Privacy Policy

1.1 Important information and who we are

Welcome to Thelonious Limited, a subsidiary of The Birdella Group Ltd. This Privacy Policy describes how Thelonious Limited (“we”, “us” or “our”) handles personal data across:

• our website at thelonious.net (the “Site”); and
• the Thelonious platform, available to subscribers at client.aiphelion.net (the “Platform”).

We are committed to protecting and respecting your privacy and Personal Data in compliance with the United Kingdom General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018 and all other mandatory laws and regulations of England and Wales (the “Legislation”). Capitalised terms used below have the same meaning as provided for in the Legislation unless expressly stated otherwise below.

This Privacy Policy explains how we collect, process and keep your data safe, and tells you about your privacy rights.

The individuals from whom we may gather and use data include:

• Customers and their Authorised Users
• Visitors to the Site, including people who request a demo, a Snapshot or a report
• Newsletter subscribers
• Suppliers and business contacts
• Any other people with whom we have a relationship or may need to contact

1.2 Your Data Controller & contact point; complaints

Thelonious Limited is the Data Controller for the Personal Data processed through the Site and the Platform or otherwise collected from you, except as described in Section 1.3. Any enquiries, requests to exercise your legal rights, or complaints regarding your data should be sent to our compliance inbox at info@birdella.com.

Complaints:

You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance. You can use our complaints form.

1.3 Processing on behalf of our clients

When you use the Platform through your employer or another organisation, we act as a Data Processor. We process your data according to the instructions of your employer or organisation, which will be the Data Controller in those circumstances.

2.1 Types of data / Privacy Policy scope

“Personal Data” means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of Personal Data about you, which we have grouped together below. Not all of the following types of data will necessarily be collected from you, but this is the full scope of the data we collect:

• Profile/Identity Data: your first name, last name, job title, organisation, username and password.
• Contact Data: your email address, phone number and business address.
• Request Data: information you give us when you request a demo, a Snapshot or a report, such as your jurisdictions, practice areas and industry.
• Marketing and Communications Data: your preferences for receiving marketing and newsletters from us.
• Billing Data: your billing name, billing address and the details needed to invoice you.
• Transactional Data: details of payments you have made for our services and the services you have selected.
• Customer Support Data: feedback, survey responses, complaints and any queries or requests for support you raise.
• Usage Data: how you use the Site and the Platform, including the queries you enter into Thelonious Research.
• Technical Data: internet protocol (IP) address, login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access the Site or the Platform.

We also collect, use and share Aggregated Data, which is not considered Personal Data in law because it does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data, which will be used in accordance with this Privacy Policy.

We may also aggregate data to enable research or analysis so that we can better understand and serve you and others. Although this aggregated data may be based in part on Personal Data, it does not identify you personally. We may share this type of anonymous data with others, including service providers, our affiliates, agents and current and prospective business partners.

We do not collect any Special Categories of Personal Data about you (details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health, or genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

2.2 The legal basis for collecting and using your data

There are a number of permitted reasons under the Legislation that allow the collection and processing of Personal Data. The main ones we rely on are:

• “Contractual Obligations”: We may require and use certain information from you to fulfil our contractual obligations and provide you with the promised service under a contract we have entered into, or are about to enter into, with you.
• “Legitimate Interest”: We may need to collect and use certain information from you to conduct our business and pursue our legitimate interests — for example, to prevent fraud and give you a secure experience, to send security alerts and sign-in verification codes to your email, to use metadata to optimise the Platform interface, or to verify your identity to prevent fraudulent bot activity. We consider and balance any potential impact on you and your rights (both positive and negative) before we process your Personal Data for our legitimate interests. We do not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
• “Legal Compliance”: We may use your Personal Data where it is necessary to comply with a legal obligation to which we are subject. We will identify the relevant legal obligation when we rely on this legal basis.
• “Consent”: We rely on consent only where we have obtained your active agreement to use your Personal Data for a specified purpose, such as when you tick a box to receive our ICYMI newsletter, or accept analytics cookies.

2.3 How we collect your data

We use different methods to collect data from and about you, including:

• Your interactions with us. You may give us your Personal Data by filling in forms on the Site or the Platform, or by corresponding with us by post, phone, email or otherwise. This includes Personal Data you provide when you:
  • request a demo, a Snapshot or a report (such as the AI Law Quarterly) on the Site;
  • subscribe to our ICYMI newsletter (which is delivered by Substack);
  • apply for, or subscribe to, the Platform, and when your Platform account is created;
  • sign in to the Platform, including when we send you a verification code by email;
  • make a complaint or give us feedback; or
  • otherwise contact us.
• Automated technologies or interactions. As you interact with the Site and the Platform, we automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this Personal Data using cookies (with your consent where required), server logs and similar technologies. Please see our Cookie Policy for further details.
• Third parties or publicly available sources. We receive Personal Data about you from various third parties and public sources, as set out below:
  • Technical Data from analytics providers such as Google Analytics, based outside the UK; and
  • Identity and Contact Data from publicly available sources such as Companies House, based inside the UK.

