Achi Privacy Policy
Last updated: 11 October 2026
This Privacy Policy explains how Dormot Technologies Ltd collects, uses, shares and protects personal data in connection with Achi, our AI-assisted business process platform at achiai.com and app.achiai.com (the "Service"), and the rights you have.
1. Who we are
Achi is provided by Dormot Technologies Ltd, a company registered in England and Wales (company number 15927545), registered office 53 John Barnes Walk, London, England, E15 4SY ("Dormot", "we", "us", "our").
Contact for privacy matters: hello@achiai.com. Our privacy lead is Eldred Green, CEO. We have not appointed a Data Protection Officer because we are not currently required to.
2. Our role: controller and processor
We handle personal data in two different capacities:
(a) As a controller. We decide how and why personal data is used for:
- visitors to our websites;
- people who sign up for, or are invited to use, the Service ("Users"), including account owners and administrators;
- billing and finance contacts at our customers;
- people who contact us for sales, support or other enquiries, or who receive our marketing; and
- usage, technical and security information about how the Service is used.
This Privacy Policy mainly covers this processing.
(b) As a processor. Our customers (businesses and organisations) use the Service to build and run their own processes, and may put personal data into it, for example form submissions, uploaded documents, workflow records, approvals and the people named in them ("Customer Content"). For that personal data, the customer is the controller and we process it only on the customer's instructions, under our Terms of Service, including the Data Processing Terms in Schedule 1 (the "DPA"). If your personal data has been put into Achi by an organisation (for example your employer or a business you deal with), please read that organisation's privacy notice and contact it to exercise your rights. If you contact us, we will pass your request to the relevant customer where we can identify it.
3. Personal data we collect
Information you give us
- Account and profile data: name, work email address, job title or role, organisation name, password (stored in hashed form) or sign-in credentials, user permissions and preferences.
- Billing data: billing contact details, company address, VAT number, plan and subscription details, and payment records. Payment card details are collected and processed directly by our payment provider, Stripe; we do not see or store full card numbers. We receive limited information from Stripe such as customer and subscription identifiers, payment status, card type, last four digits and expiry date.
- Communications: messages, support requests, feedback, survey responses and records of calls or meetings with us.
- Marketing and enquiries: details you give us when you request a demo or early access, attend an event, or sign up for updates.
Information collected automatically
- Usage data: features used, actions taken, pages viewed, timestamps, AI credit consumption, error and performance logs.
- Device and technical data: IP address, browser type and version, device and operating system, approximate location derived from IP address, and referring URL.
- Security data: sign-in events, session data, and logs of account activity.
- Cookies and similar technologies: see section 11.
Information from others
- From the customer that invites you to the Service (for example your name and work email).
- From Stripe (payment status and related information described above).
- From publicly available business sources, where we research potential business customers.
Customer Content (processed as processor; see section 2(b)): content Users upload or create in the Service, prompts and instructions given to the AI Features, and AI-generated output.
We do not intend to collect special category data about Users. Customers decide what Customer Content they put into the Service.
4. How we use personal data and our lawful bases
Under UK data protection law (and the EU GDPR where it applies) we must have a lawful basis for using personal data. We rely on the following:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Create and administer accounts; provide the Service to Users; authenticate Users | Account and profile data; usage, device and security data | Contract (where you are the customer or a party to the agreement); otherwise legitimate interests in providing the Service our customer has bought for its Users |
| Process payments, manage subscriptions, invoicing and collection | Billing data; account data | Contract; legal obligation (tax and accounting records) |
| Run the AI Features you request (see section 5) | Prompts and relevant Customer Content (as processor); account and usage data | For Customer Content: on the customer's instructions as processor. For our own data: contract / legitimate interests |
| Provide customer support and respond to enquiries | Communications; account and usage data | Contract; legitimate interests in responding to people who contact us |
| Keep the Service and our users secure; prevent fraud and abuse; enforce our Terms | Security, usage and device data; account data | Legitimate interests in protecting our Service, customers and business; legal obligation where applicable |
| Operate, maintain and improve the Service, including analytics using aggregated, de-identified Usage Data (not Customer Content) | Usage and device data | Legitimate interests in understanding how the Service is used and making it better |
| Send service and administrative messages (for example about billing, security or changes to our terms) | Account and billing contact data | Contract; legitimate interests; legal obligation where applicable |
| Business-to-business marketing about Achi to customers and business contacts | Name, work contact details, organisation, marketing preferences and interactions | Legitimate interests in promoting our business, or consent where required by law (for example for marketing emails to individuals who are not existing customers). You can opt out at any time |
| Non-essential cookies and similar technologies | Cookie and device data | Consent |
| Comply with law, respond to lawful requests, establish or defend legal claims | Any relevant data | Legal obligation; legitimate interests |
| Corporate transactions (for example a reorganisation or sale of our business) | Any relevant data | Legitimate interests |
Where we rely on legitimate interests, we have considered that those interests are not overridden by your rights and interests. You can ask us for more information, and you can object (see section 9).
