Introducing AI OS for Business & School — our most powerful products yet.Explore →
App Corp
Full-service software engineering
Engineering your experience…
App Corp
Full-service software engineering
Engineering your experience…
App Corp is built on the principle that trust is earned through transparency. This policy sets out in plain language exactly what data we collect, why we collect it, how we protect it — and the rights you hold over every byte of it.
Use the links below to jump directly to the section most relevant to you, or scroll through at your own pace. Every section is written plainly and completely.
We practise data minimisation — collecting only what is genuinely necessary to deliver exceptional service and maintain a secure, trustworthy relationship with you.
When you contact us through our website, submit a project brief, or engage our services, we collect personal information that you voluntarily share — including your name, email address, phone number, company name, role, and the content of your communications. When you enter into a contract with App Corp, we may additionally collect billing information, project specifications, signed agreements, and any supplementary detail needed to deliver the agreed scope of work to the standard you expect.
When you visit our website, we automatically collect certain technical information — including your IP address, browser type and version, operating system, referring URLs, session duration, and the pages you view. This data is gathered via first-party cookies and server-side analytics. We use it to maintain the security and performance of our site, detect anomalous access patterns, analyse engagement in aggregate, and continuously improve our content and user experience.
Every use of your data is grounded in a lawful basis — whether that is the performance of a contract, your explicit consent, a legitimate business interest, or a legal obligation. We never use your data in ways you would not reasonably expect.
We use your personal data to respond to enquiries, prepare and deliver proposals, negotiate and execute contracts, manage ongoing projects, and invoice for completed work. Where a project is in progress, we may contact you with status updates, milestone approvals, and service-related notifications. These communications are integral to the performance of our contract and cannot be opted out of while an engagement is active — though you may always update your communication preferences for discretionary correspondence.
With your explicit consent, we may send you curated case studies, industry thought-leadership content, service updates, webinar invitations, and event announcements that we believe hold genuine professional value for you. You may withdraw this consent at any time by clicking the unsubscribe link in any marketing email or contacting us directly. We also use aggregated, anonymised web analytics to measure content performance; this data cannot identify any individual and is used solely to improve our digital presence.
We may process your data to meet applicable legal and regulatory requirements, enforce the terms of our agreements, resolve disputes, protect the rights and physical safety of our team and clients, respond to valid legal requests from public authorities, and cooperate with investigations where we are legally compelled to do so. We will always seek to minimise the data shared in these circumstances and will inform you where permitted by law.
We treat your data with the same care we would expect for our own. We do not sell it, rent it, or share it for commercial gain. Disclosure occurs only in tightly defined circumstances.
We engage a small number of carefully vetted third-party service providers to support our operations — covering areas such as cloud infrastructure, CRM and project management, transactional email delivery, video conferencing, and payment processing. Every sub-processor is subject to a formal Data Processing Agreement that prohibits use of your data beyond the specific services they provide to App Corp, mandates appropriate technical and organisational security controls, and requires immediate notification of any security incident affecting your data.
We may disclose your personal information where required by law, court order, regulatory authority, or other valid legal process. In the event of a merger, acquisition, asset sale, or business reorganisation, your data may be transferred as part of that transaction — in which case we will notify you and ensure the receiving entity is bound by privacy obligations at least as protective as those set out here. In all cases, we do not sell, trade, or otherwise transfer your data to third parties for their own commercial purposes.
We keep your data only for as long as necessary — then delete or anonymise it in a secure, verifiable manner. Retention periods are defined by legal requirements, business necessity, and the principle of storage limitation.
Active client records — including project files, correspondence, and financial documentation — are retained for seven years following the conclusion of the engagement, in line with UK tax and accounting regulations. Enquiries and brief submissions that do not proceed to a contract are deleted after 24 months, unless you have separately consented to marketing communications. Server logs and analytics data are aggregated and anonymised within 26 months.
When a retention period expires — or upon receipt of a verified erasure request — we securely delete or irreversibly anonymise your personal data so it can no longer be associated with you. Deletion is performed in accordance with NIST SP 800-88 guidelines where applicable. We will confirm completion of a deletion request within the timeframes set out in the Your Rights section of this policy.
Security is a baseline expectation, not a premium feature. We invest significantly in the technical and operational controls needed to keep your data safe — and we are transparent when things go wrong.
