Version 2026-11-11
Privacy notice
This explains what Fiveways AI does with personal data in the Fiveways AI Maturity Assessment and on this website, in plain English. If something here is unclear, email enquiries@fivewaysai.com.
1. Who we are
Fiveways Ventures Ltd, trading as Fiveways AI (“Fiveways”, “we”), is the controller of the personal data described here. Registered in England and Wales, company number 09791922. Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. Contact: enquiries@fivewaysai.com.
2. Who this covers
Organisers are the managers who sign up and set a survey up. Respondents are the colleagues who answer it. Call bookers are people who book an introduction call with us. Snapshot users are people who take the AI Snapshot, a short check anyone can try without signing up. We treat respondents differently from everyone else, because their answers are designed so that nobody can tell who said what, and we never research them.
3. What we collect, why, and on what basis
| Who | What | Why | Lawful basis |
|---|---|---|---|
| Organiser | Name, work email, job title, organisation, the department or team the assessment covers (if not the whole organisation), its size, sector, goals, when and how you agreed to the terms and to be contacted, how you found us | Create your account, run your assessment, send your report, and follow up with you about our services | Contract (running the service you asked for). Legitimate interests (contacting a business contact about related services) |
| Organiser | Sign-in and security records | Keep accounts secure and prevent misuse | Legitimate interests |
| Respondent | Survey answers: tools used, how they are used, practices and attitudes, and (only in larger companies) department and seniority band | Produce combined results for the organiser | Legitimate interests (a benchmarking service we offer) |
| Respondent | Work email, only if the organiser limits the survey to company email addresses | Check that you work at the organisation, by sending you a one-time code | Legitimate interests |
| Snapshot user | Nothing, unless you ask for your result by email. Then your email address, the stage and the two areas shown in your result, and a note of when you asked. We do not keep your answers to the eight questions | Send you your result once, and let the Fiveways team follow up with you personally about it | Your request (sending the result you asked for). Legitimate interests (one personal follow-up about it). There is no mailing list |
| Clients and prospective clients | Notes of meetings and calls we hold with you: the date, who attended, and the summary and agreed actions from our note-taking tool. A list of the documents we prepare for you, and whether we have shared them with you | Prepare for and follow up on our conversations, do the work you ask for, and keep an accurate record of it | Legitimate interests (managing a business relationship). Contract, once we work together |
| Anyone | Optional feedback you type into our feedback form | Improve the service | Legitimate interests |
| Website visitors who choose Accept | A random identifier held in a cookie, which public pages of this website you read and when, and where your first visit came from (another website or a campaign tag). If you then sign in to the assessment, or open a personal link we sent you, or ask for your AI Snapshot result by email, we connect these visits to your contact record | Understand what interests you, so our conversations with you are relevant | Consent. You can withdraw it at any time from Cookie settings at the foot of every page |
| Website visitors | Technical data such as IP address, browser type and pages requested, held briefly in hosting logs | Keep the site secure and working | Legitimate interests |
We do not ask respondents for their name, and we do not store an IP address, device identifier or exact time with their answers.
4. How respondents stay anonymous
- Only combined results are shown, and only to the organiser and the Fiveways team. The organiser may choose to share the combined report with others at their company.
- No result is shown for a group of fewer than 5 people. In smaller companies (under 20 people) we do not ask for department or seniority at all.
- The organiser sees combined results only once at least 10 people have answered (6 in a small team). If results are shown while the survey is open, they refresh only after every 5 more answers, so comparing two looks never shows one person’s answers. The Fiveways team may check a report before releasing it to the organiser, in which case results are shared only after the survey closes.
- We never contact respondents and never use their answers for marketing.
- Tool names that respondents type in may be added to our shared list of AI-enabled tools, with nothing linking them to a person or company.
- Because answers are not linked to a name, we usually cannot find one person’s answers if you ask. We explain this under your rights below.
5. Limiting a survey to company email addresses
An organiser can limit a survey to people with a work email at up to five company domains. If they do, you type your work email, we send you a one-time code, and you enter it. We use your email once, to send the code. We do not keep it and it is never linked to your answers. If the organiser also turns on “one answer per email”, we keep a scrambled (keyed, one-way) copy of your email so the same address cannot answer twice. That copy records that someone took part, not what they said. It has no time on it and is deleted with the answers.
6. How we use AI, and research before we speak to you
Respondents. Nothing about respondents is ever sent to an AI service in a way that could identify them. Scores and stages are calculated by fixed rules, not by AI.
Organisers and call bookers. When you launch a survey or book a call, we prepare for talking to you by researching publicly available professional information about you and your organisation. This can include your role and career history, articles, talks, interviews and press quotes, and your organisation’s activities, size, ownership, news, job adverts and Companies House records, together with the combined, anonymous results of your survey and any notes you gave when booking. We use Anthropic’s Claude, with web search, to gather and summarise this into a short private briefing for us, and to check whether an enquiry is a genuine business enquiry.
We only look at professional information. We do not collect home addresses, family details, health, political or religious views, or personal social media, and we do not read pages behind a login (such as LinkedIn profiles) or scrape sites against their terms. The briefing is private to Fiveways, is never sent to you or anyone else, and no decision with a legal or similar effect is made about you. Our lawful basis is legitimate interests: preparing for a conversation you asked for. You can object, or ask us to delete the briefing, at any time by emailing enquiries@fivewaysai.com. We do not use your data to train AI models, and Anthropic does not use it to train its models.
Meetings and follow-up. We use a note-taking tool, Granola, in some meetings and calls. It transcribes the conversation and writes a summary. We copy only the summary, the agreed actions, who attended and the date into our records; the full transcript stays in Granola. The Fiveways team can ask Claude questions about our private briefing, our meeting notes and the documents we have prepared for you, and, when the answer is not there, Claude can run a further search of public professional information under the same limits as above. You can ask us not to use the note-taker in a meeting with you, or to delete our notes, at any time.
