GDPR
1. Introduction
This GDPR page explains how Resultory, operated by EdenTouch CoLab Ltd, complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It is intended to give you a clear, honest understanding of your data protection rights and how we handle your personal data.
EdenTouch CoLab Ltd is registered with the Information Commissioner's Office (ICO) under registration number ZC047648.
For any data protection questions, contact us at support@edentouchcolab.com.
2. Lawful Basis for Processing
We process your personal data under the following lawful bases:
2.1 Performance of a contract (Article 6(1)(b))
When you create an account and use Resultory, we process your name, email, and venture data to provide the service you signed up for.
2.2 Consent (Article 6(1)(a))
When you sign in with Google or Microsoft, we process your basic profile information based on your explicit consent through the OAuth 2.0 authorisation flow. You can withdraw this consent at any time by revoking Resultory's access in your provider's account settings.
We also rely on consent for any non-essential cookies (see our Cookie Policy).
2.3 Legitimate interests (Article 6(1)(f))
We process usage data (pages visited, features used, device information) for the legitimate interest of improving our platform, detecting fraud, and ensuring security. This processing does not override your rights and freedoms.
2.4 Legal obligation (Article 6(1)(c))
Where required by law (e.g., responding to lawful requests from authorities), we may process or disclose data to comply with legal obligations.
3. Your Rights Under UK GDPR
You have the following rights regarding your personal data:
| Right | What it means |
|---|---|
| Right to be informed | You have the right to know how we use your data (this page and our Privacy Policy fulfil this) |
| Right of access | You can request a copy of all personal data we hold about you |
| Right to rectification | You can ask us to correct inaccurate or incomplete data |
| Right to erasure | You can ask us to delete your personal data ("right to be forgotten") |
| Right to restrict processing | You can ask us to limit how we use your data while a dispute is resolved |
| Right to data portability | You can receive your data in a structured, machine-readable format and transfer it to another provider |
| Right to object | You can object to processing based on legitimate interests or for direct marketing |
| Right to withdraw consent | You can withdraw consent for processing that relies on consent at any time |
| Rights related to automated decision-making | You have rights regarding decisions made solely by automated means (see Section 6 below) |
How to exercise your rights:
Email support@edentouchcolab.com. We will respond within 30 days. We may ask for verification to confirm your identity before processing your request.
If you are unhappy with our response, you can complain to the Information Commissioner's Office (ico.org.uk).
4. Data We Process
4.1 Personal data:
- Name and email address
- Google or Microsoft profile information (if using those sign-in methods)
- IP address and device/browser information
4.2 Venture and product data (processed on your behalf):
- Product descriptions, pricing, geography
- Market assumptions and customer hypotheses
- Evidence, experiment data, and learning notes
- AI-generated recommendations, segment scores, and reports
Note: Venture data you enter is processed to provide the service to you. It is associated with your account but is not shared with other users.
5. Data Retention
We retain your data as follows:
| Data type | Retention period |
|---|---|
| Account data (name, email) | For as long as your account is active; deleted within 30 days of account deletion request |
| Venture data (hypotheses, evidence, reports) | For as long as your account is active; deleted within 30 days of account deletion request |
| Usage and analytics data | Retained for up to 24 months, then anonymised or deleted |
| Authentication logs | Retained for up to 12 months for security purposes |
| Cookies | As described in our Cookie Policy |
You can request earlier deletion at any time by contacting support@edentouchcolab.com.
6. AI Processing and Automated Decision-Making (Article 22)
This section is specifically about how Resultory uses AI and how this relates to your GDPR rights.
6.1 How AI is used in Resultory:
Resultory uses AI to process the venture data you provide (product descriptions, assumptions, evidence) and generate:
- Customer hypotheses (who might need your product)
- Segment comparisons (how different customer groups score against each other)
- Evidence assessments (how strong the evidence for each segment is)
- Commitment analysis (how far prospects have progressed)
- Learning reports (what was tested, what happened, what to do next)
6.2 AI does NOT make automated decisions about you:
Resultory's AI generates recommendations and analysis for your use. It does NOT:
- Automatically decide whether to accept or reject you for any service
- Automatically determine your eligibility for anything
- Make decisions that produce legal or similarly significant effects on you
- Process your data without human oversight
Every AI-generated output in Resultory is a recommendation that requires your human review. The PASS / REFINE / PAUSE decision framework embedded in the platform ensures that you — not the AI — make the final judgement on every business decision.
