Privacy Policy

Last updated: August 2026

We do not sell personal data. We do not use advertising trackers.

Who we are

Ethics Insight Ltd is the data controller for the personal data described in this policy. We are a company registered in England and Wales.

Ranulph is our structured integrity-risk analysis service. It is part of Ethics Insight, not a separate company. Where Ranulph is used through an authorised login at ranulph.ai, Ethics Insight remains the controller.

What we collect

Enquiry data. When you use our contact form we collect your name, work email, organisation if you give it, what your enquiry relates to, and your message.

Our contact form asks you not to send names, allegations, or sensitive evidence. If you need to share that kind of material, we agree a secure route with you after an initial conversation.

Engagement data. When you work with us, we process the documents, data, and information you share so we can carry out the review, assessment, or investigation you have asked for. This often includes commercially sensitive material.

Ranulph account data. Where you have authorised access to Ranulph, we process the information needed to create and authenticate your account, including your work email, name, organisation, role, and login records.

Technical data. Our hosting and server logs record IP addresses, browser and device information, and basic request metadata.

Correspondence. If you email us or speak to us, we process that exchange.

What we use it for

We use personal data to:

• respond to enquiries and send resources you have asked for
• deliver the engagements you have contracted us for
• operate and authenticate Ranulph access
• carry out integrity risk analysis, fraud diagnostics, and investigations
• send service messages about work in progress
• keep our systems secure and investigate misuse
• meet legal and regulatory obligations
• establish, exercise, or defend legal claims

We do not send marketing without your consent. Where we do, every message has a clear way to opt out.

How Ranulph uses AI

Ranulph applies structured analysis, built around our Risko™ integrity-risk framework, to organise information, compare it against known integrity-risk patterns, and highlight anomalies and questions worth closer examination. Where source material is used, findings link back to it.

Whether a person reviews the output depends on how you use Ranulph.

• Working through Ethics Insight. A senior specialist reviews the analysis before anything is delivered to you. This is how most engagements run.
• Approved direct access. Where we have approved you for direct access to part of Ranulph, outputs are generated without a specialist reviewing each one first.
• A mix of the two. Some clients arrange a hybrid. What applies to you is set out in your engagement documentation.

Every source feeding the Risk Index is approved by Ethics Insight, whichever route you use.

Ranulph supports professional judgement. It does not prove misconduct and does not replace an investigation.

We do not use your material to train externally available AI models. We contract with our AI providers on terms intended to stop your data being retained or used for their model training. Where we develop the Risko™ framework, we work from aggregated and anonymised insight, never from client-identifying or deal-identifying material.

If you want to know how AI was used in a particular piece of analysis, ask us and we will explain.

Automated decision-making

We do not make decisions about individuals by automated means alone where those decisions would have legal effects, or similarly significant effects, on them.

Ranulph produces analysis, not decisions. Where you use approved direct access and an output is generated without specialist review, it remains analytical support. Decisions about people, transactions, or businesses are made by you, and you remain responsible for them.

If you think a decision has been made about you on a solely automated basis, contact us and we will look into it.

Sensitive material

Fraud concerns, whistleblower reports, investigation material, and deal-sensitive documents need more care than ordinary correspondence.

• We do not ask for this material through the public contact form. We agree a secure route with you first, case by case, appropriate to the sensitivity involved.
• Access is limited to the people working on your matter, including any vetted specialist partners. You will know who they are.
• Specialist partners sign confidentiality agreements before receiving anything.
• We use this material only to deliver the work you asked for.
• We do not disclose it outside your engagement except where the law requires it.

Confidentiality is an operational commitment, not just a clause. It does not override your statutory rights under UK data protection law.

Information about other people

Some of our work involves information about people who have not contacted us. In a due diligence review that might be a director or owner of a business being assessed. In an investigation it might be someone named in a report.

