Privacy should be understandable before it is legal text.

Sarlo is currently operated in the United Kingdom as a closed-alpha product. For this closed alpha, Sarlo (operator of sarlo.ai) acts as the data controller for personal data processed through the service.

Privacy questions and rights requests can be sent to hello@sarlo.ai. If the legal entity operating Sarlo changes before wider release, this notice will be updated before that change applies to users.

• Account information: email address, account identifiers and authentication/security records.
• Information you submit: text, screenshots or other supported inputs you deliberately give Sarlo during the alpha.
• Structured information Sarlo creates: extracted dates, rota entries, corrections, confidence/uncertainty information and history needed to provide the feature being tested.
• Usage and technical information: request timing, model/API usage, error identifiers, security events and technical logs needed to operate, protect and improve the alpha.
• Support communications: information you choose to include when contacting Sarlo.

• Provide the service: authenticate invited users, process chosen inputs, save confirmed information and return useful answers.
• Keep the service secure: enforce account boundaries, investigate errors or misuse and protect the service.
• Improve closed-alpha quality: measure failures, model usage and product reliability so the tested behaviour can be corrected.
• Communicate with you: send account emails, respond to support questions and provide important service information.

Depending on the processing, Sarlo relies on performing the service you asked to use and legitimate interests in operating, securing and improving the closed alpha. Where consent is specifically required for a future optional activity, it should be requested separately rather than assumed.

Sarlo uses specialist service providers to operate the closed alpha. Current core categories include:

Support email may also pass through the email service used for the Sarlo business mailbox. Providers are used for defined operational purposes rather than to sell your personal data.

Some technology providers may process data in countries outside the United Kingdom. Where a restricted international transfer of UK personal data is involved, Sarlo requires an appropriate lawful transfer mechanism or safeguard, such as an adequacy arrangement or approved contractual protections where applicable.

You can ask for more information about relevant transfer safeguards by emailing hello@sarlo.ai.

Closed-alpha data is kept only while it is reasonably needed to provide and test the service, maintain account continuity, investigate security or reliability issues, satisfy legal requirements and complete normal backup/recovery cycles.

Because the product is still in closed alpha, retention is currently governed by these criteria rather than a single duration for every category. More specific retention schedules will be published before wider public registration where appropriate.

UK data-protection rights can include access, correction, erasure, restriction, objection and data portability, depending on the circumstances and lawful basis. You may also withdraw consent where a particular processing activity relies on consent.

To exercise a right, email hello@sarlo.ai. You also have the right to complain to the UK Information Commissioner's Office (ICO) if you believe your data-protection rights have been infringed.

Sarlo uses AI to help interpret supported inputs, but the closed alpha is not designed to make solely automated decisions that have legal or similarly significant effects on you. A central product requirement is to surface material uncertainty and allow correction rather than silently treating uncertain model output as fact.

The current public site does not intentionally use advertising cookies or cross-site advertising trackers. Hosting, authentication and security infrastructure may use strictly necessary technical storage or cookies to deliver and protect the service.

If optional analytics or other non-essential tracking is introduced later, the public notice and any required consent controls will be updated before that use begins.