6.3 Your rights regarding AI processing:
Under Article 22 of the UK GDPR, you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. Because Resultory's AI produces recommendations (not automated decisions about you), Article 22 does not directly apply to our core AI processing.
However, we voluntarily commit to the following transparency principles:
- You will always be informed when AI has generated content you are viewing
- AI-generated outputs will include stated uncertainty and evidence limitations
- You can request an explanation of how an AI-generated recommendation was produced
- You can request human review of any AI-generated output (which is already built into the platform's design)
- You can delete all AI-generated outputs by deleting your account
6.4 Data used for AI processing:
- AI processes data you have actively entered (venture descriptions, assumptions, evidence)
- AI does NOT process data from your Google or Microsoft account beyond your name and email
- AI does NOT access your Google Drive, Gmail, OneDrive, Outlook, or any other third-party service data
- We do not use your personal data to train external AI models
- Your venture data is processed to provide the service to you, not to improve general AI models for third parties
7. Data Sharing and Recipients
We do not sell your personal data. We share data only with:
| Recipient | What is shared | Purpose |
|---|---|---|
| Cloud hosting provider | Account data and venture data | Hosting and operating the platform |
| Email delivery provider | Email address | Sending service-related emails |
| Google (if using Google Sign-In) | Email and basic profile | Authentication only — no other data shared with Google |
| Microsoft (if using Microsoft Sign-In) | Email and basic profile | Authentication only — no other data shared with Microsoft |
| ICO or law enforcement | Data as required by law | Legal compliance |
We do not share your data with advertising networks, data brokers, or third-party analytics providers (beyond what is described in our Cookie Policy).
8. International Data Transfers
Your data is primarily processed and stored in the United Kingdom. Where we transfer personal data outside the UK, we rely on:
- UK International Data Transfer Agreement (IDTA)
- Adequacy decisions by the UK government
- Standard Contractual Clauses where applicable
We will not transfer your data to countries that do not provide adequate data protection without appropriate safeguards.
9. Data Protection Officer
EdenTouch CoLab Ltd is not currently required to appoint a Data Protection Officer under Article 37 of the UK GDPR. However, we are committed to data protection and handle all data protection matters through support@edentouchcolab.com.
If our processing activities change in a way that requires a DPO, we will appoint one and update this page.
10. Children's Data
Resultory is designed for founders and business professionals. We do not knowingly collect data from anyone under 16 years old.
If you believe a child under 16 has provided us with personal data, contact support@edentouchcolab.com and we will take steps to delete that data.
11. Data Protection by Design and by Default (Article 25)
We implement data protection by design and by default:
- Your data is private to your account by default — nothing is shared unless you explicitly choose to share it
- Authentication is required to access venture data — no public access to user data
- Google and Microsoft authentication uses OAuth 2.0 — we receive only what you authorise
- You can delete your account and all associated data at any time
- AI-generated outputs are clearly labelled as AI-generated within the platform
12. Breach Notification
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will:
- 1. Notify the ICO within 72 hours of becoming aware of the breach (Article 33)
- 2. Notify affected users without undue delay (Article 34)
- 3. Document the breach, its effects, and the corrective action taken
13. Changes to This Page
We may update this GDPR page as our practices evolve or as regulations change. We will notify users of significant changes by email or through the platform.
14. Contact
For data protection questions, rights requests, or complaints:
- Email: support@edentouchcolab.com
- Company: EdenTouch CoLab Ltd (Co No 16472666, ICO ZC047648)
- ICO: ico.org.uk (if you wish to complain to the regulator)
Last updated: August 2026