Privacy Policy

Effective date: February 11, 2026

1. Introduction

Exona Ltd. (“Exona”, “we”, “us”, or “our”) operates https://exonalab.com/ and https://platform.exonalab.com/, together with related AI risk intelligence services (the “Service”).

This policy covers our website and platform and explains how we collect, use, protect, and disclose personal data, including accounts, sign-in data, IP addresses, audit logs, and customer-submitted information.

We process personal data on the lawful bases described below. Using the Service does not itself constitute consent to processing or international transfers.

Our Terms and Conditions (“Terms”) govern all use of our Service and together with the Privacy Policy constitutes your agreement with us (“agreement”).


2. Definitions

SERVICE means the Exona website, platform at https://platform.exonalab.com/, and related AI risk intelligence services.

PERSONAL DATA means data about a living individual who can be identified from those data (or from those and other information either in our possession or likely to come into our possession).

USAGE DATA is data collected automatically either generated by the use of Service or from Service infrastructure itself (for example, the duration of a page visit).

COOKIES are small files stored on your device (computer or mobile device).

DATA CONTROLLER means the organisation determining why and how personal data is processed. Exona is controller for account administration, business communications, and service security. Our role for Customer Data is described in section 3.

DATA PROCESSORS (OR SERVICE PROVIDERS) means any natural or legal person who processes the data on behalf of the Data Controller. We may use the services of various Service Providers in order to process your data more effectively.

DATA SUBJECT is any living individual who is the subject of Personal Data.

THE USER is the individual using our Service. The User corresponds to the Data Subject, who is the subject of Personal Data.


3. Information Collection and Use

We collect several different types of information for various purposes to provide and improve our Service to you.

For customer-submitted data processed under enterprise agreements, roles are defined by contract. Where GDPR or UK GDPR applies, customers typically act as controller (or processor on behalf of a controller) and Exona acts as processor, except where Exona determines purposes and means as an independent controller.


4. Types of Data Collected

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you (“Personal Data”). Personally identifiable information may include, but is not limited to:

Account and contact information: name, business email, organisation, and communications with us.

Platform information: sign-in data, IP addresses, audit logs, account activity, and personal data within information submitted by customers (“Customer Data”).

We may use your Personal Data to contact you with newsletters, marketing or promotional materials and other information that may be of interest to you. You may opt out of receiving any, or all, of these communications from us by emailing at hello@exonalab.com.

Usage Data

We may also collect information that your browser sends whenever you visit our Service or when you access Service by or through a mobile device (“Usage Data”).

This Usage Data may include information such as your computer’s Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data.

Essential Session Cookies

We use only essential session cookies on the platform to keep users signed in and maintain authenticated sessions.

We do not use advertising, analytics, or preference cookies, Google Analytics, or cross-site tracking.

You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use some portions of our Service.


5. Purposes and Lawful Bases

Where Exona acts as controller, our purposes and lawful bases under UK GDPR and, where applicable, EU GDPR are:

Providing accounts and the Service: contract performance, or legitimate interests in serving the business customer you represent.

Authentication, security, fraud prevention, and audit logging: legitimate interests in protecting customers and the Service, and legal obligations where applicable.

Support, account administration, enquiries, and service notices: contract performance or legitimate interests in managing business relationships.

Troubleshooting and service reliability: legitimate interests in maintaining a reliable Service. This excludes model training using Customer Data.

Regulatory compliance: legal obligations. Establishing, exercising, or defending legal claims: legitimate interests in protecting legal rights.

Business marketing: consent where required or legitimate interests where permitted by law. You may opt out at any time.

For Customer Data processed on behalf of a customer, the customer determines the lawful basis. Exona processes it on documented instructions under the applicable agreement and DPA.


6. Retention of Data

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

We will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period, except when this data is used to strengthen the security or to improve the functionality of our Service, or we are legally obligated to retain this data for longer time periods.

For Customer Data processed under contract, we will return or delete Customer Data upon termination or expiry of services in accordance with the applicable agreement, subject to required legal retention and backup lifecycle constraints.


7. Transfer of Data

Platform data is hosted in the United Kingdom in Google Cloud’s London region (europe-west2). We do not routinely transfer all platform data to the United States for hosting.

Data may leave the UK when platform workers send information needed for AI analysis to Google Vertex AI / Gemini or OpenAI. Processing locations depend on the provider, model, and regional configuration. UK hosting does not mean all AI processing occurs in the UK.

International transfers may also occur where authorised service-provider support or operations personnel access data outside the UK. Contact privacy@exonalab.com for processing locations and safeguards relevant to your deployment.

Exona will take all the steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy and no transfer of your Personal Data will take place to an organisation or a country unless there are adequate controls in place including the security of your data and other personal information.

Where required, we rely on applicable adequacy decisions or appropriate safeguards, including the UK International Data Transfer Agreement, UK Addendum, or EU Standard Contractual Clauses, with transfer assessments and supplementary measures as appropriate. Acceptance of this policy is not consent to a transfer.


8. Disclosure of Data

We may disclose personal information that we collect, or you provide:

(a) Disclosure for Law Enforcement. Under certain circumstances, we may be required to disclose your Personal Data if required to do so by law or in response to valid requests by public authorities.

(b) Business Transaction. If we or our subsidiaries are involved in a merger, acquisition or asset sale, your Personal Data may be transferred.

