Privacy Policy

1. Who we are

3me.ai ("3me", "we", "us") is operated by Kristina Rutherford Consulting Ltd, a company registered in England and Wales (company number 14737182), registered office: 37 Bull Street, Holt, England, NR25 6HP. We are the data controller for the personal data described in this policy.

Questions, requests, or complaints about your data: kristina@3me.ai.

2. The data we collect

Data you give us

Account data: your name, email address, and password (stored as a secure hash) when you create an account, and your email address if you join our waitlist.
Business and brand data: your business name, website address, and your answers to our onboarding questionnaires (brand story, audience, voice, offers).
Content and media: images, videos, copy, and other material you upload or create in the platform, and edits you make to generated content.
Support data: messages, screenshots, or videos you send when contacting support.
Billing data: your subscription status and billing history. Card details are collected and held by our payment provider, Stripe; we never see your full card number.

Data we collect automatically

Website content: when you give us your business website address, we read publicly available pages from it to learn about your brand. This can include personal data published on your site (for example, team bios or customer testimonials).
Connected social account data: when you connect a social media account, we receive profile details (username, display name, profile image, follower counts), your post history, and performance analytics for that account, via our social publishing provider.
Usage and device data: how you use the product (pages visited, actions taken, onboarding progress), error logs, and technical data such as browser type and referrer.
Marketing attribution: if you arrive from an ad or campaign link, we record campaign parameters (such as UTM tags and ad click IDs) so we know which marketing works.
Cookies and analytics: see section 9.

3. How we use your data and our lawful bases

To provide the service (lawful basis: performance of a contract): creating your account, learning your brand, generating and scheduling content, publishing approved posts to your connected accounts, billing, and support.
To improve and secure the service (legitimate interests): usage analytics, error monitoring, preventing abuse and trial misuse, and developing features.
To communicate with you (contract and legitimate interests): service emails such as account verification, password resets, trial and billing notices, and support replies. Marketing emails to waitlist members and customers are sent under legitimate interests or consent, and you can unsubscribe at any time.
To comply with the law (legal obligation): tax, accounting, and responding to lawful requests.

4. How AI is used with your data

To create your content, we send relevant brand data: such as your website copy, questionnaire answers, and draft captions: to established third-party AI providers via their business APIs.
Under our agreements with these providers, your content is not used to train their general AI models.
Where we build a custom "brand voice" model for you, it is trained only on your brand's content and used only to deliver your service. We do not use one customer's content to generate content for another customer.
We keep an internal log of AI requests (model used, token counts, and cost) for billing and quality purposes.

5. Who we share data with

We never sell your personal data. We share it only with service providers (processors) who help us run 3me, under contracts that protect your data. These fall into the following categories:

Cloud hosting, database, and storage providers: running the platform and storing your data securely.
Payment provider (Stripe): payments and subscription billing.
Social publishing provider: connecting your social accounts and publishing approved posts on your instruction. This provider holds the access tokens for your connected social accounts.
AI providers: generating your content (see section 4).
Visual rendering provider: producing images, carousels, and video from your approved designs.
Email delivery provider: sending waitlist, support, and service emails.
Analytics (Google Analytics): on our marketing pages only, and only if you accept analytics cookies.

A current list of our sub-processors is available on request from kristina@3me.ai.

We may also share data where required by law, or as part of a sale, merger, or reorganisation of our business (in which case this policy will continue to apply to your data).

6. International transfers

Some of our providers process data outside the UK, including in the United States. Where data leaves the UK, we rely on safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement or Addendum, UK adequacy regulations, or the UK Extension to the EU–US Data Privacy Framework, as applicable to each provider.

7. How long we keep data

Account, brand, and content data: for as long as your account is active, and for up to 90 days after closure so you can change your mind, after which it is deleted or anonymised.
Billing records: up to 7 years, as required for tax and accounting.
Support correspondence: up to 2 years after the ticket is closed.
Records of your consent and terms acceptance: for as long as needed to evidence them.
Waitlist emails: until you unsubscribe or we close the list.

8. Your rights

Under UK GDPR you have the right to:

access a copy of your personal data;
correct inaccurate data;
have your data erased;
restrict or object to certain processing (including direct marketing, which we will always stop);
data portability for data you provided to us;
withdraw consent at any time where processing is based on consent.

To exercise any right, email kristina@3me.ai. We will respond within one month. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, although we would appreciate the chance to resolve your concern first.

9. Cookies

Essential cookies: used to keep you signed in and the service secure. These are always on.
Analytics cookies (Google Analytics): used on our marketing pages only, and only if you accept them via the cookie banner. You can accept or reject these when the banner appears, and change your mind by clearing your browser data for this site.

We do not use advertising or social media tracking pixels on this site.

10. Security

We protect your data with measures including encryption in transit, access controls, row-level database security, and least-privilege access for our team. No system is perfectly secure; if a breach occurs that puts your rights at risk, we will notify you and the ICO as required by law.

11. Children

3me is a business tool for adults. It is not intended for, and must not be used by, anyone under 18, and we do not knowingly collect data from children.

12. Third-party personal data you provide

If the content or websites you provide to us include other people's personal data (for example, customer testimonials or team photos), you are responsible for ensuring you have the right to use it. We process it only to provide the service to you.

13. Changes to this policy

We may update this policy as the product and the law evolve. We will post changes here and, for material changes, notify you by email or in the app. The "last updated" date at the top shows the current version.

14. Governing law

This policy and any dispute arising from it are governed by the laws of England and Wales, and subject to the jurisdiction of the courts of England and Wales.

Last updated: 11 June 2026