Privacy Policy

ai2 (ai2.design) is a design system product operated by BEY AGENCY LTD, a private limited company registered in England and Wales under company number 16435596, with a registered office at 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ. BEY AGENCY LTD is the data controller for the personal data described in this policy.

For any privacy question or to exercise your rights, you can reach us at hi@bey.agency or hello@ai2.design. Both addresses reach the same team. Our supervisory authority is the UK Information Commissioner's Office (ICO), ico.org.uk.

This policy covers the ai2 website and its current features: the free open-core component registry, the documentation, the MCP server, and the two free tools (the Extractor and the Inspiration Gallery). It explains what personal data we handle when you use these, the lawful basis for it, who we share it with, and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We aim to collect as little personal data as possible. When you subscribe to updates we use a double-opt-in step, and payment is processed by Polar Software, Inc., our merchant of record, so that we never handle your card details. This policy describes processing that is actually happening today rather than everything we might one day do.

We handle the following categories of personal data. We do not intentionally collect special category data (such as health, biometric, religious or political data) and the service is not directed to children.

Newsletter and waitlist signups use a double-opt-in flow: when you submit a form we send a confirmation email, and your address is only added to our list after you click the link in it. Subscriber addresses are handled by Resend, our email provider (see section 7). You can unsubscribe from any email at any time.

• Operating, maintaining and securing the ai2 site, registry, documentation and MCP server.
• Running the Extractor: fetching the public URL you submit server-side and returning the derived tokens at a private link that expires automatically.
• Responding to support emails and keeping a record of the correspondence.
• Sending the newsletter or waitlist updates you have asked for, after you confirm through double-opt-in.
• Validating licence keys for paid tiers and keeping a record of the purchase. The key itself is generated and delivered to you by Polar, our merchant of record; we check it against Polar rather than issuing it.
• Emailing product download links to the address on your licence when you request a download, and counting those requests against your licence so the fair-use limit can be applied.
• Detecting, preventing and responding to abuse, fraud and security incidents.
• Meeting our legal, regulatory and accounting obligations.

We measure aggregate usage and page speed using Vercel Web Analytics and Vercel Speed Insights. These are cookieless: they set nothing on your device and read nothing from it. Vercel derives a hash from the incoming request so that one visit can be told apart from another, and discards it after 24 hours; we receive page views, page-speed measurements, referrers, filtered query parameters, an approximate location no more precise than city level, and device, operating system and browser type. We cannot identify you from this, we cannot follow you across other websites, and we do not attempt to link it to your licence, your email address or anything else we hold. We use no ad networks and no behavioural profiling, we do not carry out automated decision-making that produces legal or similarly significant effects, and we do not sell personal data.

We rely on the following lawful bases under Article 6 of the UK GDPR for each purpose:

This site sets no cookies beyond what is strictly necessary and uses no tracking cookies. Our analytics are cookieless and store nothing on your device, which is why you are not asked to accept a cookie banner here. Your theme preference and your roadmap votes are kept in your browser's local storage and are not transmitted to us. The licence session, if you sign in to the licence portal, is also kept in local storage, but it holds your licence key and that key is transmitted when we validate it or send you a download. Full details of each item are in the Cookie Policy at /legal/cookies.

We share personal data only with service providers who process it on our behalf under contract, and only as needed to run the service. We do not sell personal data. A provider only receives data for the feature it powers.

We may also disclose personal data where required by law, by a valid court order, or where necessary to protect our rights, property or safety or those of others.

Some of our providers may store or process personal data outside the United Kingdom. Where that happens, we rely on an appropriate safeguard under the UK GDPR: a UK adequacy decision for the destination country, the UK International Data Transfer Addendum (UK IDTA) to the EU Standard Contractual Clauses, or the Standard Contractual Clauses where applicable, with any supplementary measures needed to keep your data protected to a UK standard.

We keep personal data only for as long as needed for the purpose it was collected for, or as required by law. The principal periods are:

Subject to the conditions in the UK GDPR, you have the following rights over your personal data:

• Access: ask for a copy of the personal data we hold about you.
• Rectification: ask us to correct data that is inaccurate or incomplete.
• Erasure: ask us to delete your data (the right to be forgotten), where no overriding legal reason to keep it applies.
• Restriction: ask us to limit how we use your data in certain circumstances.
• Portability: receive the data you gave us in a structured, commonly used, machine-readable format.
• Objection: object to processing based on our legitimate interests.
• Withdraw consent: where we rely on consent, withdraw it at any time without affecting prior processing.
• Complain: lodge a complaint with the ICO at ico.org.uk.

To exercise any of these rights, email hi@bey.agency. To help us protect your data, please send the request from the email address it concerns where possible, or give us enough context to confirm your identity. We respond to valid requests within one calendar month and do not charge a fee for routine requests.

We apply reasonable technical and organisational measures designed to protect personal data against unauthorised access, loss and misuse, including transport encryption and keeping the amount of data we hold to a minimum. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we take our responsibilities seriously and keep our measures under review.

The service is not directed to children under the age of 16 and we do not knowingly collect their personal data. If you believe a child has provided us with personal data, please contact hi@bey.agency and we will delete it.

We may update this policy as the service develops and new processing begins. Each version carries a last-updated date and a version number shown at the top of this page. Material changes will be reflected here before the related processing starts.

If you have a concern about how we handle your personal data, please contact us first at hi@bey.agency or hello@ai2.design so we can try to put it right.

You also have the right to complain to the UK Information Commissioner's Office at ico.org.uk at any time, without affecting any other legal remedy available to you.