Privacy Policy

1. Who we are

Lift Studios is operated by Intuitive AI Ltd ("Lift Studios", "we", "us", "our"), registered at The Offices, 57 Newtown Road, Hove, BN3 7BA, United Kingdom.

Lift Studios is the data controller for personal data processed through this platform. This means we determine the purposes and means of processing your personal data and are responsible for it being handled lawfully.

Contact: hello@liftstudios.app, ICO Registration: ZC108366.

Lift Studios has determined that the appointment of a Data Protection Officer is not required under UK GDPR Article 37. Privacy queries are handled directly at hello@liftstudios.app.

2. Scope of this policy

This policy applies to personal data collected and processed through:

• The Lift Studios web application (app.liftstudios.app)
• The Lift Studios marketing website (liftstudios.app)
• Any associated onboarding flows

3. What we collect and why

We collect and use personal data on the following lawful bases under UK GDPR Article 6.

3.1 To perform your contract (Article 6(1)(b))

This is data we need to deliver the AI Launchpad service you have signed up to use. Providing it is a contractual requirement: without it, we cannot create or maintain your account or deliver the service.

• Name and email address: account creation, authentication, and service communications
• Profile picture (where you sign in via Google), account display
• Journey step progress and completion dates, delivering and tracking your Launchpad experience
• Actions, milestones, and preferences: personalising your in-app journey
• Business plan answers and founder knowledge inputs: generating your AI-powered validation, planning, and brand outputs
• Brand kit selections, producing your brand outputs
• AI chat history (per user, per agent): maintaining context across your sessions
• Plan tier, managing your subscription and access
• Payment reference (not card details), reconciling payments against your account

3.2 Legitimate interests (Article 6(1)(f))

We process limited technical and operational data where we have a legitimate interest in operating the platform securely and improving it, and where that interest is not overridden by your rights.

• Session tokens, maintaining secure authenticated sessions
• Authentication logs, detecting and preventing unauthorised access
• Error and diagnostic logs, identifying and resolving technical issues
• Admin audit log entries (administrator user ID, action type, affected record, timestamp): tamper-evident record of administrative actions on accounts
• Platform usage data (login timestamps, journey step completion events, time spent per step, and which in-app actions you take, such as starting a piece of research or asking for a report to be re-run): understanding how users progress through the Launchpad to identify drop-off points, improve the product, and provide support
• IP address, before you have an account. You can use the next-step diagnostic without signing up. Each answer costs us money to generate, so we take the IP address your browser connects from, turn it into a one-way scrambled value, and store that rather than the address itself. We use it to limit how long and how often the diagnostic can be run from one device or connection, and for that purpose only: not to identify you, not to build a profile, and not for marketing. It is deleted after 30 days.
• If you then create an account, we record that the two are connected. We keep a note on that scrambled value saying which account it became, so we can tell how many people who try the diagnostic go on to sign up. That is the only thing it is used for. It is still deleted on the same 30 days as everything else above, so the connection is temporary, and we never recover your IP address from it or add it to your account.

We do not use this data for marketing, advertising, or profiling beyond the product improvement purposes described above. You can correct inaccurate account information via your account settings or by contacting us.

3.3 What we do not collect

• Passwords in plain text. If you register with email and password, your password is hashed and stored by our authentication provider. Lift Studios never sees or stores your plain-text password, and your original password cannot be recovered from our systems.
• Payment card details. All card data is handled directly by our payment processor. Lift Studios only receives a payment reference.
• Sensitive personal data as defined under UK GDPR Article 9 (e.g. health data, political opinions, ethnicity). We do not request or intentionally collect this. Please do not include sensitive personal data in your business plan answers or AI chat inputs.

4. How we protect your data

You can sign in via Google OAuth or email and password. Authentication is managed by our authentication provider.

• Google OAuth, authentication is handled by Google. Lift Studios receives only your name, email, and profile picture. We never see or store your Google password.
• Email and password, passwords are hashed and stored by our authentication provider. The plain-text password is never written to any Lift Studios storage.

