1. Who we are
This website and the Chameleon AI software suite are provided by CHAMELEON-AI-AGENT LTD ("Chameleon AI", "we", "us", "our"), a private company limited by shares, incorporated in England and Wales under company number 17147789.
- Registered office: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom
- Contact for privacy matters: stemsee@chameleon-ai-agent-ltd.net
- ICO: CHAMELEON-AI-AGENT LTD processes personal data only for its own licensing, software-support and business-administration purposes. Where a data protection fee is payable to the Information Commissioner's Office, its registration number will be published here.
For the personal data described in this policy, CHAMELEON-AI-AGENT LTD is the data controller, and we are responsible for keeping that data safe and for handling it in line with the UK GDPR and the Data Protection Act 2018. The Software is local-first: your books, ledgers and financial records stay on your own device and are transmitted only to HMRC when you file (see sections 5 and 6). We do not receive or process your accounting data, so we are not a data processor for it. Where the Software is used by a business or an accountant to process data about that organisation's own clients, staff or suppliers, that business or accountant is the controller for that data.
We comply with the UK GDPR's data-protection principles: we process personal data lawfully, fairly and transparently; only for the specific purposes set out below; limited to what we actually need; kept accurate; retained no longer than necessary (section 10); and protected by appropriate security (section 11). We have identified and recorded a lawful basis for every processing activity before starting it — these are set out in section 4 — and we do not use your personal data for any incompatible new purpose without telling you first.
2. Scope of this policy
This policy covers:
- the website at chameleon-ai-agent-ltd.net and its subdomains;
- the Chameleon AI desktop software and its companion mobile application ("the Software"), including the AI IDE, Presenter, Accounting (Making Tax Digital), Classroom, PC Technician, Logistics 4×4 and related tools;
- enquiries, licensing, support and other correspondence with us.
Third-party services you choose to connect the Software to — for example an AI provider, HM Revenue & Customs, a bank or a cryptocurrency exchange — are governed by their privacy policies, not this one. Links or integrations to those services do not mean we control how they use your data.
3. Our privacy principles
The Software is designed to be local-first. Your documents, ledgers, code, presentations, chat history and API keys are stored on your own device and are not transmitted to us. We collect the minimum personal data needed to run the website, provide licences and support the Software, and we do not sell personal data or use it for third-party advertising.
4. Personal data we collect, and why
The table sets out, for each activity, what we process, why, and our lawful basis under Article 6 of the UK GDPR. Where we rely on legitimate interests we have named the interest; where we rely on a legal obligation we can identify the law. For background on lawful bases see the ICO's guide to lawful basis.
| Category | Examples | Purpose | Lawful basis (UK GDPR, Art. 6) |
|---|---|---|---|
| Enquiry & correspondence data | Name, email address, company name, message content, and any details you volunteer when you email us with a licensing or software-support enquiry | To respond to you, quote for and administer licences, and keep records of our dealings | Legitimate interests — the interest is responding to unsolicited enquiries and running our business correspondence. Where you are asking about buying a licence, steps taken at your request before entering a contract. |
| Licensing & account data | Licensee name, billing contact, licence keys, purchase and payment records, support tickets | To issue and manage licences, provide software support, and meet our accounting and tax obligations | Performance of a contract (the licence). Retaining purchase and payment records is a legal obligation under the Companies Act 2006 and tax law. |
| Website technical data | IP address, browser type, referring page, pages viewed, date/time — recorded in standard server logs by our hosting provider | To deliver the site, keep it secure, diagnose faults and understand aggregate traffic | Legitimate interests — the interest is the security, availability and correct operation of our website. |
| Support & diagnostic data | Information you send us to investigate a problem, such as log extracts, error messages, configuration details or screenshots | To reproduce and fix faults and improve the Software | Performance of a contract where you hold a licence; otherwise legitimate interests — the interest is diagnosing and fixing defects in our Software. |
| Security reports | Your name and email address and the technical content of a vulnerability report you send to security@chameleon-ai-agent-ltd.net | To assess, fix and coordinate disclosure of the issue, and to credit you if you wish | Legitimate interests — the interest is the security of our software and our users. See our security policy. |
| Making Tax Digital submission data | See section 6 | See section 6 | See section 6 |
We do not intentionally collect special category data. Please do not send it to us unless we specifically ask for it.