5. How the AI Features use data
- What happens. When a User asks Achi's AI Features to do something (for example suggest a form, draft a document, build a workflow or summarise a submission), we send the User's prompt and the relevant context needed for that task (which may include parts of Customer Content) to an AI model to generate a response. We use a model-routing service (OpenRouter) to send requests to underlying AI model providers.
- AI proposes; humans decide. AI output is a proposal or draft for a User to review. Achi is designed so that material or irreversible actions require confirmation by an authorised User. Achi does not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Customers are responsible for how they use AI output in their own decisions.
- No training on Customer Content. We do not use Customer Content, including prompts and AI output, to train or fine-tune AI models, whether ours or anyone else's.
- Retention by AI providers. Third-party AI providers process Customer Content to generate responses for you and, under their terms with us, may retain it for a limited period for abuse monitoring. We keep a record of AI conversations within your organisation's Account as part of Customer Content so that Users can see their history.
- Product improvement. We may use aggregated, de-identified Usage Data (for example how often features are used, error rates and credit consumption), which does not include the substance of Customer Content, to operate and improve the Service.
6. Who we share personal data with
We do not sell personal data, and we do not share it with third parties for their own marketing.
We share personal data with:
- Service providers (sub-processors) who help us run the Service, under contracts that require them to protect it and use it only on our instructions. Our current key providers are:
| Provider | Purpose |
|---|---|
| Supabase | Database, authentication and file storage |
| Vercel | Website and application hosting |
| OpenRouter | Routing of AI requests to AI model providers |
| AI model providers accessed via OpenRouter | Generating AI output for the AI Features |
| Stripe | Payment processing, subscription billing and fraud prevention (Stripe also acts as an independent controller for some processing, under its own privacy policy) |
| Resend | Sending transactional and service emails |
| Analytics providers | Website and product analytics |
The Service is hosted with Supabase and Vercel. Some of these providers process data outside the UK; see section 7.
We will keep this list up to date, and will notify customers of new sub-processors as described in the DPA.
- Our customers: if you are a User, the customer that owns the Account (and its administrators) can see information about your use of the Service, such as your profile and activity.
- Professional advisers: lawyers, accountants, auditors and insurers, under duties of confidentiality.
- Authorities: law enforcement, regulators, courts or other public bodies where we are required by law, or where reasonably necessary to protect our rights, our customers or others.
- Successors: a buyer, successor or group company in connection with a reorganisation, merger, sale or transfer of all or part of our business, subject to this Privacy Policy.
7. International transfers
We are based in the UK, but some of our service providers may process personal data in other countries outside the UK and European Economic Area (EEA), which may include the United States. Some of these countries may not have data protection laws equivalent to those in the UK.
Where we transfer personal data outside the UK (or, where the EU GDPR applies, outside the EEA), we make sure an appropriate safeguard is in place, such as:
- a UK adequacy regulation (or EU adequacy decision), including the UK Extension to the EU–US Data Privacy Framework where the recipient is certified; or
- the UK International Data Transfer Agreement (IDTA), or the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, and for EU data the EU Standard Contractual Clauses, together with any additional measures needed.
You can ask us for more information about the safeguards we use by contacting us (section 13).
