Version 2026-10-02 · Effective 2 October 2026
Squidgy is a platform businesses use to build and run AI agents. "Squidgy", "we" and "us" mean 4142 Ltd, a company registered in England and Wales (company number 16433875), registered office 20 Wenlock Road, London, England, N1 7GU, trading as Squidgy. The Services are for business use only.
This notice explains how we handle personal data when you visit squidgy.ai, use the Squidgy app, or are otherwise in contact with us. Questions or requests: privacy@squidgy.ai.
As a controller, we decide how and why we use: account and profile data, billing data, website and app usage data, communications with us, and our own marketing and sales contacts. This notice explains that processing.
As a processor, we handle the content our business customers put into the platform on their behalf: their conversations with agents, uploaded files, knowledge bases, and the details of their own leads, customers and contacts. For that data our customer is the controller, and our Data Processing Agreementgoverns what we may do with it. If you are one of our customers' contacts, or you are talking to an agent a business runs on Squidgy, that business's privacy notice applies and you should contact them first; we will help them respond.
If you hold your own account, "contract" above means our contract with you. If you use Squidgy as a member of an organisation's account, we process your account and usage data on the basis of our legitimate interests in providing the Services that organisation has contracted for, and in keeping them secure.
At signup we ask you to acknowledge that your content will be processed by AI services. That is an acknowledgement of how the Services work, not consent in the data protection sense. Our basis for AI processing is our contract with you, because the Services cannot work without it.
When you or your users send a message to an agent, the message and the context the agent needs (such as conversation history and relevant knowledge-base extracts) are sent to an AI model to generate a reply. We route most requests through OpenRouter, an AI gateway, to models from Anthropic, OpenAI, Google, DeepSeek, Moonshot AI, Alibaba (Qwen) and Meta. Some features call OpenAI directly, for example for speech and image understanding. Which model handles a request depends on the agent. The full list, with locations, is on our sub-processor page.
Model providers receive content only to generate the response. We do not use your content to train AI models, and we do not sell it. Model providers operate under zero data retention, and we have switched off every option that would let them use content for training. China-based hosting providers are excluded, except that Moonshot AI (Kimi) models, used by a few agents, may still be served by Moonshot AI. Customers who need it can have their AI processing kept on EU infrastructure. Section 10 explains how we protect international transfers.
Squidgy does not itself make decisions about individuals based solely on automated processing that have legal or similarly significant effects. Businesses that configure agents are responsible for how they use them. Our terms prohibit using agents for that kind of decision-making without our agreement and appropriate safeguards.
On squidgy.ai, our analytics (PostHog) and marketing attribution (HighLevel) load only after you accept them in the cookie banner, and you can change your choice at any time. If you submit an enquiry form, the details you enter are sent to HighLevel, our CRM, so we can respond, whether or not you accepted marketing cookies.
In the Squidgy app, optional technologies also run only with your consent, which you give or refuse in the app's cookie banner and can change at any time from "Cookie settings" in your account menu. With analytics consent, PostHog records sessions: the pages you view, how you interact with them, and text displayed on screen, which can include your conversations with agents, plus browser console logs. Text you type into input fields is masked. With marketing consent, Google Tag Manager loads advertising measurement tags from Meta, TikTok and LinkedIn. Those companies receive information about your visit, such as pages viewed and their own identifiers, and use it under their own privacy policies. We are joint controllers with each of them for collecting and sending that information. The essence of the arrangement is the same for all three: we decide to use the tag on our app and are responsible for telling you about it, asking for your consent before it runs, and stopping it if you withdraw; each company is responsible for what it does with the data once it receives it, including your rights over that data. Meta sets this out in its Controller Addendum, and TikTok in the jurisdiction-specific terms to its Business Products (Data) Terms; LinkedIn's position is governed by its advertising terms. You can ask us for copies at privacy@squidgy.ai. You can exercise your rights with us or with the company directly, and we will pass on any request we receive. Details are in our Cookie Policy.
We do not sell personal data. We share it with our service providers, listed on our sub-processor page, who process it for us under contract: hosting and databases (Vercel, Render, Supabase, Neon, DigitalOcean), AI models (section 5), payments (Stripe), analytics (PostHog, Google Tag Manager), messaging (Resend, Twilio), CRM (HighLevel), internal notifications and issue tracking (Roam, Linear), and providers behind specific features. Integrations you connect, such as Google, Meta or Slack, receive data because you direct it, under their own terms. If you allow marketing cookies in the app, Meta, TikTok and LinkedIn receive information about your visit as described in section 6.
We may also share data with professional advisers, with authorities where the law requires it, and with a buyer or successor if our business or a brand is reorganised or sold. Our Terms of Service allow us to transfer customer agreements to a successor company operating a Squidgy brand; if that happens, we will tell you first.
We use encryption in transit, providers that encrypt data at rest, access controls, and a managed secrets store. The measures we commit to for customer content are in Annex 2 of our DPA. No system is perfectly secure; if a breach affects you, we will tell you and the regulator where the law requires.
Many of our providers are in the United States, and some model providers may process data in other countries, including China. For transfers from the UK we rely on UK adequacy regulations, including the UK–US data bridge for recipients certified under it, or otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. For transfers from the EEA we rely on EU adequacy decisions, including the EU–US Data Privacy Framework, or the EU Standard Contractual Clauses. Ask us at privacy@squidgy.ai for details of the safeguard used for a particular provider.
Under UK GDPR (and the EU GDPR where it applies) you can ask to access, correct or delete your personal data, to restrict or object to how we use it (including objecting at any time to direct marketing), and for a portable copy. Where we rely on consent, you can withdraw it at any time. Email privacy@squidgy.ai; we will respond within one month. If your data is in a business's account on Squidgy, contact that business first, as it controls that data.
You can complain to the Information Commissioner's Office at ico.org.uk, or your local supervisory authority in the EEA. We would appreciate the chance to put things right first.
You may ask to know, access, correct or delete the personal information we hold about you. We do not sell personal information or share it for cross-context behavioural advertising, and we will not treat you differently for exercising your rights. Email privacy@squidgy.ai.
Squidgy is for businesses and is not directed at children. Account holders must be at least 18. If you think a child has given us personal data, contact privacy@squidgy.ai and we will delete it.
We will update this notice when our practices change and show the new version date. We will tell account holders about significant changes by email or in the product before they take effect. If a change means we need your consent for something, we will ask for it.
Version 2026-10-02, effective 2 October 2026. Contact: privacy@squidgy.ai, or 4142 Ltd (trading as Squidgy), 20 Wenlock Road, London, England, N1 7GU.