Subcontext Consumer Notice

Last updated: 3 October 2026

This notice explains how the Subcontext platform handles your information when you use an insurance quote, application, policy or support journey that runs on our technology. That could be a chat window, an online quote form, a help pop-up, or a conversation by SMS, WhatsApp, email or phone.

We wrote it once for every business that uses Subcontext, so it does not name a particular company. The business you are actually dealing with (the broker, insurer or other firm) is called the Provider in this notice.

The Provider's privacy policy comes first. The Provider decides how your information is used and is responsible for it (it is the "data controller"). Its privacy policy is the main document about your information. This notice adds detail about the technology behind the Provider's journey and the suppliers it uses. If the two differ, the Provider's policy and your rights against the Provider take priority.

1. Who we are and what we do

Subcontext Ltd ("Subcontext", "we", "us") provides the technology that runs the Provider's journey. We act as the Provider's data processor: we handle your information only on the Provider's instructions and on its behalf. We do not decide why your information is collected, and we never sell it.

Sometimes Subcontext is itself the Provider, for example when you chat with the assistant on subcontext.com. Then we are the data controller, and our Privacy Policy explains how we use your information.

• Subcontext Ltd, registered in England and Wales (Company No. 17019645)
• Registered office: 124 City Road, London, EC1V 2NX
• Registered with the Information Commissioner's Office (ICO), reference ZC098511
• Contact: hello@subcontext.com

2. Where you might meet us

The platform can run any of these parts of a Provider's journey:

• A chat window on the Provider's website or mini-site.
• An online quote and application form.
• A help assistant that explains a question on a form when you ask for guidance.
• Conversations by SMS, WhatsApp, email or phone.
• Payment pages for paying by card or setting up a Direct Debit.
• A follow-up from your adviser after you have spoken to them, written with the help of the platform and approved by your adviser before it is sent.

3. What information the platform handles

What you tell us. Anything you type, say or choose: for example your name, contact details, date of birth, address, and your answers to the Provider's questions. For insurance this can include health and lifestyle information. It also includes payment details you enter. The Provider decides what it asks for and why, and its privacy policy explains this.

What your adviser shares. If your adviser follows you up after running a quote for you, their quoting software (such as Iress) can pass that quote to the platform. It includes your name and date of birth, the cover you asked about, and the underwriting details the quote was based on, such as whether you smoke and your height and weight, along with the insurers, products and prices quoted. Your adviser chooses which quotes to send you. The prices and cover amounts in the email come from the quote itself, not from the AI. Your health details are shown only to your adviser, so they can see what the quote was based on: they are never put in the message to you.

What is recorded automatically. To run the journey safely and reliably, the platform also records:

• Your IP address and browser or device details.
• A random visitor identifier and session token, kept in your browser so your conversation stays connected (see Section 7).
• Which page, product or form you started from: the page's address (with personal details removed), its title and any campaign or advert details in its link, and the page that referred you there.
• A picture of the public page you started on, taken by the platform itself without your cookies. It never shows your personal information.
• Security and usage logs of requests to the platform (with sensitive values such as passwords and card numbers left out).
• A record of your conversation: the messages you send and the replies you receive, and for phone calls, a recording and transcript where the Provider records calls.

Your choices about being contacted. Each time you agree or say no to being contacted (for example by ticking a box, replying STOP or unsubscribing), the platform records your choice, the message type and channel, the wording you were shown, and when and how you made it. This lets the Provider show that it respected your choice.

4. How the AI assistant works

The Provider's journey may be guided by an AI assistant. Here is what that means for you:

• Text conversations: your messages, with the conversation so far, are processed by AI models (Anthropic's Claude, and DeepSeek models) running on Amazon Web Services (AWS) Bedrock in the EU or London. They write the assistant's replies and help prepare quotes. AWS does not store these messages or use them to train models.
• Phone calls: if you speak to an AI voice assistant, the live call audio goes to OpenAI so the assistant can understand and answer you, and its spoken replies may be produced by ElevenLabs. Both are in the United States. OpenAI does not use this data to train its models, but may keep it for up to 30 days to check for abuse. If the Provider records calls, you are told at the start of the call.
• Quotes shown during the journey are worked out automatically from what you tell us. They are indications until the Provider confirms them.
• Extra support: if something you say suggests you might need extra care (for example illness, bereavement or money worries), the platform can flag this to the Provider's team and hold back sales messages to you, so a person can make sure you are treated fairly.
• Talking to a person: you can ask to speak to a person at any time. The platform supports handing your conversation to the Provider's team; how and when that happens is up to the Provider.

