Privacy Policy
Last updated: 24 September 2026
This policy explains how Tessera Security collects, uses and protects your personal data when you use our website and request access to Tessera.
1. Who we are
Tessera Security Ltd ("Tessera", "we", "us", "our") is the data controller responsible for your personal data in connection with this website, tesserasecurity.ai. We are a company registered in England and Wales (company number 17336112), with a registered office at Office 444, Unit 5, 399-405 Oxford Street, London, England, W1C 2BU. You can contact us about this policy or your personal data at hello@tesserasecurity.ai.
2. Scope of this policy
This policy covers our public website and the request-access form. It does not cover the Tessera product application, which has its own privacy notice and data-processing terms provided to customers when they are onboarded.
3. What personal data we collect
Information you give us
When you submit the request-access form, we collect the details you provide — your name, work email, organisation, optionally your role, and a short description of what you'd use Tessera for — so we can respond and assess fit for a pilot.
Information collected automatically
When you visit the site, our hosting and content-delivery provider automatically records limited technical information in logs — such as your IP address, browser type and the pages you request — to keep the site secure and running. We do not use this information to identify you personally.
Your light/dark theme choice is stored only in your own browser (local storage) so the site can remember it on your next visit. It is not sent to us.
4. How we use your data, and our lawful bases
| What we do | Data used | Lawful basis (UK GDPR) |
|---|---|---|
| Respond to your access request and assess fit for a pilot | Name, email, organisation, role, use case | Legitimate interests (Art. 6(1)(f)) — responding to your request |
| Operate, secure and troubleshoot the website | Server-log technical data | Legitimate interests — keeping our site available and secure |
| Contact you about access, with your agreement | Email address | Consent (Art. 6(1)(a)) |
We will not use the details from your request for unrelated purposes, and we will not add you to any other marketing without asking you first.
5. Cookies and analytics
We do not currently set non-essential or tracking cookies, and we do not run third-party analytics on this site. If we introduce these in future, we will update this policy and, where required, ask for your consent before any non-essential cookies are set.
6. Who we share your data with
We do not sell your personal data. We share it only with the service providers ("processors") that help us run the site and handle requests, and only so far as they need it to provide their service to us:
| Provider | Purpose |
|---|---|
| Amazon Web Services (UK/London) | Website hosting and content delivery |
| Web3Forms | Processing and delivering request-access form submissions to us |
We may also disclose personal data if required to do so by law, or to protect our rights, users or the security of our services.
7. International transfers
Where a provider stores or processes personal data outside the United Kingdom, we take steps to ensure it is protected by an appropriate safeguard recognised under UK data protection law — such as an adequacy decision, the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum.
8. How long we keep your data
We keep the details from your access request for as long as needed to respond and, if relevant, to onboard you — and for a reasonable period afterwards — unless you ask us to delete it sooner. Server logs are kept only for as long as our providers retain them for security and operational purposes.
9. Your rights
Under UK data protection law you have the right to: be informed about how we use your data (this policy); access the personal data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to our processing; data portability; and withdraw your consent at any time where we rely on consent.
To exercise any of these rights, email hello@tesserasecurity.ai. Withdrawing consent does not affect processing carried out before you withdrew it.
10. Complaints
If you have a concern about how we handle your data, we'd like the chance to put it right — please contact us first. You also have the right to complain to the UK's supervisory authority, the Information Commissioner's Office (ICO), at ico.org.uk.
11. Security
We take reasonable technical and organisational measures to protect your personal data against loss, misuse and unauthorised access. Our site is served over an encrypted (HTTPS) connection. No method of transmission or storage is completely secure, but we work to protect your data and to keep our practices under review.
12. Children
Our website is intended for business users and is not directed at children. We do not knowingly collect personal data from anyone under the age of 18.
13. Changes to this policy
We may update this policy from time to time. When we do, we will change the "last updated" date at the top of this page, and — where the changes are significant — we will take reasonable steps to let you know.
14. Contact us
For any question about this policy or your personal data, contact us at hello@tesserasecurity.ai.