5. Data the Software processes on your device
When you use the Software, the following are processed locally on your own computer or phone and are not sent to us:
- the files you open or create — code, documents, presentations, media;
- your accounting records, ledgers, invoices, VAT figures and supporting data;
- your AI provider API keys, and the prompts and responses exchanged with the provider you choose;
- credentials or tokens you enter for third-party services (HMRC, banks, payment processors, cryptocurrency exchanges);
- chat history, settings and local caches.
This data is transmitted only when you direct the Software to contact a third party — for example asking a cloud AI provider a question, syncing a bank feed, or submitting a return to HMRC — and in each case it goes directly from your device to that third party over an encrypted connection. The Software can additionally encrypt the access tokens and credentials it stores on your device (and, in the desktop and mobile app, the accounting database), protected by a secret only you hold; see our Security page and section 11. You are responsible for securing your own device, backups and credentials.
5.1 Bank feeds (Open Banking)
If you choose to connect a bank account, the Software uses a regulated Open Banking provider — an FCA-authorised Account Information Service Provider (AISP), for example GoCardless Bank Account Data or TrueLayer — to retrieve your account and transaction data. You authenticate directly with your bank; the AISP then passes the transaction data to the Software on your device, where it is added to your local ledger. That data, and the access tokens for the connection, are held on your device and by the AISP under the AISP's own terms and privacy notice. CHAMELEON-AI-AGENT LTD does not receive, store or have access to your bank data or bank credentials. Open Banking consents expire (typically after 90 days) and you can withdraw a connection at any time through your bank or the AISP.
6. HM Revenue & Customs — Making Tax Digital
The Accounting tool can submit VAT and other tax information to HMRC through HMRC's Making Tax Digital APIs. When you use this feature:
6.1 What is sent to HMRC
- Your VAT Registration Number (or other tax reference), the return figures you have prepared (the nine VAT boxes or equivalent), the obligation/period key, and your declaration that the figures are final.
- OAuth tokens issued by HMRC to authorise the connection.
- Fraud-prevention header data that HMRC requires every Making Tax Digital application to send. This identifies the device and connection making the submission and can include: a device identifier generated by the Software, your device's local and public IP addresses, screen and window size, timezone, operating-system user name, and the product name and version. HMRC uses this data to detect and prevent fraud, as described in HMRC's own fraud prevention guidance.
6.2 How it is sent
All of the above is transmitted directly from your device to HMRC over a secure connection. It is not routed through, stored by, or accessible to CHAMELEON-AI-AGENT LTD. HMRC access tokens are stored only on your device.
6.3 Lawful basis and responsibility
Processing for HMRC submissions is carried out to comply with a legal obligation (your tax filing duties) and on the basis of the contract under which you use the Software. HMRC is an independent controller of the data once received; its handling is governed by the HMRC Privacy Notice. You remain responsible for the accuracy and timeliness of everything you submit; the Software is a filing tool and does not provide tax or accountancy advice.
7. Cookies and similar technologies
The website does not use analytics, advertising or tracking cookies. It may use a small number of strictly necessary items (for example remembering your language choice) that are exempt from consent under the Privacy and Electronic Communications Regulations. The Software uses local storage on your device for settings and caching, as described in section 5. If we introduce any non-essential cookies in future we will ask for your consent first and update this policy.
8. Who we share personal data with
We share personal data only as needed to run our business:
- Hosting and email providers that operate the website and our correspondence infrastructure on our behalf, under contract and appropriate safeguards.