We protect your personal data with TLS 1.3 encryption for all data in transit, AES-256 encryption for data at rest, role-based access controls with the principle of least privilege, hardware security keys and multi-factor authentication for all internal systems, and automated vulnerability scanning. Our infrastructure runs on ISO 27001-aligned cloud platforms with 99.9% uptime SLAs, continuous intrusion detection, and geo-redundant backups. We conduct formal security audits annually and run ongoing staff training on data protection responsibilities.
We maintain a documented incident response plan that includes containment, investigation, remediation, and communication procedures. In the event of a personal data breach likely to result in high risk to your rights and freedoms, we will notify you without undue delay — and in any case within 72 hours of becoming aware — in accordance with our obligations under UK GDPR Article 34. Breach notifications will include the nature of the incident, categories of data affected, likely consequences, and the measures taken or proposed to address it.
We are a UK-based business that operates globally. Where your data crosses borders, we ensure legally robust safeguards are in place before any transfer occurs.
App Corp is registered in England and primarily processes personal data within the UK and the European Economic Area (EEA), which share equivalent data protection standards. Where we engage sub-processors based outside the UK/EEA — for example, cloud platforms with data centres in the United States or Asia-Pacific — we ensure compliance through approved transfer mechanisms, including the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses (SCCs), or adequacy decisions issued by the Secretary of State or the European Commission. A current list of our sub-processors and their data locations is available on request.
Privacy law and our business practices evolve. When we update this policy in any meaningful way, we tell you clearly — rather than burying changes in an obscure revision log.
We may revise this Privacy Policy from time to time to reflect changes in our data practices, technology stack, applicable law, or regulatory guidance. When we make material changes — those that affect your rights, the categories of data we collect, or how we use it — we will update the 'Last updated' date displayed prominently at the top of this page and, where appropriate, send a direct notification to the email address associated with your enquiry or engagement. Minor clarifications and formatting updates will be made without a notification email. We encourage you to review this policy periodically; your continued use of our services following any update constitutes acceptance of the revised terms.
Under UK GDPR, EU GDPR, and the California Consumer Privacy Act (CCPA), you hold meaningful, enforceable rights over your personal data. App Corp is committed to honouring every valid request promptly, free of charge, without discrimination.
Request a structured copy of the personal data we hold about you, along with information on the purposes of processing, categories of data, retention periods, and any recipients.
Ask us to correct any inaccurate or incomplete personal data we hold about you, without undue delay. We will notify any relevant third parties of the correction.
Request deletion of your personal data where it is no longer necessary for the purpose it was collected, you have withdrawn consent, or processing is unlawful.
Ask us to restrict processing of your personal data in certain circumstances — for example, while we verify the accuracy of your data or assess an objection.
Receive a copy of your personal data in a structured, commonly used, machine-readable format and transmit it to a controller of your choice.
Object at any time to processing of your data for direct marketing purposes, or where processing is based on legitimate interests or a public task.
California residents have the right not to receive discriminatory treatment for exercising their CCPA privacy rights.
Where processing is based on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.
Email [email protected] with your full name, the right(s) you wish to exercise, and a description of the data concerned. Requests can also be submitted by post.
To protect your data, we will verify your identity before fulfilling any request. We may ask for one form of identification if we cannot verify you from existing records.
We assess each request within 7 days and aim to respond fully within 30 days. Complex or numerous requests may require up to 90 days — we will notify you if this applies.
Once fulfilled, we will send you written confirmation of the action taken. Requests we cannot fulfil will include reasons and information on escalation pathways.
If you are unsatisfied with our response to any privacy request, or believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk, or with the relevant supervisory authority in your country of residence. We encourage you to first contact us directly — we take every concern seriously and aim to resolve issues promptly.
Questions about this policy, a data rights request, or concerns about how your information is handled? Our dedicated Data Protection Officer and privacy team are here — and committed to a substantive response within two business days.
For data rights requests, policy questions, and general privacy enquiries. Include your full name and a brief description of your request.
Available Monday to Friday, 09:00–18:00 GMT. For urgent data breach reports, our line is monitored outside business hours.
For formal legal notices and postal requests. Mark correspondence 'FAO: Data Protection Officer' to ensure direct routing.
If you are unsatisfied with our response, you have the right to escalate a complaint to the ICO at ico.org.uk or by calling 0303 123 1113.