Privacy Policy

This Privacy Policy explains how Crescitax Limited, trading as SapixAI, collects, uses, discloses, stores and protects personal data when you visit our website at sapixai.com, contact us, request a quote, book a call, or engage us for content production services. It also explains the rights you have in relation to your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

We are committed to handling personal data responsibly and transparently. We collect only the data we genuinely need, we keep it only for as long as necessary, and we never sell personal data to third parties. This policy is written in plain English wherever possible; if anything remains unclear, please contact us using the details in section 15 and we will be happy to explain.

By using our website or providing personal data to us, you acknowledge that you have read this policy. Where we rely on your consent for a specific processing activity, we will always ask for it separately and explicitly.

The data controller responsible for your personal data is Crescitax Limited, a private limited company registered in England and Wales under company number 16800379, with its registered office at 84 Elspeth Road, London, England, SW11 1DR. Crescitax Limited trades under the name SapixAI and operates the website sapixai.com.

SapixAI is an AI native content studio. We produce UGC style videos, cinematic advertising spots, static advertisement creatives and AI influencer content for ecommerce brands and marketing teams. Our registered nature of business, as recorded at Companies House, is advertising agencies (SIC code 73110).

As data controller, we determine the purposes and means of processing the personal data described in this policy, and we are responsible for ensuring that such processing complies with applicable data protection law.

This policy applies to:

• visitors to our website, sapixai.com;
• prospective clients who contact us, request information or book discovery calls;
• clients and their personnel who engage us for content production services;
• suppliers, collaborators, creators and business partners who work with us;
• any other individual whose personal data we process in the course of running our studio.

This policy does not apply to third party websites, platforms or services that may be linked from our website, such as social media platforms, scheduling tools or payment providers. Those services operate under their own privacy policies, which we encourage you to read.

The categories of personal data we collect depend on how you interact with us. They include the following.

4.1 Contact and identity data. Your name, work email address, phone number, job title, company name and any other details you choose to include when you contact us by email, through a form on our website, or by booking a call.

4.2 Enquiry and project data. The content of your messages to us, briefs you send, brand guidelines, product information, footage, photography, logos, references and any other materials you share so that we can scope and deliver your project.

4.3 Commercial and financial data. Billing addresses, purchase orders, invoices, payment records, proposals, contracts and correspondence relating to the commercial relationship between you (or your organisation) and us. Card payments, where applicable, are processed by our payment provider and we do not store full card details on our own systems.

4.4 Technical and usage data. When you visit our website, our hosting infrastructure automatically records standard technical information such as your IP address, browser type and version, device type, operating system, referring page, pages visited and the date and time of each request. This information is used for security monitoring, troubleshooting and aggregated statistics.

4.5 Preference data. Choices you make on our website, such as your light or dark theme preference, which are stored locally on your device rather than on our servers.

We do not knowingly collect special category personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation), and we ask that you do not send such data to us. Our website and services are directed at businesses and are not intended for children under the age of 18.

We collect personal data through the following channels:

• Direct interactions. You give us data when you email us, complete a form, book a call, request a quote, sign a contract or send us project materials.
• Automated technologies. Our servers and hosting provider automatically collect technical and usage data when you browse our website.
• Third parties. We may receive contact or company data from referrals, publicly available business directories, professional networks, or from your colleagues who introduce us to your organisation.

We process personal data only where we have a valid lawful basis under Article 6 of the UK GDPR. The table below summarises our main processing purposes and the lawful basis for each.

Responding to enquiries and running discovery calls. Lawful basis: legitimate interests (responding to business enquiries and developing our commercial relationships) and, where an engagement follows, steps prior to entering a contract.

Scoping, producing and delivering commissioned content. Lawful basis: performance of a contract with you or your organisation.

Managing contracts, invoices, payments and accounting. Lawful basis: performance of a contract and compliance with legal obligations (including UK tax and company record keeping requirements).

Sending service updates and marketing communications. Lawful basis: consent, or legitimate interests in marketing to existing business contacts. You can opt out of marketing at any time by using the unsubscribe mechanism in the message or by emailing us.

Keeping our website secure and understanding how it is used. Lawful basis: legitimate interests in maintaining the security, integrity and performance of our digital services.

Establishing, exercising or defending legal claims. Lawful basis: legitimate interests in protecting our legal rights.

Our production pipeline uses generative artificial intelligence tools to create video, imagery, voice and motion content. Project materials you share with us may be processed by these tools solely for the purpose of delivering your commissioned work.