7. Who else handles the data
We use these providers to run the service. They act on our instructions.
- Vercel: website hosting, and cookie-free visit statistics for the website (Vercel Web Analytics). Survey pages, shared reports and the back office are not included.
- Plausible Analytics: statistics for the public pages of this website, from an EU company with its data held in the EU. It runs without cookies, stores nothing in your browser, does not keep IP addresses and does not build a profile of you. It receives the pages read, where the visit came from (another website or campaign tags on a link), the country, device type and browser, and the AI Snapshot steps described in section 11. Survey pages, reports, signed-in pages and the back office never use it; from surveys it receives only anonymous counts of how many people reach each step, sent by our server with nothing about the person.
- Supabase: our database, in Ireland.
- Cal.com: booking introduction calls. When you book, Cal.com receives the name, email address and any notes you enter, and checks our calendars for free times. Cal.com then sends us those booking details, which we keep in our business records so we can prepare for and follow up on the call.
- Resend: sending emails such as sign-in links and one-time codes, from an EU region. It keeps short-term delivery logs.
- Anthropic: the AI (Claude) that researches public professional information about organisers and call bookers and writes our private briefings (see section 6). It is never given anything that identifies a survey respondent.
- Companies House: the UK public register of companies, which we search for information about your organisation.
- Granola: our meeting note-taking tool, which transcribes meetings it is used in and writes a summary. We keep only the summary, agreed actions, attendees and date in our records.
- Google: Google Drive, where we keep the documents and presentations we prepare for clients. Our records hold only each document’s name, link and whether it is shared with you.
- Cloudflare: our domain and a bot check (Turnstile) that sees visitors’ IP addresses.
- Slack: short internal notifications to the Fiveways team, such as a new sign-up or a booked call, with the person’s name, work email and company. Survey answers and anything that could identify a respondent are never sent.
- GitHub: our code and issue tracker. No personal data is put in it.
Some of these companies are based in, or operate from, the United States. Where personal data goes outside the UK we rely on the safeguards the providers offer, such as the UK addendum to standard contractual clauses or the UK–US data bridge. We do not sell personal data.
8. How long we keep it
- Individual survey answers: deleted about 90 days after the survey closes.
- Reports: kept, and available to you whenever you sign in, until you delete your account.
- Anonymous benchmarks: for each finished survey we keep the overall scores, combined percentages, sector, size band and month, with no company name and nothing that links them to a company or to anyone who answered. They are kept indefinitely, so organisations can be compared, and are not personal data.
- Organiser account and contact details: until you delete your account (see below).
- Call bookings, contact records, research briefings, meeting notes and document lists: 12 months if we do not go on to work together, then deleted. If we do work together, for as long as the relationship lasts.
- Feedback: up to 12 months.
- Website visit records (only if you chose Accept): 12 months after your last visit, then deleted. Choosing Reject in Cookie settings deletes them straight away.
- Participation records (only with “one answer per email”): deleted with the answers.
- One-time codes: minutes, then deleted.
- Technical logs: kept briefly by our hosting providers, normally about 30 days.
9. Deleting your account
Organisers can delete their account at any time from their account page. We remove your sign-in, company details, surveys, answers, reports and any record of the pages you read on this website, and any view-only links you shared stop working. We keep a record of your sign-up contact details (your name, work email, job title and company) in Fiveways’ business records so we can contact you about the survey. We also keep a count of the sign-up that does not identify you, and a scrambled copy of your email address so that we do not send you marketing. You can ask us to delete the contact record too by emailing enquiries@fivewaysai.com.
10. Your rights
You can ask us to show you your data, correct it, delete it, restrict or stop our use of it, or give you a copy. You can object to us contacting you at any time, and every marketing email has an unsubscribe link. Email enquiries@fivewaysai.com and we will reply within one month. Because survey answers are not linked to a name, we may not be able to find a particular respondent’s answers; if so we will tell you why. If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk.
11. Cookies and remembering your visits
We use the cookies and similar storage needed to sign you in, keep the survey working and run the bot check. These are always on, because the site cannot work without them.
On the public pages of this website we also ask whether we may remember your visits. If you choose Accept, we set a cookie holding a random identifier and record which of these pages you read and when, and where your first visit came from. On its own this does not tell us who you are. We only connect it to you if you sign in to the AI Maturity Assessment, ask for your AI Snapshot result by email, or open a personal link we sent you, in the same browser. We use it to understand what interests you before we speak; we do not share it, sell it or use it for advertising, and nothing is tracked on other websites. The cookie lasts 12 months.
If you choose Reject, nothing is recorded. You can change your mind at any time from Cookie settings at the foot of every page; choosing Reject then deletes everything recorded about your visits. Survey pages, reports, shared report links and signed-in pages are never recorded, and survey respondents are never identified this way.
Separately, our website statistics (Plausible, and Vercel’s page counts) use no cookies and nothing stored in your browser, and do not follow you across visits or other websites: pages read, where visitors came from, country and device type, and how fast pages load. In a survey we only count how many people reach each step and the average time spent on it, so we can make the survey easier to finish; nothing is recorded per person and it is never linked to answers. Our server also sends these step counts to Plausible, with nothing about the person.
The AI Snapshot works the same way. We count, without identifying anyone, how many people start it, how far they get, which stage is shown and whether they go on to the AI Maturity Assessment. Your answers stay in your browser and are not recorded. If you ask for your result by email and have chosen Accept, we also connect your visits to your contact record, as described above.
12. Changes
We will update this notice when what we do changes, and show the version date at the top.