Privacy notice
How we collect, use and look after your personal information, and the choices you have. Last updated 15 October 2026.
Thank you for visiting Mortgage AI. This notice explains, as clearly as we can, what personal information we collect through mortgage-ai.uk, why we collect it, how we look after it and the choices and rights you have. We have written it for the people who use the site: mortgage and protection advisers, their colleagues and firms, and the businesses that build the AI tools we list or that would like to promote them.
It is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003 (PECR), as amended by the Data (Use and Access) Act 2025. If anything here is unclear, please email us at mortgageai@agentmail.to and we will be glad to help.
At a glance
- We collect very little: mainly your email address if you join our newsletter or waitlist, and whatever you choose to tell us when you email us.
- We only send the newsletter and waitlist emails if you tick the box to say yes. You can unsubscribe at any time with one click.
- Our website sets no cookies and uses no analytics or tracking tools.
- We never sell your personal information and we never give our subscriber list to sponsors or advertisers.
- Mortgage AI shares information about AI tools for professionals. We never need information about your clients, so please do not send us any.
1. Who we are
Mortgage AI is an independent website for UK mortgage and protection professionals. It brings together a directory of AI tools organised by the tasks advisers do every day, UK mortgage market news, a daily email newsletter and a waitlist for tools we are building.
Mortgage AI is run by Bob Duncan, a sole trader trading as Mortgage AI, who is the data controller. We are registered with the Information Commissioner's Office (ICO), registration number ZC275732. Contact: mortgageai@agentmail.to
| Detail | Information |
|---|---|
| mortgageai@agentmail.to | |
| Website | mortgage-ai.uk |
We are not required to appoint a Data Protection Officer. Privacy questions and requests sent to the email address above are read and answered.
2. The information we collect
2.1 Information you give us
| When | What we collect |
|---|---|
| You join the daily newsletter | Your email address, the fact that you ticked the consent box, the wording you agreed to, the date and time, the page you signed up on and, if our email provider records it, the IP address used at sign-up. If we use a confirmation (double opt-in) email, we also record when you confirmed. |
| You join the waitlist for our tools | Your email address, a note that you joined the tools waitlist and the same consent details as for the newsletter. |
| You use the "What should we build next?" form in our directory | The options you tick, anything you write about what slows your day down and, only if you choose to add it, your email address. This form does not send anything to us by itself: it opens your own email app with your answers filled in, so we only receive it if you press send. We will also see your name and email address as they appear in your email account, and any signature you use. |
| You use the time audit opt-in form or the adviser survey | Your email address (required for the time-audit opt-in, optional in the survey), your firm type or role (mortgage, IFA or both; solo, AR or DA), your answers (such as your biggest time-wasters, the tools you pay for and your monthly spend band, and what you would want built), your time-audit calculator totals if you send them, and whether you ticked the separate consent box for our early-access list and a 15-minute chat. The calculator itself runs only in your browser. Nothing you enter on either page is stored on our website: the forms open your own email app with your answers filled in, addressed to mortgageai@agentmail.to, so we only receive them if you press send. We will also see your name and email address as they appear in your email account. |
| You email us | Your name, email address and anything else you include, such as your firm, job title, phone number and the content of your message. This covers general questions, tool suggestions, corrections to a listing and feedback. |
| You ask about advertising or sponsorship | Your name, role, business email and phone number, the business you represent, the product you would like to promote, the placement you are interested in and our correspondence with you. |
| You become a sponsor or advertiser | The details above plus the listing or sponsor copy, logos and links you supply, billing contact details, invoices, purchase order numbers and records of what we published and when. We are not taking card payments yet, so we do not hold payment card details. |
| You exercise a privacy right or make a complaint | The details of your request, any information we need to confirm who you are and our response. |
We do not ask for, and do not want, any information about your clients. Please do not include client names, case details, financial information or anything similar in a form or an email to us. We also do not ask for any special category information (such as health, ethnicity or religious beliefs) and ask that you do not send it.
2.2 Information collected automatically
Like almost every website, our host keeps standard server logs whenever a page is requested. These logs are created by the web server at IONOS, not by any tracking code we have added, and typically include:
- the IP address of the device making the request;
- the date and time of the request and the page or file requested;
- the type of browser and operating system (known as the user agent);
- the address of the page that linked to ours, if your browser shares it; and
- whether the request succeeded and how much data was sent.
We do not use these logs to identify you. They help keep the site running, secure and free from abuse.