If you send us footage, photographs or voice recordings of real, identifiable people (for example founders, employees, creators or customers), you confirm that you have the authority and, where required, the documented consent of those individuals to share such material with us and to have it processed for the agreed purpose. Where you act as the data controller for that material, we act as your processor and will handle it in accordance with your instructions and any data processing terms agreed between us.

We do not use client materials or personal data to train, fine tune or improve publicly available AI models without your explicit prior written consent. Where we use third party AI platforms, we select providers whose terms do not claim ownership over customer inputs and whose processing is governed by appropriate contractual safeguards.

We never sell personal data, and we do not share it with third parties for their own independent marketing purposes. We share personal data only with the following categories of recipients, and only to the extent necessary:

• Hosting and infrastructure providers, who store our website, files and business data on secure cloud servers;
• Scheduling, email, file sharing and customer relationship tools, used to communicate with you and manage projects;
• AI generation and production platforms, used in the course of delivering commissioned content;
• Payment processors, for the purpose of taking payment for our services;
• Professional advisers, including accountants, bookkeepers, insurers and lawyers, where necessary for the running of our business;
• Public authorities, regulators and law enforcement, where we are required to disclose data by law, regulation, court order or lawful request.

Where a recipient processes personal data on our behalf as a processor, it does so under a written contract that imposes appropriate confidentiality and security obligations and restricts its use of the data to our documented instructions.

Some of the service providers we use are located, or store data, outside the United Kingdom. Where personal data is transferred to a country that is not covered by UK adequacy regulations, we ensure the transfer is protected by appropriate safeguards, such as the UK International Data Transfer Agreement, the UK addendum to the EU standard contractual clauses, or another lawful transfer mechanism recognised under the UK GDPR. You may contact us for further information about the safeguards applied to a specific transfer.

We retain personal data only for as long as necessary for the purposes described in this policy, after which it is securely deleted or irreversibly anonymised. Our standard retention periods are as follows:

• Enquiry data where no engagement follows: up to 24 months from the last meaningful contact;
• Client project data, contracts and correspondence: for the duration of the relationship and up to 6 years after it ends, in line with limitation periods for contractual claims;
• Invoices and financial records: 6 years from the end of the relevant financial year, as required by UK tax and company law;
• Technical and server logs: up to 12 months;
• Marketing contact data: until you withdraw consent or object, or the data becomes outdated.

In limited circumstances we may retain data for longer where required by law or where necessary in connection with an ongoing legal claim or dispute.

Our website uses only essential browser storage, for example to remember your theme preference between visits. We do not use advertising cookies, cross site tracking technologies or third party profiling tools. Where analytics are enabled, they are configured to be privacy respecting and to avoid identifying individual visitors. You can control or delete cookies and local storage at any time through your browser settings; doing so will not prevent the website from functioning, although your theme preference may not be remembered.

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration and disclosure. These include encrypted transport (HTTPS), access controls limiting data to those who need it, reputable cloud providers with recognised security certifications, and regular review of the tools and platforms we use. No method of transmission or storage is completely secure, but we take the protection of your data seriously and continually review our practices. Where we are legally required to notify you or the regulator of a personal data breach, we will do so without undue delay.

Under the UK GDPR, and subject to certain conditions and exemptions, you have the following rights in relation to your personal data:

• Access: to obtain confirmation of whether we process your data and a copy of it;
• Rectification: to have inaccurate or incomplete data corrected;
• Erasure: to request deletion of your data in certain circumstances;
• Restriction: to request that we limit the processing of your data in certain circumstances;
• Portability: to receive data you provided to us in a structured, commonly used, machine readable format;
• Objection: to object to processing based on legitimate interests, and to object at any time to direct marketing;
• Withdrawal of consent: where processing is based on consent, to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, email riccardo@sapixai.com. We respond to valid requests within one month, and we do not charge a fee unless a request is manifestly unfounded or excessive, as permitted by law. We may need to verify your identity before acting on a request.

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the UK supervisory authority, the Information Commissioner's Office (ICO), via ico.org.uk or by telephone on 0303 123 1113. We would, however, appreciate the chance to address your concerns directly first.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements or services. Any changes will be posted on this page with a revised "last updated" date, and where changes are material we will take reasonable steps to draw them to your attention. The version published on this page is the version currently in force. This policy was first published in January 2025 and was last updated in September 2026.

For any question about this policy or about how we handle personal data, or to exercise any of your rights, please contact us by email at riccardo@sapixai.com or in writing to Crescitax Limited (trading as SapixAI), 84 Elspeth Road, London, England, SW11 1DR, United Kingdom.