Minimisation: We only collect the specific professional data required to facilitate account access, security and product improvement. We do not use these account details for unrelated marketing or sell them to third parties. Risk Mitigation: By processing this data, we actually protect the individual and their firm from the risks of data breaches or unauthorised account usage. We use industry-standard encryption and security protocols to ensure that account data is handled with the highest level of confidentiality.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
Our lawful bases for collecting or using personal information for dealing with queries, complaints or claims are:
Legitimate interests – we’re collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.
Our legitimate interests are:Our legitimate interest is to provide responsive support and maintain an accurate record of communications related to technical queries, service complaints, or potential legal claims. In the environment of specialty insurance, it is vital that we can investigate and resolve issues efficiently to ensure the continuity of underwriting operations. The benefits include: Effective Dispute Resolution: Enabling a fair, documented, and timely process for addressing user concerns or technical discrepancies. Service Reliability: Utilising feedback from queries to identify and fix bugs or system errors that could otherwise impact a syndicate\'s ability to quote risks. Legal Defence &; Accountability: Maintaining evidence of correspondence and system performance to protect both Novee.ai and our clients in the event of a commercial dispute or regulatory inquiry. To address a specific query or complaint, we must process the identity and contact details of the individual raising the matter, alongside a history of their interactions with the platform. Without this information, we would be unable to provide personalised support, track the progress of a resolution, or verify the context of a “claim” regarding system behavior. In the London Market, where an underwriting decision involves significant financial capacity, having a clear audit trail of communications is the only way to ensure professional accountability. We have assessed that the impact on the individuals involved is minimal and is outweighed by the benefits for the following reasons: Professional Context: Correspondence typically involves business-to-business technical support or commercial performance queries. We are processing information about individuals acting in their professional capacity, not their private lives. Expected Processing: Users would reasonably expect that if they raise a query or lodge a complaint, their contact information and the details of the issue will be recorded to facilitate a response. Proportionality: We only retain communication logs for as long as is necessary to resolve the matter or to satisfy statutory limitation periods for legal claims. Data is stored within our secure, encrypted infrastructure and is accessed only by staff members involved in the support or legal process.
For more information on our use of legitimate interests as a lawful basis you can contact us using the contact details set out above.
Where we get personal information from
Directly from you
Suppliers and service providers
Indirectly collected from you via our client submissions and documentation
Automated decision-making
Our service involved artificial intelligence tools; however, these support human decision making by our clients and are not intended for the making of automated decisions with legal or similarly significant effects.
How long we keep information
Client Account Data: Duration of contract + 6 years. Necessary for account security and to defend against potential breach of contract claims under the Limitation Act 1980.
User Queries & Support Logs: 6 years from resolution. To maintain a record of system performance and support provided in case of future commercial disputes.
Audit Trails & Logs: 7 years. Meets Lloyd’s “Minimum Standards” for auditability and helps detect unauthorized data access.
Complaints & Legal Claims: 10 years after settlement. To defend the firm’s position in long-tail insurance litigation or regulatory inquiries.
For more information on how long we store your personal information or the criteria we
use to determine this please contact us using the details provided above.
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113