After login, a JWT-based session token is stored in a cookie on your device. That cookie is HttpOnly (inaccessible to browser scripts, which prevents session theft via cross-site scripting), Secure (transmitted only over HTTPS), and has a limited lifetime after which you must re-authenticate.

Data isolation.Every API endpoint requires authentication; unauthenticated requests are rejected. Every database query is scoped to the authenticated user's own identifier by both application logic and database-level row-level security. There is no mechanism by which one user can access another user's journey progress, documents, AI conversations, or business plan answers.

Administrative access. Access to the admin dashboard is restricted to authorised Lift Studios staff by role-based permissions, enforced at both the application and database level.

Audit logging.We maintain an internal audit log of administrative actions on user accounts. This log records the administrator's user ID, the action type, the record affected, and a timestamp. It exists solely for security, integrity, and compliance purposes and is not used for profiling or marketing.

Platform analytics. We collect internal analytics data, login timestamps, session frequency, journey step completion events, time elapsed between steps, and a record of specific actions you take in the app, such as starting a piece of research or asking for a report to be re-run, stored against your user ID. We record that an action happened, not the content you write: your answers, notes and documents are never included in this data. It is used solely to improve the product and is not shared with advertising networks or used for targeted marketing.

Infrastructure. Your data is stored in a managed PostgreSQL database and accessed via a managed authentication service, both provided by our cloud database and authentication provider. The application itself is served by our application hosting provider. Both operate under industry security certifications and have signed Data Processing Agreements with us.

5. Data breach notification

Lift Studios maintains internal incident response procedures to detect, investigate, and respond to personal data breaches.

• ICO notification, where a breach is notifiable under UK GDPR Article 33, we will notify the Information Commissioner's Office within 72 hours of becoming aware, where feasible.
• User notification, where a breach is likely to result in a high risk to your rights and freedoms (Article 34), we will notify affected users directly without undue delay.
• Sub-processor breaches, our Data Processing Agreements with sub-processors require them to notify Lift Studios of any breach affecting your data within 48 hours of becoming aware.

6. Cookies

We use a single authentication cookie, as described in Section 4. This cookie is strictly necessary for the platform to function and does not require your consent under UK PECR. We do not currently use analytics cookies, advertising or tracking cookies, or third-party embedded cookies. If this changes, we will update this policy and, where required, obtain your consent before setting non-essential cookies.

6.1 Work stored in your browser

Alongside that cookie, the platform keeps a working copy of your Launchpad progress in your browser's local storage: the answers you give, the documents you generate, and how far through each stage you are. This is not a cookie and is not sent to third parties. It is held on the device you are working on so the platform responds immediately as you work, and it is backed up to your account so your progress follows you between devices.

Two consequences are worth knowing. Your work stays on any device you have used until you sign out or clear your browser data, so on a shared or public computer you should sign out when you finish. And if you hold more than one business under one account, the platform works on one at a time: the working copy in your browser belongs to whichever business is currently selected, and switching businesses saves the one you are leaving before loading the other. Because of this, the platform runs in one browser tab at a time: open it in a second tab and that tab will ask you to carry on in the first, so two tabs cannot save over each other.

You can clear this copy at any time by clearing your browser's site data for this platform, which does not delete anything already saved to your account. To delete the account-side copy, use the deletion route in Section 11.

7. Automated decision-making

The Lift Studios platform uses AI to generate outputs including business validation assessments, plans, and brand recommendations. These outputs are advisory in nature. No automated decision produces a legal or similarly significant effect on you without human review.

Where the platform generates a validation assessment (a Proceed, Pivot, or Pause verdict):

• Inputs: the answers you provide during validation, covering your business idea, target market, founder background, and readiness indicators.
• How the verdict is produced, your answers are assessed by an AI language model against a structured framework, with weights applied across business viability, founder readiness, and external threats.
• What the outcome means, a Proceed verdict indicates inputs were assessed as sufficient to move forward. A Pivot verdict indicates the idea should be reshaped, with areas identified. A Pause verdict indicates the idea is not ready, with reasons given. None of these outcomes are binding.
• What it does not affect, the validation output has no bearing on your ability to access credit, employment, insurance, or any other regulated benefit.

