Privacy notice
Last updated: 27 July 2026
Who we are
UK M-1 LIMITED ("M-1", "we", "us"), a company registered in England and Wales (no. 16657358) with its registered office at 167–169 Great Portland Street, London W1W 5PF, operates the website m-1.ai. We are the data controller for the personal data described in this notice. You can contact us about anything in this notice at hello@m-1.ai.
What we collect
We keep collection to a minimum. When you ask for a sign-in link to the M-1 Room, we collect your work email address together with basic request metadata: the time of your request, your IP address, your browser's user-agent string and the page you came from. When you go on to hold a conversation in the M-1 Room, we process the messages you send and the responses generated in that session. If you email us directly, we hold your email address and the contents of your message. We do not collect any other personal data through this site.
Why we collect it, and our lawful basis
We use your work email and request metadata to send your sign-in link, respond to your enquiry, protect the site against automated abuse and keep basic records of business contact. We process M-1 Room conversation content to generate the responses you see and to operate the service. Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR): responding to people who ask to speak with us, operating the tools we offer them, and keeping our site secure. We do not use your details for marketing lists or newsletters, and we do not sell or share personal data with third parties for their own purposes.
The M-1 Room (AI agents)
The M-1 Room is powered by AI. The messages you send are processed by Microsoft Azure AI services to generate a response in the moment; its direction, delivery and build lenses are AI agents shaped by the founding team's experience, not the people themselves. We instruct our providers to process this content only to deliver the service to you and not to train their own general-purpose models on it. M-1 keeps the room's email and conversation state for 30 days after the last activity, then deletes it automatically. Do not enter confidential programme data or personal data about others into the room.
Cookies
We do not use advertising or analytics cookies. The site sets only what is strictly necessary for it to function and to protect it from abuse, including tokens set by Cloudflare Turnstile (described below). Because these are essential, they do not require consent under UK law, and there is no cookie banner to click.
Bot protection (Cloudflare Turnstile)
Our enquiry form is protected by Cloudflare Turnstile, which checks that requests come from a person rather than an automated script. Turnstile processes limited technical information about your browser and connection to make that assessment. Cloudflare acts as our processor for this purpose. You can read Cloudflare's own privacy documentation at cloudflare.com.
Where your data lives and who processes it
The site and its enquiry data run on Cloudflare's infrastructure. M-1 Room messages are passed to Microsoft Azure AI services, which generates the responses. These providers act as our processors, under our instructions and appropriate safeguards, including recognised safeguards for any transfers outside the UK. The client-deployment boundary described elsewhere on this site is separate from this public room.
How long we keep it
Sign-in request records and their basic request metadata are deleted automatically after 12 months. M-1 Room email and conversation state is deleted 30 days after the last activity. Abuse-control keys are deleted after two days; magic-link and rate-limit records expire sooner under their own short windows. Direct enquiries that become a business relationship are reviewed periodically and kept only while there is a continuing business need. To ask for earlier deletion, email hello@m-1.ai.
Your rights
Under UK data protection law you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to our processing of it, and to data portability where applicable. Because we rely on legitimate interests, you can object at any time and we will stop processing your data unless we have compelling grounds to continue. To exercise any right, email hello@m-1.ai. We respond within one month.
Complaints
If you are unhappy with how we handle your personal data, please contact us first at hello@m-1.ai and we will do our best to put it right. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
Changes to this notice
If we change how we handle personal data, we will update this notice and revise the date at the top of the page.