Your rights, and our breach process

Ask us, and here is exactly what happens.

Last updated 12 November 2026. One route, one clock, wherever you are: privacy@betteroutcomes.ai. We do not ask you to find the right form or to say which law you are relying on.

What you can ask for

Six things.

A copy

Everything we hold about you, and who we have given it to.

A correction

Anything wrong or incomplete, put right. When a fact changes we replace it and keep the old one as history rather than losing it or mixing the two.

Deletion

You, gone. Not hidden, not flagged — removed, along with every lesson an agent learned only from you.

A portable copy

Your data in a form a machine can read, so you can take it elsewhere.

A stop

Stop a particular use, or restrict it while we check something you have told us is wrong.

A person, not a machine

If a decision about you was made by automation, you can object to it and ask a person to look again. In our system no model decides a number, a date, a price, a ranking or anything that has to be explained — code computes those and a named person approves the recommendation.

The process

Seven steps, in order.

You write to privacy@betteroutcomes.ai. Any wording is fine.
We acknowledge and, if we need to, ask what exactly you want — which data, roughly when, which service. We ask to make the answer right, not to slow it down, and we will not refuse a request for being vague.
We check who you are, proportionately. If someone is asking on your behalf we check they are allowed to.
We freeze the data the moment the request arrives, so nothing that would normally be deleted on a timer disappears while we are answering.
We look everywhere it could be — the account, the agent's memory, the logs, free text. Information about you in a sentence someone typed counts just as much as a field in a database.
We answer within one month. If it is genuinely complex we tell you inside that month and say when we will finish. We always reply, including when the answer is no, and then we say why and how to challenge it.
We keep a record of the request and what we gave you, so we can show it was handled.

If you are our client's customer rather than our client, write to us anyway and we will route it. Your data is held on our client's instructions, so the decision is theirs; we pass the request on straight away and help them answer it.

Honestly, where this is slow: deleting a person is quick and tested. Producing everything we hold about one named person means people looking, because the one-click export does not exist yet. We will still do it inside the month, and we are building the route.

The clocks

What we hold ourselves to, everywhere.

Different places give different deadlines. We do not run different processes for different places, so we take the shortest one and apply it to everybody.

What	Our commitment	Why that number
Answering a request about your own data	Within 1 month	The strictest of the deadlines we work under
Telling you it is complex	Inside that same month	So you are never waiting without knowing
Telling our client that their customer asked us	Without delay	The decision is theirs to make
Telling a client their data was breached	Without undue delay, and we aim for 24 hours	A client may have only 72 hours, or 3 calendar days, to tell their own regulator — a late word from us spends their clock
Fees	None	We do not charge for a request about your own data. Some regimes allow a fee; we would rather not have that conversation

If information is exposed

The breach process.

A breach is any time personal data is lost, destroyed, altered, disclosed or reached by someone who should not have it — by accident or otherwise. It is not only a hack.

Anyone can raise one — our own people, a client, a researcher. security@betteroutcomes.ai, and the clock starts when the message arrives, not when someone opens it.
We contain it first. Revoke the grant, stop the agent, rotate the key. An agent can be stopped immediately and stays stopped until a person restarts it.
We establish the facts — what, when, whose, how much, still happening or not.
We tell every client whose data is involved, without undue delay, aiming for 24 hours, even when we do not yet know everything. Then updates as we learn more, rather than one complete report later.
The client decides what their regulator and their people are told, because that is the controller's call. We give them the facts in the shape a notification needs.
Where we are the controller — our own account and billing data — we notify the authority ourselves within the deadline that applies, and tell the people affected where the risk to them is high.
We write it down — the facts, the effect, what we did — whether or not anyone had to be notified, and we tell the client what we changed so it does not happen again.

What exists today and what does not: an agent that exceeds its limits already stops itself, writes a record and tells the client's named person. That is a limits check, not breach detection. The process above is kept by people, and the detection and the clock are being built. We would rather write that down than imply a system we do not have.

Complaining

Us first, then them.

If you are unhappy with how we handled a request or a breach, say so to privacy@betteroutcomes.ai and the owner will answer. You can also complain to the data protection authority where you are, and you do not have to come to us first.