- Payment and accounting providers used to take payment for commercial licences and to keep our statutory books.
- Professional advisers (accountants, lawyers) where necessary and under a duty of confidentiality.
- Authorities, regulators or law enforcement where we are required to do so by law, or to establish, exercise or defend legal claims.
- A successor entity if the business is reorganised, sold or transferred, subject to this policy.
Third-party services you connect the Software to yourself (AI providers, HMRC, banks, exchanges) receive data directly from your device under their own terms; we are not a party to that transfer.
9. International transfers
Some providers we use, and some AI providers you may choose, are located outside the United Kingdom. Where personal data for which we are responsible is transferred outside the UK, we rely on UK adequacy regulations or on standard contractual clauses / the UK International Data Transfer Agreement, together with appropriate technical safeguards.
10. How long we keep personal data
- Enquiries that do not lead to a contract: kept only as long as needed to deal with the enquiry, then deleted. We do not keep a prospect or marketing list.
- Licensing, contract and support records: for the life of the relationship and then up to 7 years, to meet accounting, tax and limitation-period requirements.
- Website server logs: retained by our hosting provider for a short period for security and diagnostics.
Data processed only on your device is kept until you delete it.
11. How we protect personal data
Keeping your personal data safe is our responsibility. We apply appropriate technical and organisational measures, including:
- encryption in transit (TLS, using the operating system's certificate store) for the website and for every connection the Software makes on your behalf;
- encryption at rest on your device: the Chameleon Accounting MTD app encrypts its whole ledger and its daily backups (SQLCipher v4 format, AES-256) with a key held in the device's secure store, alongside your access tokens and API credentials; the command-line tool encrypts its tokens and credentials (authenticated ChaCha20-Poly1305) and requires its ledger to sit on an encrypted volume;
- access controls, least-privilege administration and per-organisation isolation, with the number of people who can access personal data kept to a minimum;
- a local-first design that means your accounting data and credentials never reach our systems in the first place (sections 5 and 6);
- signed, verifiable software updates, and a built-in security self-check for the device the Software runs on;
- a published route for reporting vulnerabilities to us — see our security policy.
If a personal data breach occurs, we will act to contain it and, where the UK GDPR requires, report it to the Information Commissioner's Office within 72 hours of becoming aware; where the breach is likely to be a high risk to you, we will tell you without undue delay. Issues affecting HMRC Making Tax Digital data are also reported to HMRC within 72 hours. No system is perfectly secure, and you remain responsible for the security of your own device, credentials and backups (see section 5 and the security policy).
12. Your rights
Under UK data protection law you have the right to: be informed; access a copy of your personal data; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing; data portability; and to withdraw consent where processing is based on consent. For the personal data we hold as controller (enquiries, licensing, support, security reports), email stemsee@chameleon-ai-agent-ltd.net and we will respond within one month.
For the data held in the Software on your own device, you do not need to ask us: you can correct it in the app (via adjusting entries, so the audit trail is preserved), export a complete copy at any time in open formats (CSV, JSON and a copy of the underlying database, with a checksum manifest), and delete a company's data or everything, permanently, from within the Software. Because that data never reaches us, there is no server-side copy to request or delete. You remain responsible for keeping VAT and tax records for at least six years.
If you are not satisfied, you can complain to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — ico.org.uk — tel. 0303 123 1113. We would appreciate the chance to address your concerns first.
13. Children
The website and Software are intended for business and adult personal use and are not directed at children. We do not knowingly collect personal data from anyone under 18.
14. Changes to this policy
We may update this policy from time to time. The "last updated" date and version number above will change, and material changes will be highlighted on this page. Continuing to use the website or Software after an update means you accept the revised policy.
15. Contact
Questions about this policy or about how we handle personal data:
CHAMELEON-AI-AGENT LTD, stemsee@chameleon-ai-agent-ltd.net
Registered office: 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom