Privacy notice

Version 2026-10-23. Last updated: 23 October 2026

This notice explains how Cantis Ltd ("Cantis", "we", "us") collects and uses personal data through the website at cantis.ai and its waitlist. The Cantis app has its own privacy notice. If someone testing the Cantis app has written to you, see information for the people testers write to.

Who we are

Cantis Ltd is the controller of the personal data described in this notice. We are a company registered in England and Wales, company number 17408269, with our registered office at 128 City Road, London, EC1V 2NX, United Kingdom. We are registered with the Information Commission (ICO) under number ZC226320.

Contact us about this notice or your personal data at hello@cantis.ai.

The personal data we collect

When you join the waitlist, we collect:

• your name, if you give it
• your email address
• your role, chosen from a list
• whether you would like free early access to the beta, and your confirmation that you use Windows with Outlook or Teams
• a record of your consent: the date and time you joined, the version of the form and of this notice in place at the time, and, where relevant, when you renewed your place on the list and when we invited you to the beta

If you choose to, you can also give us:

• a description of a message that nearly went wrong
• a message you found hard to write, with the role of the person it was written to

If you email us, we keep your message, your email address and our reply.

When you use a share option on the site, we count it as one use of that option on that day. The count contains no information about who used it and is not personal data.

We also count how many times the pages of this site are opened each day, as a single number for each day. The count contains no information about who opened them and is not personal data.

How we use your personal data, and our lawful basis

• To run the waitlist and email you about Cantis and early access. Lawful basis: your consent, given when you join.
• To choose and invite people to the beta. We use your role, your answer about early access and, if you gave one, your description of what nearly went wrong, to select a mix of participants. Lawful basis: your consent.
• To send one email confirming that you have joined. This also tells you if someone else used your address. If someone else enters your email address, we receive it from the person who completed the form. Lawful basis: our legitimate interest in confirming that each address on the list belongs to the person who gave it.
• To develop Cantis, including training and testing the models behind its coaching. We review the text you give us before we use it. An automatic check first marks text that may contain sensitive or identifying details, and a person at Cantis reads that text. Other text is reviewed with the help of an AI service (see "Who we share your personal data with"). To use the text, we make a copy in which anything that could identify a person, such as names, company names, places, dates and contact details, is removed or replaced, so that no one can reasonably be identified from it. Once we have made the anonymised copy, or decided not to use the text, we delete the original. From that point the copy cannot be linked to you and is no longer personal data. Where identifying details cannot be removed, or the text contains special category data, we delete it instead. Lawful basis: for a message you share using the tick box, your consent. For a description of what nearly went wrong, our legitimate interest in developing a product that reflects real workplace communication. You can object to this at any time.
• To reply to you and handle requests and complaints. Lawful basis: our legitimate interest in answering people who contact us, and our legal obligation to handle requests and complaints about personal data.
• To run the website and keep it secure. Cloudflare processes your IP address and similar technical data to send you each page, to protect the site from attacks and spam, and to limit how often the form and the share options can be used. We do not keep logs of visits and we do not link this data to your waitlist details. We use Cloudflare Web Analytics to count visits to each page. For each visit, Cloudflare receives the page, the page you came from, your browser and device type, your country (worked out from your IP address) and how long the page took to load. It sets no cookies, stores nothing on your device and does not build a profile of you. We see only totals. Cloudflare keeps these figures for up to six months. We do this because we have a legitimate interest in knowing which pages people read, so we can improve the site. Cloudflare handles this for us and is listed at cantis.ai/suppliers. Lawful basis: our legitimate interest in operating a secure website.

You can withdraw your consent at any time by emailing hello@cantis.ai or replying to any email from us. Withdrawing consent does not make our earlier use of your data unlawful. If you withdraw consent for a message you shared before we have reviewed it, we delete it. After review we hold only an anonymised copy, which cannot be linked to you.

Information about other people

We ask everyone who writes to us not to name or identify anyone else, and not to include special category data about anyone. This means information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation, and criminal allegations or convictions.

