Artificial Societies Ltd is a company incorporated in England and Wales (company number 15963818), with its registered address at 5 New Street Square, London, EC4A 3TW. We are a wholly owned subsidiary of Societies, Inc., a corporation registered in Delaware, USA.
This Privacy Policy explains how we collect, use, disclose, and protect information when you:
If you are a customer using our Platform under a Statement of Work, the Terms of Service (available at https://societies.io/terms-of-service) contain additional provisions regarding data protection, including our obligations as a data processor. In the event of any conflict between this Privacy Policy and the Terms of Service, the Terms of Service shall prevail for Platform users.
We act in two distinct capacities depending on the processing activity:
Data Controller. Artificial Societies Ltd is the data controller for: (a) the personal data we collect about website visitors, prospective customers, and Platform customers as described in Sections 2.1–2.3; and (b) the publicly available personal data we collect and process to build and maintain our AI persona models, as described in Sections 2.5 and 2.6.
Data Processor. When customers submit data to our Platform for Simulations (including prompts, audience configurations, and bespoke content) ("Customer Data"), we process this data on behalf of the customer, who remains the data controller. Please refer to Section 8 of our Terms of Service for full details of our data processing obligations.
When you visit our website, we may collect:
We use cookies and similar technologies to collect analytics data. You can manage your cookie preferences through our cookie banner or your browser settings. For more information, please see our Cookie Policy at https://societies.io/cookie-policy.
When you inquire about our services, we collect:
When you become a customer, we collect:
Our Platform enables customers to run Simulations using synthetic audiences. When customers provide data for Bespoke Societies or Simulations ("Customer Data"), we process this data on behalf of the customer as a data processor. The customer remains the data controller for Customer Data. Please refer to Section 8 of our Terms of Service for full details of our data processing obligations.
To build and maintain the AI persona models that power our Platform, we collect and process information that has been manifestly made public by individuals on open social media platforms and professional networks. We act as the data controller for this processing activity.
The categories of publicly available data we may collect include:
We do not collect:
This data is used solely to construct synthetic AI personas that simulate behavioural patterns, sentiment, and preferences of market segments. The personas operate within a closed simulation environment. They are not used to make automated decisions about individuals, and we contractually prohibit customers from using simulation outputs to target, contact, or make decisions about identifiable individuals.
In certain use cases, our Platform may process the publicly available data of public figures (such as senior executives, elected officials, public commentators, and recognised industry leaders) without pseudonymisation, where the identity of the individual is material to the research objective.
Public figures have a reduced expectation of privacy regarding their professional activities and public statements. This principle is established in European human rights case law and is reflected in GDPR Recital 47. We process public figure data under the same legal basis (Legitimate Interest, Article 6(1)(f)) with the following additional safeguards:
Further detail is provided in our Legitimate Interest Assessment, available on request.
We use the information we collect to:
We do not use Customer Data (including simulation prompts, input parameters, and bespoke audience configurations) to train foundational AI models unless explicitly agreed in writing with the customer.
Under UK GDPR, we rely on the following legal bases for processing personal data:
Processing is necessary to perform our contract with you or to take steps at your request before entering into a contract. This applies to customer account management, service delivery, and billing.
Processing is necessary for our legitimate interests, provided these are not overridden by your rights. Our legitimate interests include:
Balancing test: We have conducted a Legitimate Interest Assessment for the collection and processing of publicly available data. This assessment concludes that our interest in providing market intelligence through behavioural simulation is not overridden by the rights and freedoms of the individuals concerned, given that: (a) the data is limited to information manifestly made public by the individual; (b) the processing occurs within a closed simulation environment with no real-world consequences for the individual; (c) we do not make or enable automated decisions about individuals; and (d) individuals may object to the processing at any time (see Section 8). For public figures, the balancing test weighs more favourably given their reduced expectation of privacy regarding professional activities. A copy of this assessment is available on request.
Where we rely on consent, you have the right to withdraw it at any time. We will seek consent for specific activities where required, such as marketing communications.
Processing is necessary to comply with our legal obligations, including tax records, regulatory requirements, and responding to lawful requests from authorities.
We do not use automated decision-making or profiling that produces legal or similarly significant effects concerning you. Our AI technology is used solely to generate synthetic personas and simulation results for research purposes.
We may share your information with:
Third parties who provide services on our behalf, including:
A full list can be found at societies.io/subprocessors.
These providers are contractually bound to protect your information and may only use it to provide services to us.
Our legal, accounting, and other professional advisors as necessary for the operation of our business.
Authorities or other third parties when required by law, court order, or regulatory request, or to protect our rights, property, or safety.
In connection with any merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.
We do not sell your personal data or share it with third parties for their advertising purposes.
Your information may be transferred to and processed in countries outside the United Kingdom, including the United States (where our parent company, Societies, Inc., is located) and other countries where our service providers operate.
When we transfer personal data outside the UK or EEA, we ensure appropriate safeguards are in place, including:
We have conducted a Transfer Risk Assessment evaluating the risks to personal data when it is processed by US-based sub-processors. This assessment concludes that the combination of contractual, technical, and organisational safeguards in place ensures an essentially equivalent level of protection to that guaranteed under UK GDPR. A copy of this assessment is available on request.
For Platform customers, please refer to Section 8.8 of our Terms of Service for specific provisions regarding international data transfers.
We retain personal data for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting, or reporting requirements.
| Data Type | Retention Period |
|---|---|
| Business contact data (customers) | Duration of relationship + 6 years |
| Inquiry data (prospective customers) | 3 years from last contact |
| Platform usage data | Duration of subscription + 1 year |
| Analytics data | 2 years |
| Publicly available persona data | Duration of active use in platform models; deleted or refreshed when no longer required, or upon valid objection/erasure request |
For Customer Data processed on behalf of customers, retention is governed by the Terms of Service (Section 6.4).
Under UK GDPR, you have the following rights regarding your personal data:
You may request a copy of the personal data we hold about you.
You may request that we correct inaccurate or incomplete personal data.
You may request that we delete your personal data in certain circumstances.
You may request that we restrict the processing of your personal data in certain circumstances.
You may request to receive your personal data in a structured, commonly used, machine-readable format.
You may object to processing based on legitimate interests or for direct marketing purposes.
If you are an individual whose publicly available data has been used to build our AI persona models, including public figures, you have the right to object to this processing at any time. Upon receiving a valid objection, we will cease processing your data and remove it from our models unless we can demonstrate compelling legitimate grounds that override your interests.
Where processing is based on consent, you may withdraw that consent at any time.
You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at https://ico.org.uk if you believe your rights have been violated.
To exercise any of these rights, please contact us at support@societies.io, or use the links below to submit a formal request:
We implement appropriate technical and organisational measures to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include:
Our security posture has been independently verified through a SOC 2 Type I examination (January 2026), with a Type II audit currently in progress.
For Platform customers, additional security measures are described in Section 8.4 of our Terms of Service.
We may update this Privacy Policy from time to time. When we make material changes, we will:
We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.
Our services are intended for business use only. We do not knowingly collect personal data from anyone under 18 years of age. If you believe we have inadvertently collected data from a minor, please contact us immediately at support@societies.io and we will take steps to delete such information.
If you have any questions about this Privacy Policy or our data practices, please contact us:
| Company Name | Artificial Societies Ltd |
| Address | 5 New Street Square, London, EC4A 3TW |
| support@societies.io | |
| Data Protection Contact | Tom Whittle, CTO |
Version 2.0
Last Updated: 18 March 2026