We want to be open about what we do not do. Our website currently sets no cookies, uses no analytics service, contains no advertising or social media tracking pixels, loads no third-party fonts, scripts or embedded videos, and does not use your browser's local storage. The search box and filters in our AI directory work entirely inside your browser, so what you type there is never sent to us.
We have switched off open and click tracking in our newsletter.
2.3 Information from other sources
- About AI tool providers and sponsors: when we research a tool for the directory or prepare a sponsorship, we use information the business has made public, such as its own website, press releases, Companies House and professional networking profiles. This is mostly about businesses, but it can include the names and business roles of founders or contacts.
- From our service providers: our email provider tells us when someone subscribes, confirms, unsubscribes or when an email bounces. We are not taking payments online yet, so no payment provider sends us payment records.
- From people who recommend a contact: if a colleague passes on your business email so that we can talk about a listing or sponsorship, we will tell you where we got your details when we first contact you.
We build our newsletter list only from people who sign up themselves. We do not buy, rent or borrow email lists, and we do not collect adviser email addresses from directories or registers to send marketing.
3. How we use your information and our lawful bases
Data protection law requires us to have a lawful basis for each way we use personal information. The table below sets out each purpose, the information involved and the basis we rely on.
| What we do | Information used | Lawful basis (UK GDPR Article 6) |
|---|---|---|
| Send you the daily Mortgage AI newsletter, including clearly labelled sponsor messages within it | Email address, consent record | Consent, Article 6(1)(a). PECR regulation 22 also requires consent for marketing emails to individuals and sole traders. |
| Tell you about the Mortgage AI tools we are building when you join the waitlist | Email address, waitlist note, consent record | Consent, Article 6(1)(a), and PECR regulation 22 |
| Keep a record of your consent and a record of people who have unsubscribed, so we never email you again by mistake | Email address, consent and unsubscribe records | Legal obligation, Article 6(1)(c) (we must be able to show consent was given), and legitimate interests, Article 6(1)(f), in respecting your wishes |
| Reply to your emails, questions, tool suggestions and listing corrections | Name, contact details, message content | Legitimate interests, Article 6(1)(f): answering people who contact us and keeping our directory accurate |
| Read and act on feedback from the "What should we build next?" form | Options ticked, free text, email address if given | Legitimate interests, Article 6(1)(f): understanding what would help advisers most before we build it |
| Use time-audit and survey answers for product research, and send everyone who leaves an email a free summary of the survey results | Answers, firm type or role, calculator totals, email address if given | Consent, Article 6(1)(a), where you give your email address and ask for the summary; legitimate interests, Article 6(1)(f), for survey answers sent without an email address: understanding where advisers lose time before we build tools |
| Add you to our early-access list and contact you about a 15-minute chat | Email address, answers, consent record | Consent, Article 6(1)(a). We only do this if you tick the separate, unticked consent box |
| Discuss, quote for and agree advertising or sponsorship | Business contact details, correspondence, proposals | Contract, Article 6(1)(b), where you are a sole trader or partner taking steps towards an agreement with us; otherwise legitimate interests, Article 6(1)(f), in dealing with the business you represent |
| Publish and manage sponsored listings and newsletter sponsorships | Sponsor copy, logos, links, business contact details | Contract, Article 6(1)(b), or legitimate interests, Article 6(1)(f), as above |
| Invoice sponsors and keep accounting and tax records | Billing contact details, invoices, payment records | Legal obligation, Article 6(1)(c), under tax and accounting law |
| Send occasional business emails to sponsors and advertisers about similar sponsorship opportunities | Business contact details | Legitimate interests, Article 6(1)(f). See section 5 for how PECR applies, and you can opt out at any time |
| List AI tools in our directory, including the names of businesses and, now and then, their founders | Publicly available business information | Legitimate interests, Article 6(1)(f): giving advisers accurate, useful information about tools on the market |
| Keep our website secure and working well, and prevent misuse | Server logs, including IP addresses | Legitimate interests, Article 6(1)(f): running a safe, reliable website |
| Respond to privacy requests and complaints | Request details, identity information | Legal obligation, Article 6(1)(c) |
| Establish, exercise or defend legal claims and keep proper business records | Any relevant records | Legitimate interests, Article 6(1)(f), and where relevant legal obligation, Article 6(1)(c) |
Where we rely on legitimate interests, we have weighed our interests against your rights and expectations and are satisfied that the way we use your information is proportionate and what you would reasonably expect. You can ask us for more detail about that assessment, and you have the right to object (see section 12).
Where we rely on consent, you can withdraw it at any time. Doing so does not affect anything we did with your information before you withdrew it.