We do not use your conversations or your personal information to train or improve any AI model, ours or anyone else's.

5. Who helps us run the platform

These suppliers (our "sub-processors") help deliver the journey. Each one handles only what it needs for its job, under a contract with us.

The full, current list is in our Data Processing Agreement and on the sub-processor list. We update this notice when the suppliers change.

The Provider's own systems. The Provider may also connect its own systems to the journey. For example, if you book a call, the details may go into the Provider's Google Calendar (and you may get a calendar invitation), a Google Sheets spreadsheet, or its own customer or policy system. Those systems belong to the Provider, and its privacy policy covers them.

6. Where your information is kept

The platform stores your information with AWS in Ireland. Text AI runs on AWS Bedrock in the EU or London. Some suppliers are in the United States: the voice AI services (OpenAI, ElevenLabs), messaging (Twilio, Meta), payments (Stripe), and app notifications (Apple, Google Firebase).

When your information goes to the United States, it is protected by the UK's data bridge with the US (the UK Extension to the EU-US Data Privacy Framework) where the supplier is certified, or otherwise by the UK International Data Transfer Agreement or the EU Standard Contractual Clauses with the UK Addendum. Our Transfer Risk Assessment explains more.

7. Cookies, local storage and other things a page may load

The chat and form keep a visitor identifier and session token in your browser's local storage. They are needed to keep your conversation connected and recognise your session, and are not used for advertising or tracking you across other websites.

Depending on the page, it may also load:

• Stripe on payment pages, which may set its own cookies to help prevent fraud on the payment you are making.
• Web fonts from Google Fonts, which means Google receives your IP address.
• Video players from YouTube or Vimeo, where the Provider includes a video. These services may set their own cookies.
• Advertising measurement, only where the Provider has connected an advertising account (see Section 5). The platform notes the ad click reference in the link you arrived from. The Provider's own website may also use its own cookies, which its cookie policy explains.

8. Keeping your information safe

• All connections are encrypted (HTTPS).
• Stored data is encrypted, and especially sensitive details, such as bank details for Direct Debit, get an extra layer of encryption.
• Access is limited to people who need it, and is logged.
• Our security policies are published at subcontext.com/trust.

9. How long information is kept

The platform keeps your information on the Provider's behalf for as long as the Provider needs it. The Provider's privacy policy gives its retention periods. In addition:

• Call recordings (where calls are recorded) are deleted automatically after the period the Provider sets, which is one year unless it chooses otherwise. The Provider can delete a recording sooner, or keep it longer where it is needed, for example for a complaint or legal claim.
• Security logs such as IP addresses are kept for 90 days, or up to a year if they relate to a security problem or spam.
• A quote your adviser shares is kept encrypted, and deleted after 30 days if no message is sent to you from it.
• If the Provider stops using Subcontext, its data is deleted within 90 days of its contract ending, unless the law requires something to be kept longer.
• If the Provider deletes your record after you said no to being contacted, the platform keeps only a scrambled, one-way code made from your email address or phone number (never the address or number itself), for that Provider only. If the same address or number comes back, your choice is applied again, so you are not contacted against your wishes.

10. Your choices about being contacted

You can change your mind at any time:

• Email: use the unsubscribe or "manage preferences" link at the bottom of the Provider's emails, or reply asking to unsubscribe.
• SMS and WhatsApp: reply STOP. Reply START if you change your mind.
• Preference page: the "manage preferences" link opens a page where you can choose, channel by channel, whether the Provider may contact you about your enquiry or policy and about its other products, or say no to all of it.

Some messages, such as policy documents and notices about payments and renewals, may still be sent where they are needed to run a policy you hold.

11. Your rights and complaints

Because the Provider is in charge of your information, please use your data protection rights (such as access, correction, deletion or objection) through the Provider. Its privacy policy explains how. When the Provider asks us to help with your request, we do.

If you want to raise something about the platform itself, email hello@subcontext.com and we will pass it to the right Provider or deal with it ourselves.

You can also complain to the Information Commissioner's Office, the UK data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113. We would appreciate the chance to help first.

12. Changes to this notice

We update this notice when the platform or its suppliers change. The date at the top shows when it last changed.