This is infrequent, but where it happens:

• We process only what is relevant and proportionate to the matter.
• Where the information concerns alleged criminal offences, we process it under the conditions available to us in Schedule 1 of the Data Protection Act 2018, and we keep the policy documentation those conditions require.
• We do not disclose it beyond those involved in the engagement, except where the law requires it.
• We delete or anonymise it when we no longer have a legitimate need for it.

Where we hold information about you that came from somewhere other than you, you may have the right to be told. In some cases the law lets us not tell you, for example where doing so would prejudice the prevention or detection of crime or the conduct of an investigation, or where telling you would take disproportionate effort. We apply those exemptions matter by matter and record why, rather than as a blanket rule.

If you think we hold information about you in connection with an assessment or investigation, contact us at hello@ethicsinsight.co. We will respond, though what we can tell you may be limited.

Our legal grounds

Legitimate interests. Running the website securely, responding to enquiries, managing our business, and carrying out integrity and risk analysis for clients. We have assessed that these interests are not overridden by the rights of the people concerned.

Contract, and steps before a contract. Where you contact us about a service or we are delivering an engagement.

Legal obligation. Where the law requires us to keep or disclose information.

Where we process criminal offence data, we also rely on a condition in Schedule 1 of the Data Protection Act 2018, as described above.

Who else processes your data

• Netlify. Hosts this website and routes contact form submissions.
• Postmark. Sends the requested complaint guide to the work email provided through the public guide-request form.
• Supabase. Authentication and access management for Ranulph.
• DigitalOcean. Infrastructure hosting for the Ranulph platform.
• Advanced Analytica Ltd. Designed and built the Ranulph platform.
• AI model providers. Process submission content to produce analysis, under terms preventing use of your data for training their models.

Sub-processors may not use your data for their own unrelated purposes. We put data processing agreements in place with anyone processing personal data on our behalf.

Cookies

This public site does not currently use optional analytics cookies, advertising cookies, or a cookie banner.

The site may still involve limited technical storage or request metadata needed for hosting, security and form delivery through our providers. If optional analytics or marketing tools are introduced later, this notice will be updated before they are switched on.

How long we keep it

Where a matter is under legal hold, we keep it for as long as the hold lasts and record why.

When we no longer have a legitimate need for personal data, we delete or anonymise it. Where deletion is not immediately possible, for example in a backup, we restrict access and delete it on the next cycle.

Sending data outside the UK

Some of the providers we use process data outside the UK, including in the United States. Where that happens we rely on recognised safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK-US Data Bridge, so your data is protected to a standard equivalent to UK law.

Security

We apply access controls, confidentiality obligations, and human oversight of AI-assisted work, proportionate to the sensitivity of what we handle.

No internet service can be guaranteed completely secure. If you spot a security problem affecting your data or your account, tell us straight away at hello@ethicsinsight.co.

Your rights

You can ask us to:

• give you a copy of the personal data we hold about you
• correct data that is wrong or incomplete
• delete your data, in certain circumstances
• restrict or stop certain processing
• give you your data in a portable format, where that right applies
• stop processing based on consent, by withdrawing it

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

To exercise any of these, email hello@ethicsinsight.co. We may need to confirm your identity first.

We will respond within one calendar month. If your request is complex, or you have made several, we may take up to two months longer, and we will tell you within the first month if so.

Some rights are qualified rather than absolute, and exemptions apply to investigation and legal claim material. Where we cannot fully meet a request, we will tell you why.

Other websites

We link to other sites, including our LinkedIn, Substack, and Instagram pages. We are not responsible for how they handle your data. Read their policies separately.

If the business changes hands

If Ethics Insight is sold, merges, or enters insolvency, personal data may transfer as part of that. Any new owner would handle it in line with this policy, and we would tell you about any material change.

Children

Ethics Insight is a professional service for businesses and organisations. It is not aimed at children, and we do not knowingly collect personal data from anyone under 13.

Changes to this policy

We update this policy when our services, systems, or legal obligations change. The version on this page is the current one, and the date at the top shows when it last changed.

Contact