Time audit and adviser survey. We only add people to the early-access list, or contact them about a 15-minute chat, with explicit consent given by ticking the separate box, which is never ticked for you. To withdraw your consent or ask us to delete your answers, email mortgageai@agentmail.to and we will remove you from the early-access list and delete your answers. Nothing from these pages is stored on our website; answers reach us only as an email you choose to send.
We will only use your information for the purposes above, or for a new purpose that is compatible with them. If we ever want to use it for something different, we will tell you first and, where needed, ask for your consent.
4. Our newsletter and waitlist: consent and unsubscribing
We would love you to hear from us, but only if you want to. Here is how we make sure the choice is yours:
- You opt in. Each sign-up form has a consent box that starts unticked. You need to tick it yourself, and it is separate from anything else on the page.
- Separate choices. The daily newsletter and the tools waitlist are separate lists with separate boxes. Joining one does not sign you up to the other.
- We say what you will get. The newsletter is a short daily email with UK mortgage news, rate movements and AI tools worth knowing about. It may include messages from our sponsors, which will always be labelled as sponsored. The waitlist is for news about the Mortgage AI tools we are building, including when they launch and how much they cost.
- Confirmation. We send a confirmation email and only add you to the list once you click the link in it.
- We keep a record. We store when and how you agreed, and the wording you saw, so we can show that you chose to hear from us.
How to unsubscribe
Every email we send includes an unsubscribe link at the bottom. One click is enough and you will not be asked to log in or explain why. You can also email mortgageai@agentmail.to with the word "unsubscribe" and we will remove you for you.
We stop emailing you as soon as our email system processes the request, and as quickly as we can if you email us. We then keep your email address on a suppression list (a short record of addresses we must not email) so that you are not added back by accident. Every marketing email will also show who it is from.
We do not pass your email address to sponsors, advertisers or anyone else for their own marketing.
5. Business-to-business emails, sole traders and PECR
PECR sets rules for marketing by email and treats two kinds of recipient differently:
- Corporate subscribers, such as limited companies, limited liability partnerships, Scottish partnerships and public bodies. PECR allows marketing emails to their business addresses without prior consent, as long as the sender is identified and an easy way to opt out is given.
- Individual subscribers, which include sole traders and some partnerships in England, Wales and Northern Ireland. They are treated like members of the public, so marketing emails need their prior consent (or the narrow "soft opt-in" for existing customers).
Many mortgage and protection advisers are self-employed or run their business as sole traders, and we cannot tell from an email address which group you are in. So we treat everyone the same: we only send our newsletter and waitlist emails to people who have actively opted in, whatever kind of business they work for.
For sponsors and advertisers who have bought from us or talked to us about a sponsorship, we may send occasional emails about similar sponsorship opportunities. If you are a sole trader or partner, we only do this under the soft opt-in rule: you gave us your details during those discussions, the emails are about similar services of ours, and you are given a clear chance to opt out when we first collect your details and in every email after that.
Even when PECR allows a business email, UK GDPR still applies when an address identifies a person (for example a named mailbox at a firm). You always have an absolute right to tell us to stop sending you marketing, and we will.
6. Sponsors, advertisers and sponsored content
Mortgage AI is partly funded by businesses that pay to promote their products. To keep things fair and transparent for everyone:
- Every paid placement, whether on the website or in the newsletter, is clearly labelled "Sponsored".
- Sponsors never receive our subscriber list or any personal information about our readers.
- When you click a link to a tool provider or sponsor, you leave our website. That business is responsible for its own website and for any information it collects from you, under its own privacy notice. Your browser may tell the destination site that you arrived from Mortgage AI.
- Some links to tools in our directory are affiliate or partner links. If you sign up through one, we may earn a commission at no extra cost to you. These links are marked beside the listing, they never change our reviews, and we do not use tracking cookies.
If you are a sponsor or advertiser, we use the business contact details of the people we deal with to discuss, agree, deliver and invoice the sponsorship, as set out in sections 2 and 3. We keep these records for the periods in section 9. Your own customers' or prospects' information is never needed and should not be sent to us.
7. Who we share your information with
We use a small number of trusted service providers to run Mortgage AI. They act as our processors, which means they may only use your information on our instructions and under a written contract that requires them to keep it secure and confidential.
| Provider | What they do for us | Where your information is held | Safeguard |
|---|---|---|---|
| IONOS (IONOS SE and its UK company IONOS Cloud Ltd) | Host our website and domain, and keep the server logs described in section 2.2 | With IONOS, on the hosting product used for this website | IONOS data processing agreement. Transfers to the EU or EEA are covered by UK adequacy regulations. |
| AgentMail, Inc. | Provides our email inbox, mortgageai@agentmail.to, which receives your emails, enquiries and feedback form answers | United States | AgentMail provides this inbox under its terms. Transfers to the United States are covered as described in section 8. |
| xAI (Grok) | Helps us draft website content. A person reviews what it produces before it is published (see section 13). | United States | Used under xAI's terms. We keep personal information out of it wherever we reasonably can. |
We do not currently use any online form service or website analytics service. Our sign-up forms are not yet connected to any provider, and our feedback form works through your own email app. If we add any new provider, we will update this notice before it starts handling your information.