You have the right to request human review of any AI-generated output by contacting hello@liftstudios.app.

8. Sub-processors

We engage the following categories of sub-processors in order to deliver the service. We have Data Processing Agreements in place with each. A detailed, named list is available on request.

• Cloud database and authentication provider, stores user data and manages authentication (US)
• Application hosting provider, serves the web application (US / EEA)
• AI language model provider: powers AI reasoning, chat, validation scoring, and document generation (US)
• AI image generation provider, generates brand and marketing imagery (US / EEA)
• Payment processor, handles card payments; Lift Studios never receives card details (US)
• Transactional and marketing email provider: formats, delivers, and schedules service and product emails (US / EEA)
• Workflow automation provider, internal operational automations (US / EEA)
• Social media scheduling provider, will publish content on your behalf when social features are enabled (US / EEA)
• Error monitoring provider, captures diagnostic error information (US / EEA)
• Feature flag and experimentation provider, manages product feature rollouts (US / EEA)

Lift Studios does not share one user's data with any other user, does not sell personal data to any third party, and does not use personal data for advertising.

9. International data transfers

Several of our sub-processors are based outside the UK. Where data is transferred to countries not covered by a UK adequacy decision, we rely on the UK International Data Transfer Agreement (IDTA) or the Standard Contractual Clauses (SCCs) as the lawful transfer mechanism, or where applicable the UK Extension to the EU-US Data Privacy Framework for certified US processors.

Lift Studios conducts periodic checks to confirm that US processors relying on the UK Extension maintain an active certification status. If a processor's certification lapses, we will ensure an alternative transfer mechanism is in place before continuing to transfer personal data.

10. Data retention

We retain your personal data for as long as your account is active, and for a period of 3 years after account closure or last activity, after which it is permanently deleted.

Exceptions:

• Financial records (payment references) are retained for 7 years in line with UK accounting and tax obligations.
• Admin audit log entries are retained for 12 months from the date of creation and then permanently deleted.
• Platform analytics data is retained for the duration of your account and deleted alongside your account data.
• IP addresses recorded against an account (last sign-in address, event and error logs) are retained for 90 days and then permanently deleted.
• Scrambled IP values recorded before you have an account, used only to limit how long and how often the diagnostic can be run from one device, are retained for 30 days and then permanently deleted. If you create an account in that window we note which account the value became, so we can count how many people who try the diagnostic go on to sign up; that note is deleted on the same 30 days, and your IP address is never recovered from it or stored on your account.
• Backup data may be retained for a short additional period (up to 90 days) following deletion, after which it is purged from backup systems.

On deletion, the following is removed: your name, email, profile picture, business plan answers, journey progress, AI chat history, brand kit selections, and preferences. The following is retained where legally required: payment references (7 years) and admin audit log entries relating to your account (12 months).

11. Your rights under UK GDPR

• Access, export everything we hold about you as a JSON bundle from Settings → Data export.
• Rectification: edit your profile, ideas, and preferences in-app, or contact us for fields you cannot edit yourself.
• Erasure ("Right to be Forgotten"), delete your account from Settings → Delete account, subject to legal retention obligations.
• Restriction, ask us to pause processing of your data in certain circumstances.
• Portability: receive your data in a structured, machine-readable format (JSON).
• Object, object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at hello@liftstudios.app. We will respond within 30 days. We may need to verify your identity before processing your request.

12. Right to complain

If you have concerns about how we handle your personal data, please contact us first at hello@liftstudios.app, we will do our best to resolve the matter promptly.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113
• Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

13. Children's data

Lift Studios is intended for use by adults (18+) in a professional context. We do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided us with personal data, please contact us at hello@liftstudios.app and we will delete it promptly.

14. Changes to this policy

We may update this policy from time to time. Material changes will be notified to you by email or via an in-app notice. The "Last updated" date at the top of this page will always reflect the current version. Continued use of the platform after changes constitutes acceptance of the updated policy.

15. Contact

Lift Studios
hello@liftstudios.app
liftstudios.app
Intuitive AI Ltd, The Offices, 57 Newtown Road, Hove, BN3 7BA