AI Data Handling Policy

Last updated: 29 April 2026

Summone Limited, trading as Summone Consulting. ICO Registration ZC123116.

Purpose

This policy sets out how Summone Consulting handles client data when using artificial intelligence tools during consulting engagements. It is provided to clients as part of our procurement documentation.

AI Tools in Use

We use the following AI tools in our consulting and development work:

• Claude by Anthropic. API and consumer versions. Used for code assistance, content development, and analysis.
• ChatGPT by OpenAI. API and consumer versions. Used for research, code assistance, and content development.
• Microsoft Copilot by Microsoft. Enterprise version. Used for productivity and document creation.
• Gemini by Google. API and consumer versions. Used for research and analysis.
• n8n. Self-hosted and cloud versions. Used for workflow automation.
• Antigravity. Used for agentic workflow development.
• VAPI. Used for voice AI development.
• ElevenLabs. Used for voice synthesis.

Data Minimisation Principle

Our default position is that personally identifiable information and commercially sensitive client data should not be entered into AI tools. Where AI tools are used during a client engagement, we work with anonymised, sample, or synthetic data wherever possible.

Client Advisory Obligation

Where a client requests or requires the use of AI tools that involve inputting real data, Summone Consulting will advise the client in writing of the following:

• Consumer versions of AI tools including ChatGPT and Gemini may use inputs to improve their models unless explicitly opted out.
• Enterprise and API versions do not use inputs for training by default.
• Regulated data including personal data covered by UK GDPR should not be entered into consumer AI tools without appropriate data processing agreements in place with the tool provider.

Client Responsibility

Where a client proceeds with the use of consumer AI tools after receiving our written advice, the client accepts responsibility for that decision and its compliance implications. Summone Consulting is not liable for data handling decisions made by clients against our documented advice.

Enterprise and API Versions

Where Summone Consulting controls the tool selection, we use enterprise or API versions of AI tools. These versions operate under data processing agreements that confirm inputs are not used for model training.

Data Processing Agreements

Summone Consulting maintains data processing agreements or reviews terms of service for each AI tool used. Clients may request copies of relevant terms on request.

Security

All client work is conducted on secured devices. Client data shared with Summone Consulting for the purposes of an engagement is stored securely and deleted at the end of the engagement unless retention is required for legal or contractual purposes.

Review

This policy is reviewed annually or when new AI tools are added to our practice.

Contact