We may also share information, only where necessary, with:
- professional advisers such as our accountant, lawyers or insurers, who are bound by confidentiality;
- HM Revenue and Customs, regulators, the police or courts, where the law requires it or to protect our rights or the safety of others; and
- a buyer or successor if Mortgage AI, or part of it, is ever sold or transferred, in which case your information would stay protected by this notice or one at least as protective, and we would tell you.
We never sell your personal information, and we never share it with third parties for their own marketing.
8. International transfers
Some of our providers store or access information outside the UK. Whenever your personal information is transferred outside the UK, we make sure it stays protected to the standard UK law requires, by using one of the following:
- a country the UK Government has found to give adequate protection under UK adequacy regulations (this includes the countries of the European Economic Area);
- for transfers to the United States, the UK Extension to the EU-US Data Privacy Framework (the UK-US "data bridge"), where the recipient is certified under it; or
- the ICO's International Data Transfer Agreement, or the International Data Transfer Addendum to the European Commission's standard contractual clauses, together with a transfer risk assessment and any extra safeguards needed.
Section 7 shows where each provider holds information and which safeguard applies. You are welcome to ask us for more detail or a copy of the relevant safeguard by emailing mortgageai@agentmail.to.
9. How long we keep your information
We keep personal information only for as long as we need it for the purposes in this notice, and then delete it securely or make it fully anonymous.
| Information | How long we keep it |
|---|---|
| Newsletter subscriber details | Until you unsubscribe. You are removed from our sending list straight away, and the rest of your subscriber record is deleted as quickly as we can. |
| Waitlist details | Until we have told you that our tools are available, or 24 months after you joined, whichever comes first, unless you choose to stay on the list. |
| Consent records | For as long as you are subscribed, and for 2 years after you unsubscribe, so that we can show consent was given if ever asked. |
| Suppression list (unsubscribed addresses) | Your email address only, for as long as we send marketing emails, so that we never email you again by mistake. |
| Emails, questions, tool suggestions and listing corrections | 24 months from our last contact with you |
| Feedback form answers | 24 months from when we receive them. We may keep anonymous summaries, which no longer identify anyone, for longer. |
| Time-audit opt-in and adviser survey answers, and the early-access list | Up to 24 months from when we receive them, or until you withdraw your consent, whichever comes first. We may keep anonymous summaries, which no longer identify anyone, for longer. |
| Advertising or sponsorship enquiries that do not go ahead | 24 months from our last contact |
| Sponsor agreements, invoices and accounting records | 6 years from the end of the financial year they relate to, as required by tax and accounting law |
| Server logs held by IONOS | Kept by IONOS for its standard security log period, then deleted. We do not keep a separate copy. |
| Privacy requests and complaints | 2 years after the request or complaint is closed |
We may keep information for longer if the law requires it, or if it is needed in connection with a legal claim or complaint, and only for as long as that need lasts.
10. Cookies and similar technologies
Cookies are small files that a website can store on your device. PECR says that, apart from those strictly necessary to provide a service you have asked for, a website must ask for your consent before using them or any similar technology (such as tracking pixels or local storage).
Our website does not set any cookies at all, including strictly necessary ones, and does not use any similar technologies. That is why you will not see a cookie banner when you visit.
| Type | Do we use it? |
|---|---|
| Strictly necessary cookies | No |
| Analytics or statistics cookies | No |
| Advertising or social media cookies and pixels | No |
| Third-party embeds (videos, maps, social posts) | No |
| Local storage or browser fingerprinting | No |
If this ever changes, for example if we add analytics, we will update this notice and the table above first. Where consent is required we will ask for it before anything is set, with "Accept" and "Reject" options that are equally easy to choose, and you will be able to change your mind at any time.
The websites of tool providers and sponsors that we link to may use their own cookies. Please check their cookie and privacy notices.