8. How long we keep personal data
We keep personal data only for as long as we need it for the purposes described in this policy, including to meet legal, accounting and reporting requirements.
| Data | Retention period |
|---|---|
| Account and profile data | For as long as the Account is active, then deleted as described below |
| Customer Content (processor data) | For as long as the customer's subscription is active, and as instructed by the customer. After a paid subscription ends: 30 days for the customer to export, then deleted from active systems within a further 30 days |
| Expired free Trials (not converted to paid) | Customer Content retained for a limited period after the Trial ends, after which it is deleted |
| Backups | Deleted or overwritten in the normal rolling backup cycle |
| Billing and transaction records | 6 years after the end of the financial year to which they relate, to meet UK tax and accounting rules |
| Security and access logs | Up to 12 months |
| Support and enquiry records | Up to 3 years after the last contact |
| Marketing data | Until you opt out or after 2 years of no engagement; we keep a suppression record so that we respect your opt-out |
| Data needed for legal claims | For as long as necessary to establish, exercise or defend the claim |
Where we no longer need personal data, we delete it or anonymise it so that it no longer identifies anyone.
Closing an account. An Account owner can request account closure and deletion by contacting us at hello@achiai.com. We will verify the request, give the organisation the opportunity to export its data, delete data in line with the table above, and confirm when deletion is complete.
9. Your rights
Under UK data protection law (and the EU GDPR where it applies), you have the following rights, subject to some conditions and exceptions:
- Access: to receive a copy of the personal data we hold about you.
- Rectification: to have inaccurate or incomplete data corrected.
- Erasure: to have your data deleted in certain circumstances.
- Restriction: to ask us to limit how we use your data in certain circumstances.
- Objection: to object to processing based on our legitimate interests, and to object at any time to direct marketing.
- Portability: to receive data you have provided to us in a structured, machine-readable format, or have it sent to another organisation, where processing is based on contract or consent and carried out by automated means.
- Withdraw consent: where we rely on consent, you can withdraw it at any time. This does not affect processing already carried out.
- Automated decision-making: not to be subject to decisions based solely on automated processing that have legal or similarly significant effects on you. We do not make such decisions about Users.
To exercise any of these rights, contact us at hello@achiai.com. We may need to verify your identity. We will respond within one month, which may be extended by up to two further months for complex or numerous requests, in which case we will tell you. We do not usually charge a fee.
If your request relates to Customer Content (where we are a processor), we will refer it to the relevant customer, and help that customer respond.
You can unsubscribe from marketing emails at any time using the unsubscribe link or by replying to the email.
10. Security
We use technical and organisational measures appropriate to the risk to protect personal data, including industry-standard measures such as encryption in transit and at rest, access controls and the logical separation of each customer's data. Access to personal data within Dormot is limited to people who need it for their role.
No method of transmitting or storing data is completely secure. If we become aware of a personal data breach, we will take steps to contain it and, where required by law, notify the Information Commissioner's Office, affected customers and affected individuals. Please help us by using a strong, unique password and telling us promptly at hello@achiai.com if you suspect any security issue.
11. Cookies and similar technologies
We use cookies and similar technologies on our websites and in the Service. Strictly necessary cookies are needed for sign-in, security and core features and do not require consent. We only use analytics or other non-essential cookies with your consent, where the law requires consent. For details of the cookies we use and how to manage them, see our Cookie Policy at achiai.com/cookie-policy. You can manage cookies through your browser settings; see our Cookie Policy.
12. Children
The Service is designed for businesses and is not intended for anyone under 18. We do not knowingly collect personal data from children as Users. If you believe a child has given us personal data, please contact us and we will delete it.
13. Contact us and complaints
If you have any questions about this Privacy Policy or how we use personal data, or wish to exercise your rights, please contact:
Dormot Technologies Ltd (Achi)
53 John Barnes Walk, London, England, E15 4SY
Email: hello@achiai.com
You have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk/make-a-complaint or on 0303 123 1113. If you are in the EU or EEA, you may also complain to the data protection authority in your country. We would appreciate the chance to deal with your concern first, so please contact us before going to the regulator.
14. Changes to this Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version on this page and change the "Last updated" date. If we make material changes, we will notify Account owners by email or in the Service before the changes take effect.