3.1 Our data uses

We will only use your Personal Data when the law allows us to.

The table below sets out the types of Personal Data we collect and the lawful basis for processing it. Please refer to Section 2.2 for more information on each lawful basis.

The examples in the table are indicative, and the purposes for which we use your data may be broader than described, but we will never process your data without a legal basis or for an unrelated purpose. For further enquiries, please contact us at info@birdella.com.

3.2 Marketing and content updates

You will receive marketing and new content communications from us only if you have opted in to receive them. From time to time we may analyse your Profile/Identity, Contact, Technical and Usage Data to form a view on which of our services and content may interest you, so that we can send you relevant communications.

Opting out

You can ask us to stop sending you marketing communications at any time by following the unsubscribe link in any marketing email (including ICYMI), or by contacting us at info@birdella.com.

If you opt out of marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes.

3.3 Change of purpose

We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you would like an explanation of how processing for a new purpose is compatible with the original purpose, please contact us at info@birdella.com.

If we need to use your Personal Data for an unrelated purpose, we will notify you and explain the legal basis that allows us to do so.

4.1 Your legal rights

In certain circumstances, you have the following rights under the Legislation in relation to your Personal Data:

• Right to be informed. You have a right to be informed about our purposes for processing your Personal Data, how long we store it for, and who it will be shared with. We have provided this information in this policy.
• Right of access. You can receive a copy of the Personal Data we hold about you and check that we are processing it lawfully (a “data subject access request”). See Section 4.3 for how to make a request.
• Right to rectification. You can ask us to correct incomplete or inaccurate Personal Data we hold about you, though we may need to verify the accuracy of the new data you provide.
• Right to erasure. You can ask us to delete or remove Personal Data where there is no good reason for us to continue processing it, where you have successfully exercised your right to object (see below), where we may have processed your information unlawfully, or where we are required to erase your Personal Data to comply with law. We may not always be able to comply with a request for erasure for specific legal reasons, which we will explain to you at the time of your request.
• Right to object. You can object to our processing of your Personal Data. This is not an absolute right and applies only in certain circumstances, for example:
  • where we are processing your Personal Data for direct marketing purposes; or
  • where we are relying on a legitimate interest (ours or a third party’s) and there is something about your particular situation that makes you want to object because you feel it affects your fundamental rights and freedoms.
  In some cases we may continue processing your data if we can demonstrate compelling legitimate grounds that override your rights and freedoms.
• Right to restrict processing. You can ask us to restrict or suppress your Personal Data. This is not an absolute right and applies only in certain circumstances:
  • if you want us to establish the data’s accuracy;
  • where our use of the data is unlawful but you do not want us to erase it;
  • where you need us to hold the data, even if we no longer require it, to establish, exercise or defend legal claims; or
  • where you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Right to data portability. You can ask us to transfer your Personal Data to you or to a third party in a structured, commonly used, machine-readable format. This right applies only to automated information that you initially consented to us using, or that we used to perform a contract with you.

4.2 How we protect your Personal Data

We take the security of your data seriously. We use appropriate security measures designed to ensure that Personal Data we collect is accessible only by a limited number of personnel who have specific access rights and are bound by obligations of confidentiality. Where we use subcontractors to store or process your data, we enter into appropriate contractual obligations with them so that we do not relinquish control of your Personal Data or expose it to security risks that would not have arisen had the data remained in our possession.

Unfortunately, no transmission of data over the internet is guaranteed to be completely secure. While we strive to protect your Personal Data, we cannot guarantee the security of data you transmit to us, and any such transmission is at your own risk. If you believe your interaction with us is no longer secure, please contact us immediately at info@birdella.com.

We have procedures in place to deal with any suspected Personal Data breach, and we will notify you and any applicable regulator of a breach where we are legally required to do so.

4.3 How to request your data

You will not have to pay a fee to access your Personal Data (or to exercise any of your other rights). However, if your request is clearly unfounded or excessive, we may refuse to comply with it.

We may need to request specific information from you to confirm your identity and ensure you have the right to access your Personal Data (or to exercise any of your other rights). This is a security measure to ensure that Personal Data is not disclosed to anyone who has no right to receive it. We may also contact you to ask for further information to speed up our response.

We aim to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests. In that case, we will notify you and keep you updated.

5.1 Where your data is held

• The Platform: the Thelonious platform and its databases are hosted in the United Kingdom (London).
• The Site: thelonious.net is hosted by Fasthosts in the United Kingdom.