(c) Other cases. We may disclose your information also:

(i) to our subsidiaries and affiliates;

(ii) to contractors, service providers, and other third parties (including subprocessors) we use to support our business and deliver the Service;

(iii) to fulfill the purpose for which you provide it;

(v) for any other purpose disclosed by us when you provide the information;

(vi) with your consent in any other cases;

AI subprocessors include Google (Vertex AI / Gemini) and OpenAI, which receive data needed for AI-powered analysis. Details of subprocessors, functions, processing locations, and safeguards are available on request at privacy@exonalab.com.


9. Security of Data

The security of your data is important to us. We maintain a defense-in-depth security program designed to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access.

Our technical and organizational measures include, as appropriate:

  • encryption in transit (for example, TLS for network communications);

  • encryption at rest for production databases and backups where supported by our infrastructure;

  • role-based access controls and least-privilege access to systems that process Personal Data;

  • logging and monitoring of security-relevant events; and

  • periodic review of security controls and incident response procedures.

While no method of transmission over the Internet or method of electronic storage is 100% secure, we use commercially reasonable safeguards aligned with industry standards and applicable legal requirements.


10. UK and EEA Data Protection Rights

Where UK GDPR or EU GDPR applies, you have the following rights, subject to applicable legal conditions and exemptions.

Where GDPR applies, Exona processes Personal Data only where a valid legal basis exists, including performance of a contract, compliance with legal obligations, legitimate interests, or consent as required.

Where Exona processes Customer Data as a processor, Exona supports execution of a Data Processing Agreement (DPA) including Article 28 GDPR terms and, where relevant, approved transfer mechanisms.

We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

To exercise your rights, email privacy@exonalab.com. Where we act as processor, we assist the customer in responding under our contractual and legal obligations.

In certain circumstances, you have the following data protection rights:

(a) the right to access, update or to delete the information we have on you;

(b) the right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete;

(c) the right to object. You have the right to object to our processing of your Personal Data;

(d) the right of restriction. You have the right to request that we restrict the processing of your personal information;

(e) the right to data portability. You have the right to be provided with a copy of your Personal Data in a structured, machine-readable and commonly used format;

(f) the right to withdraw consent. You also have the right to withdraw your consent at any time where we rely on your consent to process your personal information;

Please note that we may ask you to verify your identity before responding to such requests. Please note, we may not able to provide Service without some necessary data.

You may complain to the UK Information Commissioner’s Office at https://ico.org.uk/ or your competent EEA supervisory authority, as applicable.

If Exona confirms a personal data breach affecting Customer Data, we will notify affected enterprise customers without undue delay and provide available information reasonably necessary to support their legal notification and remediation obligations.


11. Tracking and Advertising

We do not use advertising cookies, cross-site tracking, or personalised advertising. Essential platform session cookies remain necessary for authentication regardless of browser tracking preferences.


12. Other Applicable Privacy Rights

Depending on your location and applicable law, you may have additional rights to access, correct, delete, object to, or restrict processing of personal data. Contact privacy@exonalab.com. We do not sell personal data or share it for cross-context behavioural advertising, or discriminate for exercising applicable rights.


13. Operational Records

We use technical and audit logs to operate, troubleshoot, and secure the platform as described in sections 4–6. We do not use Google Analytics.


14. AI Service Providers

Platform workers send data to Google Vertex AI / Gemini and OpenAI for analysis requested through the Service. These are inference requests, not permission to train models on Customer Data. See sections 7, 8, and 21.


15. Business Administration

We process business contact information and contractual correspondence to administer customer relationships and meet record-keeping obligations.


16. Links to Other Sites

Our Service may contain links to other sites that are not operated by us. If you click a third party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.


17. Privacy Contact

For privacy questions, personal data requests, and information about our data protection arrangements, contact Exona at:

Email: privacy@exonalab.com

This is our designated privacy contact. This policy does not assert that Exona has appointed a statutory Data Protection Officer.


18. Children’s Privacy

The Service is intended for business and professional users aged 18 or over, consistent with our Terms. It is not intended for children.

If you believe someone under 18 has provided personal data through an account, contact privacy@exonalab.com so we can investigate and take appropriate steps, including deletion where required.


19. User Access Control

Platform access is limited to authorised users according to their role and the customer’s applicable access arrangements.

Requests to change or revoke access should go to the customer’s authorised contact or Exona support. Access is restricted when no longer authorised.

Account activity and security-relevant actions may be recorded in audit logs for oversight and incident investigation.

Send deletion requests to privacy@exonalab.com. Requests are handled according to our role, customer instructions, retention requirements, and legal obligations.


20. Security Protocols

We periodically review security controls and address identified vulnerabilities according to risk. We do not commit to weekly manual penetration testing or a specific external testing schedule.

Security measures include authentication, role-based controls, least-privilege administration, and security logging, as described in section 9.

We investigate suspected incidents and take appropriate containment and remediation steps, notifying customers and authorities where required by law or contract.


21. AI Training Data

Customer Data is never used to train or fine-tune AI or machine-learning models, whether by Exona or its AI service providers. AI providers process Customer Data only for inference needed to deliver the Service under arrangements prohibiting training. Improving the Service excludes model training or fine-tuning using Customer Data.


22. Internal Security Rules

Data Access: Access to internal data is restricted by default. Exona employees are only given access to scopes that are necessary to complete their work.

Offboarding: access to company systems and personal data is revoked when no longer required, including when employment or engagement ends. Company data on devices is handled under applicable security and retention procedures.


23. Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will notify you via email and/or a prominent notice on our Service if notable changes occur, prior to the change becoming effective and update “effective date” at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.


24. Contact Us

If you have any questions about this Privacy Policy, please contact us:

By email: privacy@exonalab.com

hello@exonalab.com

Exona Lab

London Initiative for Safe AI (LISA)

25 Holywell Row

London

EC2A 4XE