Welcome to Project Alix’s Privacy and Data Protection Policy (“Privacy Policy”). This Privacy Policy sets out how Project Alix uses and protects any information that you give to us when you use projectalix.com or the Walk & Talk app and admin dashboard.
If you are here about WhatTheMould, that service has its own Privacy Policy at whatthemould.com/privacy.
Last updated: 16 September 2026
1. Introduction
Important information and who we are
At Project Alix (“we”, “us”, or “our”), we are committed to protecting and respecting your privacy and personal data in compliance with the United Kingdom General Data Protection Regulation (“GDPR”), the Data Protection Act 2018 and all other mandatory laws and regulations of the United Kingdom.
This Privacy Policy applies to:
projectalix.com — our marketing website; and
Walk & Talk — our mobile app and admin dashboard used by professional surveyors, housing associations and their staff to carry out property inspections.
Your Data Controller
Project Alix is your Data Controller and responsible for your Personal Data. Any inquiries about your data should be sent to us by email at ask@projectalix.com or by post to Office 408 Screenworks, 22 Highbury Grove, London N5 2ER.
Where we use Walk & Talk on behalf of a housing association or other business client, that client is the Data Controller of the survey content and we act as their Data Processor. We call this out where it applies.
You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns first — please contact us in the first instance.
We are registered with the ICO under registration number ZB625182.
2. Legal basis for data collection
About Personal Data
Personal Data means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
Some information is considered particularly sensitive because of the impact it might have on the individual concerned. This “special category” data includes racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health, sex life or sexual orientation, and genetic and biometric data.
We do not seek to collect Special Categories of Personal Data. Voice recordings and photos captured during a Walk & Talk inspection may incidentally contain such data if a resident volunteers it; where that happens, we handle it under the housing association’s lawful basis and their existing tenancy relationship with the resident.
Types of data we collect
Depending on which of our services you use, we may collect, use, store and transfer the following kinds of Personal Data:
Profile / