How Hypernova Transform uses AI
I use AI as a tool to work faster and think more clearly. I do not use it to think for me, and I never let it make a decision on your behalf.
You always get a human, not a machine
I lead AI with my wisdom, not the other way around. Every strategy, recommendation and judgement call in your engagement is made by me. AI can draft, summarise, or help me test an idea - but it never decides what goes in front of you, and it never speaks for me.
Everything AI touches, I check
Nothing generated with AI assistance reaches you unread. I review, verify and take responsibility for every word and every number, the same as if I had typed it myself.
I tell you when AI has been involved
You will always be able to find out where AI played a part in the work behind your engagement. My website footer links back to this policy, and any proposal I send you includes a short note on where AI has been used, with a link here for more detail.
Where reasonable, I go beyond the footer link and say so on the page itself - not hiding behind a policy you'd have to go looking for.
This website is one example. Its copy and structure were drafted with AI assistance, then reviewed and approved by me before publication - the same standard applied to everything else in this policy.
Your data stays out of general-purpose AI tools
I use Claude for anything involving your information, run on an account with Anthropic's data-training setting switched off, checked monthly. That means your conversations and documents are never used to train Anthropic's models, and are automatically cleared from their systems within 30 days.
Other AI tools (Perplexity, Gemini, Copilot) are sometimes useful for general research - checking a market trend, a public data point, a piece of terminology - but never with anything of yours in them. I might also glance at what a public AI search summary already says about your business, in the same way I might Google you, but I never feed it anything you haven't already made public yourself.
Full detail on how your data is actually handled - what's never touched, how long things are kept, and what happens if something goes wrong - is in the Data & Privacy Policy.
Questions
If anything here isn't clear, or you'd like more detail on a specific piece of work, contact me directly - see the Legal section for how.
How your data is handled
This sits alongside the Responsible AI policy and covers the practical detail: what I do with your information, what I never do with it, and what happens if something goes wrong.
What counts as personal data. Any information that could identify a living person - not just a name. An email address is personal data even without a name attached. Aggregated business figures - traffic numbers, conversion rates, revenue bands - are not, because no individual is identifiable from them. This is the line the rest of this policy is built on.
No personal data goes into AI tools
This is the single most important commitment in this policy, and it's what keeps everything else simple. I don't put personal information belonging to a client, or to a client's customers, into Claude or any other AI tool. Diagnostic work runs on aggregated analytics, business metrics and anonymised findings, not named individuals. If a finding genuinely requires looking at something personal, that part of the work happens outside AI tools entirely, by hand.
This is separate from my own business contacts - people I'm in a direct working or prospective-client relationship with. Managing who I'm talking to, their role, and what they need is ordinary business-relationship management, the same as any CRM, and rests on legitimate interest rather than the stricter standard above. I keep this to what's professionally relevant - name, role, business needs - and remove it once the relationship ends or on request.
Never, under any circumstances, in any AI tool:
- Passwords, API keys, or login credentials
- Bank details, card numbers, or other financial account information
- Personal data about any named individual - yours, your staff's, or your customers'
- Health information
- Anything you've specifically told me to keep out
Where your data actually sits
Working files - GA4 exports, CRM extracts, working documents, drafts - live on my own systems for the length of the engagement and are reviewed for deletion no later than 90 days after handover completes. I may delete them sooner - at your request, or at my own discretion - and 90 days is a maximum, not a target. Final deliverables (your roadmap, your reports) are yours to keep; I retain a copy for my own records unless you ask me not to.
Anything processed through Claude is retained by Anthropic for a maximum of 30 days before automatic deletion, and is never used to train their models (see the Responsible AI policy for how I keep that setting active).
If something goes wrong
If I ever discover a data-handling error on my part, I'll tell you promptly and directly - what happened, what it affects, and what I'm doing about it. I carry professional indemnity insurance, which covers this kind of situation.
Legal compliance
I work to UK GDPR and the Data Protection Act 2018 as standard, and to the EU AI Act where an engagement touches EU markets or data. Because I don't put personal data into AI tools in the first place, most of the complexity that usually comes with these rules simply doesn't arise in my work.
Questions or requests
If you want to know exactly what I hold about you or your business, or you'd like something deleted, contact me directly - see Legal.
Modern Slavery Statement
Hypernova Transform is well below the turnover threshold that makes a Modern Slavery statement a legal requirement under section 54 of the Modern Slavery Act 2015. I'm publishing one anyway, because it's the right thing to do, and because it's the kind of question a procurement or governance-minded client is entitled to ask before they work with anyone.
What I actually do
I maintain a register of the suppliers material to how I operate: hosting, email, software, AI tools, banking and insurance. For each one, I check whether they publish their own Modern Slavery or human rights statement, note whether it's current, and record what I find - including when it isn't current. I review this register at least once a year.
This isn't a box-ticking exercise. My first review, completed August 2026, found that one established, well-known supplier's published statement was over a year out of date against their own stated annual review commitment. I've recorded that honestly rather than treating every supplier as equivalent, and I'll check again at the next review to see whether it's been updated.
Why this looks different to a large company's statement
I'm a sole practitioner with no subcontractors, no offshore delivery chain, and no labour supply chain of my own. What I have is a short list of technology and service suppliers, each individually low-risk. My due diligence is proportionate to that: a documented annual check, not a supply-chain audit apparatus built for a business many times this size.
Questions
If you'd like more detail on the supplier register or how a specific review was conducted, contact me directly - see the Legal section for how.
Legal
All content on this site is the property of Hypernova Transform unless otherwise stated.