11. How we keep your information safe
We take the security of your information seriously and use measures that fit the small amount of information we hold, including:
- an encrypted connection (HTTPS) for our website;
- a static website with no database or user accounts on our web server, which greatly limits what could ever be exposed;
- collecting only what we need, and deleting it on the schedule in section 9;
- strong, unique passwords and two-step verification on the accounts we use to run Mortgage AI;
- access to personal information limited to Mortgage AI and to the providers listed in section 7; and
- written contracts with our providers that require them to keep information secure and confidential.
No system can be completely secure, and email in particular is not always encrypted end-to-end, which is another reason we ask you never to send us client information. If a personal data breach happens that is likely to put your rights at risk, we will report it to the ICO within 72 hours of becoming aware of it and, where the risk to you is high, we will tell you directly and without undue delay.
12. Your rights
You have important rights over your personal information. They are free to use in almost all cases, and we will be glad to help.
| Your right | What it means |
|---|---|
| Right to be informed | To be told clearly how your information is used. This notice is part of that. |
| Right of access | To ask for a copy of the personal information we hold about you, and details of how we use it. |
| Right to rectification | To ask us to correct information that is wrong, or complete information that is incomplete. |
| Right to erasure | To ask us to delete your information. We will do so unless we need to keep some of it, for example invoices we must keep by law, or the suppression list entry that stops us emailing you again. |
| Right to restriction | To ask us to pause using your information, for example while we check whether it is accurate or consider an objection. |
| Right to data portability | To receive information you gave us, where we use it based on your consent or a contract, in a commonly used digital format, or to ask us to send it to another organisation where that is technically possible. |
| Right to object | To object to us using your information based on legitimate interests. We will stop unless we have compelling legitimate grounds that override your interests, or need it for legal claims. You have an absolute right to object to direct marketing: if you tell us to stop, we always will. |
| Right to withdraw consent | Where we rely on your consent, such as for the newsletter and waitlist, you can withdraw it at any time by unsubscribing or emailing us. It is as easy to withdraw consent as it was to give it. |
| Rights about automated decisions | If a significant decision about you is made solely by automated means, with no meaningful human involvement, you have the right to be told about it, to make representations, to ask for a person to step in and to challenge the decision. We do not make any such decisions (see section 13). |
How to use your rights
Email mortgageai@agentmail.to and tell us what you would like us to do. You do not need to use any particular words or form. If we need to confirm your identity, we will ask only for what is reasonable, for example asking you to reply from the email address you subscribed with.
We will respond without undue delay and within one month. If a request is particularly complex, or you send several, we may extend this by up to two further months; if so we will tell you within the first month and explain why. When searching for your information we will carry out reasonable and proportionate searches. In rare cases where a request is clearly unfounded or excessive, we may charge a reasonable fee or decline, and we will explain our reasons and your options.
13. Automated decisions, profiling and our use of AI
Mortgage AI is about artificial intelligence, so we want to be especially clear about how we use it ourselves.
- No automated decisions about you. We do not make any significant decision about you (one with a legal or similarly significant effect) based solely on automated processing, meaning with no meaningful human involvement.
- No profiling for marketing. We do not build profiles of individual readers, score or rank subscribers, or combine your information with data from other sources to target you. Everyone on a list receives the same newsletter.
- How we use AI tools. We use AI assistants to help research tools for the directory and to draft website and newsletter content. We may also use them to help sort, summarise and draft replies to emails sent to us. A person always reviews the result and makes the decisions. We keep personal information out of AI tools wherever we reasonably can.
- Our directory lists tools. Listing a tool is not an endorsement, and it is not a recommendation of any product.
14. Children
Mortgage AI is a resource for mortgage and protection professionals and is not intended for anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us their information, please contact us and we will delete it.
15. Links to other websites
Our directory and sponsored listings link to other organisations' websites. We are not responsible for how those organisations handle personal information, and this notice does not cover them. We encourage you to read the privacy notice of any website you visit, particularly before using an AI tool with any information about your clients.
16. Questions and complaints
If you have a question or concern about how we handle your personal information, please tell us first by emailing mortgageai@agentmail.to with "Privacy complaint" in the subject line. We aim to reply promptly, look into it properly, keep you updated and tell you the outcome without undue delay. We genuinely want to put things right.
You also have the right to complain at any time to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection:
- Online: ico.org.uk/make-a-complaint
- Phone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
The ICO usually expects you to raise your concern with us first, but that does not affect your right to go to them.
17. Changes to this notice
We will update this notice whenever we change how we use personal information, for example when we connect a newsletter provider, add analytics or start taking payments online. The date below shows when it was last updated. If we make a significant change, we will tell our subscribers by email before it takes effect and, where the law requires it, ask for your consent again.
Last updated: 15 October 2026