We use a small number of trusted service providers to run our business. Some of them process Personal Data in the United States:

• Google Workspace — our business email and productivity tools, used whenever you correspond with us.
• Google Analytics — website analytics, used only if you accept analytics cookies on the Site.
• Substack — delivery of our ICYMI newsletter, if you subscribe.
• Resend — delivery of the sign-in verification codes we email to Platform users.
• Google Cloud (Vertex AI) — runs the Google Gemini models that power Thelonious Research. When you ask Thelonious Research a question, your question and the related context are sent to Google for processing. Google may process them in the United States or route them to its servers in other countries. Google does not use them to train its models.

Each of these transfers is protected by the safeguards described in Section 8.

We may also share your Personal Data where required for legal reasons, or to enforce our terms or this Privacy Policy.

5.2 Security standards

Wherever data is processed, we apply a consistent security framework. This currently includes:

• Encryption: Personal Data held on the Platform is encrypted at rest using AES-256, and all data is encrypted in transit using TLS 1.2 or higher.
• Access control: access to our production environment is restricted to a limited number of authorised personnel and is protected by multi-factor authentication (MFA).
• Oversight: we carry out regular internal vulnerability assessments, led by our senior technical team.

We will only retain your Personal Data for as long as reasonably necessary to fulfil the purposes for which we collected it, including to satisfy any legal, regulatory, tax, accounting or reporting requirements. We may retain your Personal Data for longer in the event of a complaint, or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

To determine the appropriate retention period, we consider the amount, nature and sensitivity of the Personal Data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it and whether we can achieve those purposes by other means, and the applicable legal, regulatory, tax, accounting or other requirements.

By law we must keep basic information about our customers (including Contact, Profile/Identity, Billing and Transactional Data) for six years after they cease being customers, for tax purposes.

You must not use the Site, our services or the Platform unless you are aged 18 or older. If you are under 18 and you access any of them, you must stop doing so immediately.

The Site and the Platform are not intended for children, and we do not knowingly collect data relating to children.

The Site and the Platform are both hosted in the United Kingdom. However, some of the service providers listed in Section 5.1 process Personal Data in the United States, and questions you ask Thelonious Research may be processed by Google in the United States or other countries. Using our services may therefore involve the international transfer of your data.

8.1 Transfers from the UK

Where we transfer Personal Data from the UK to a country whose laws do not provide the same level of protection as UK law (such as the United States or other countries where our providers operate), we ensure an equivalent degree of protection is afforded to it through safeguards recognised under UK GDPR. These include the UK Extension to the EU–US Data Privacy Framework, where the recipient is certified under it, or the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses.

8.2 US state-specific disclosures (CCPA/CPRA)

For users based in the United States, we comply with applicable state laws:

• No sale of data: we do not “sell” your personal information to third parties, nor do we “share” it for cross-context behavioural advertising as defined by the CCPA.
• Purpose limitation: we only process your data for the business purposes set out in this policy — primarily to provide the Thelonious intelligence services.
• Sensitive data: we do not use or disclose “Sensitive Personal Information” for purposes other than those permitted by law.

We keep this Privacy Policy under review and will place any updates on this page. This version is dated 4 October 2026.

By using the Site, the Platform or our services, you acknowledge the collection and use of data by us as set out in this Privacy Policy. Continued access or use will constitute your acceptance of any modifications to it. Please check this page regularly to ensure you are aware of any changes.

It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Personal Data changes during your relationship with us — for example, if you change your email address.

All uses of the word “including” mean “including but not limited to”, and the examples in this policy are not intended to limit the terms they illustrate.

Any email addresses set out in this policy may be used solely for the purpose for which they are provided, and unrelated correspondence may not receive a response.

Unless otherwise required by law, we reserve the right not to respond to emails, even if they relate to a legitimate subject matter for which we have provided an email address. You are more likely to receive a reply if your request or question is polite and reasonable, and there is no obvious other way to deal with it (for example, our FAQs or other areas of the Site).

Our staff are not authorised to contract on our behalf, waive rights or make representations (whether contractual or otherwise) to you. Our terms, policies and any official public announcement on the Site take precedence over any communications you may receive from our staff. If anything in an email from any address linked to us contradicts this policy, our terms or any official public announcement on the Site, or is inconsistent with or amounts to a waiver of any of our rights, you should disregard it entirely, and the latter will take precedence. The only exception is genuine correspondence issued to you by a duly authorised representative of our legal department.

The Site and the Platform may include links to third-party websites, plug-ins and applications (such as legal databases, news sources or our Substack newsletter). Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave the Site, we encourage you to read the privacy policy of every website you visit.