Universe Labs — WhatsApp test and app-support privacy notice

1. Who we are and what this covers

UNIVERSE LABS LTD, NI739102, 211 Antrim Road, Belfast, BT15 2GW, United Kingdom, controls its restricted WhatsApp app testing, reviewer evidence, administration, support and security information. This includes the app currently called Universe Customer Dev. Contact Brian Bradley at support@universe-labs.ai or write to the address above, marked Privacy request. Brian is the owner-confirmed sole human with access to the current test, administration and support systems; software providers also process information as described below.

The invitation-only tests use labelled replies and isolated test records. Later rehearsals create native test booking records in a separate Dispatch test database and use a local office inbox with an actual test staff reply. They do not create production taxi bookings, dispatch vehicles or send staff-group messages. Please use fictional details and do not send sensitive information, payment details or another person's information. Personal identifiers and anything you actually type can still be personal data. Automated replies are currently paused; the receiver can still record authenticated test messages and delivery events. A paused test or completed demonstration is not permanent test retirement.

Live B Cabs bookings are outside this test. BELFAST CITY CABS LTD, NI744446, is responsible for its booking data; Universe Labs would process it on B's instructions for a separately enabled service. This notice does not replace a client's booking notice, cover Universe Wallet or authorise production processing.

2. Information, purposes and lawful basis

We use participants' WhatsApp identity/telephone and display information supplied by the platform, message text, dates and message identifiers, reply/button context, delivery events and supplied journey details. Limited action, send-attempt and diagnostic records support reliable replies and prevent duplicate or uncertain actions. Attachment descriptions or captions can arrive, but this test does not download attachments, transcribe audio or call external AI for its deterministic journey. The later rehearsal uses isolated Dispatch address, quote, booking and status actions. Its route distance is explicitly synthetic, not evidence of a measured route or production fare.

App administration and support use necessary business/account identifiers, contact and permission records, correspondence and security/error information. Reviewer evidence includes recordings, screenshots and limited technical reports showing the test. These sources are you, Brian's administration and Meta/WhatsApp. Participation is voluntary; without the necessary WhatsApp identifier and input we cannot demonstrate that interaction.

We rely on legitimate interests in the requested, limited test, accurate app review, responsive support, security and reliability. We limit the information, recipients and reuse to those purposes, consider people's reasonable expectations and provide a way to object. Where a specific legal duty requires processing, we use only information necessary for that duty. We do not use this test for advertising, selling personal data or unrelated clients' services. Its automated menus produce isolated test records, not decisions about production journeys or significant entitlements.

3. Recipients, services and international processing

Our isolated test receiver and office inbox are at Universe Labs' Belfast office. The later Dispatch rehearsal also stores test booking data with Supabase in a separate test project whose primary region is London, United Kingdom. This includes the participant telephone/name, selected journey details, fare, booking reference/state and related idempotency or audit records. Office messages, tickets and reply/resolve commands are stored in our local office inbox. Cancelling a test booking does not erase its history. Meta/WhatsApp provides messaging, app administration, review and support; relevant reviewer footage is submitted to Meta. Its Cloud API Terms and incorporated processing terms govern the applicable service. Meta's own safety, security and account processing is separate.

Tailscale provides remote connectivity and the public callback relay. It relays encrypted callback traffic; TLS ends on our server. Microsoft 365 hosts support@universe-labs.ai and processes email sent there. OpenAI Codex and Anthropic Claude/Claude Code assist development and administration and can receive the limited screenshots, video frames, reports or other material Brian supplies. They are separate from the deterministic WhatsApp journey; their involvement must not be described as no external AI processing at all.

Vercel hosts these pages and processes website-request information such as IP/browser details. Google Fonts receives browser font requests. Those website routes are separate from the test's WhatsApp message store. Access is limited to the people and service purposes required; Brian is the sole human operator, not the only organisation processing information.

These providers may process information outside the UK, including in the United States and other service locations. A London primary database region does not establish UK-only processing by Supabase or its support/subprocessors. Its published DPA describes regional storage, international transfers and applicable standard contractual clauses with a UK Addendum. We do not claim a complete independently verified provider-country list or account-specific backup location from the project-region setting. Tailscale and Vercel's published data-processing terms include standard contractual clauses and UK transfer provisions where required; Microsoft's published online-service terms provide transfer safeguards. Administration uses Codex through a ChatGPT account and Claude through an individual subscription. OpenAI's EEA/UK consumer privacy terms describe US and other affiliate, partner and vendor locations, with adequacy arrangements or standard contractual clauses and the UK Addendum where applicable. Anthropic's consumer privacy terms describe US and other locations, using adequacy arrangements or standard contractual clauses with the approved UK equivalent where applicable. These are attributed provider safeguards, not a claim that our individual accounts have an executed business/API DPA, UK-only processing or a complete verified country list. Ask Brian for details or copies of the relevant safeguards.

We minimise material supplied for development and administration and use synthetic or appropriately redacted content where possible. Before expanding assistance use to new unredacted customer content or credential workflows beyond the already authorised administration, Brian must review the need, applicable product terms and account controls. Existing assistance copies remain within our rights-request and copy follow-up scope. This does not claim they have already been erased, or promise a particular training or retention setting on those individual accounts.

Supplier information: Supabase DPA, Supabase subprocessors, Supabase primary regions, Tailscale DPA, Tailscale privacy, Microsoft DPA, Vercel DPA, OpenAI privacy, Anthropic privacy, and Google Fonts information.

4. Retention and copies

The owner-approved rule is to delete or irreversibly anonymise the isolated pilot dataset seven days after permanent pilot closure AND settlement of pending/uncertain actions and related support cases. This includes messages, isolated test journeys, action/send records, diagnostics and identified review/support copies containing pilot data. The inventory must also cover the later native test bookings and related history/idempotency/audit records in Supabase, and local office tickets and commands. Separate test sessions and their spent allowances are not merged or reset. A pause or completion of a demonstration does not start the clock. Eligible earlier erasure requests are assessed when received.

Other administrator contact and permission records are kept while access is active and associated access/security issues remain unresolved. Other support correspondence is kept until its issue and necessary follow-up are finished. At those endpoints we remove personal information no longer needed. Minimal request/outcome evidence may remain for an actual legal duty or identified complaint/claim, with a recorded reason and review/end trigger, reviewed at case closure. This is not an indefinite general archive.

The four original review paths were excluded from the particular Node 1 backup job whose configuration was checked. That does not verify coverage of later test-session paths, Supabase backups or all other/historical copies. Those copy inventories, deletion/expiry arrangements and restoration handling remain to be checked. Our policy includes identified copies under our control; it does not promise that every backup, supplier or device copy has already been erased within seven days. Copies that cannot immediately be removed must be restricted from further use while deletion or expiry is arranged. Any restoration must respect completed deletion/restriction decisions before information is used again. We explain confirmed outcomes and outstanding copy work, including its actual timing, to the requester. Independent provider/account records and other people's device copies follow their applicable terms and rights processes.

5. Your rights and requests

Contact Brian to ask for access, correction, erasure, restriction or other applicable rights. No special form or phrase is needed; requests can be verbal or written. See the deletion instructions. Manual assessment and authorised action are used; no automatic per-person purge is claimed. Acknowledgement or pausing replies is not completed deletion.

Right to object: you can object to processing based on legitimate interests by contacting Brian.

We normally respond free of charge, without undue delay and within one calendar month. We explain proportionate identity checks, any permitted extension, what was done, any information retained and why, and outstanding supplier/copy work. You can complain to us or to the Information Commissioner's Office: ICO complaints, 0303 123 1113.

Effective date: 15 October 2026.