If you are mentioned in a submission despite this, we received the information from the person who wrote it, not from you. It will be a description of a workplace message or situation. We use it only for the review described above, on the basis of our legitimate interest. We remove anything that identifies you when we make the anonymised copy, and we delete the original after review. Any special category data is deleted, not used. You have the same rights under this notice as anyone else.

Who we share your personal data with

We use the following service providers, who process personal data on our behalf under contracts that restrict how they can use it:

• Cloudflare, Inc. hosts the website, stores the waitlist, sends the confirmation email and provides Cloudflare Web Analytics (visit counts). The waitlist database is held in the European Union. Cloudflare also uses some technical data, such as IP addresses, for its own network security, as a separate controller under its own privacy policy.
• Microsoft hosts our email at hello@cantis.ai.
• AI service providers. We currently use Anthropic to help review submitted text and make the anonymised copy. Text that our automatic check marks as possibly sensitive is read only by a person at Cantis and is not sent to an AI service. AI service providers act only on our instructions, under commercial terms that do not allow them to use the text to train their own models.

We do not sell your personal data or share it for advertising. We may disclose personal data where the law requires it. If we change or add an AI service provider, we will name it in this notice.

International transfers

The waitlist database is held in the European Union, which the UK recognises as providing adequate protection. Cloudflare, Microsoft and Anthropic may process data in other countries, including the United States. Transfers to the United States are made under the UK Extension to the EU-US Data Privacy Framework where the provider is certified, or otherwise under the UK International Data Transfer Addendum or an equivalent safeguard in the provider's data processing terms. You can request a copy of the relevant safeguard by emailing hello@cantis.ai.

How long we keep your personal data

• Waitlist details: two years from when you join. Before then we may ask whether you want to stay on the list. If you say yes, we keep your details for a further two years. Otherwise we delete them.
• Text you submit: kept until we have reviewed it, and deleted with your waitlist details if that is sooner. After review we keep only the anonymised copy, if one was made. It is not linked to you and is not affected by a later request to delete your details.
• Emails: for as long as needed to deal with your enquiry, and in any case no longer than 12 months after our last exchange or, if you are on the waitlist, no longer than your waitlist details, whichever is later. Records of complaints are kept for two years after the complaint is closed.

Deleted data is removed from our database backups within 30 days.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• restrict how we use your data
• receive your data in a portable format
• object to our use of your data
• withdraw your consent at any time

Your right to object. You can object at any time to our use of your personal data where we rely on legitimate interests, and to its use for direct marketing. If you object to direct marketing, we will stop.

To exercise any of these rights, email hello@cantis.ai. We will respond within one month. If a request is complex we may extend this by up to two further months, and we will tell you within the first month if we do. We may ask you to confirm your identity.

Complaints

You have the right to complain to us about how we use your personal data. Email hello@cantis.ai with "Complaint" in the subject line. We will acknowledge your complaint within 30 days, investigate it without undue delay, keep you informed and tell you the outcome.

You also have the right to complain to the Information Commission (ICO), which regulates data protection in the UK, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects on you.

Providing your data

You are not required to give us any personal data. To join the waitlist you must give us your email address, choose your role, and confirm that the address is yours and that we may email you about Cantis and early access. The request for early access and the free-text boxes are optional. Without the required information you cannot join the waitlist.

Children

The waitlist is intended for working adults and is not directed at anyone under 18.

Cookies and similar technologies

This website does not store anything on your device for analytics or advertising, and it does not use any technology to follow visitors across sites. Our hosting provider, Cloudflare, may set security cookies, such as __cf_bm, to tell people from automated traffic. These are strictly necessary and exempt from consent under the Privacy and Electronic Communications Regulations. Nothing else is stored on your device. Our visit counts come from Cloudflare Web Analytics, which uses none of these.

The opening animation on the home page reads your browser's reduced-motion setting, the size of your screen and the address of the page you came from, only to decide whether and how to show it on your device. None of this is stored or sent to us. You can skip the animation at any time with the Skip button, a click or a key press, or open the site without it at cantis.ai/?opening=off.

Changes to this notice

We will update the version and date at the top of this notice when we change it. If a change affects how we use personal data you have already given us, we will email you before it takes effect.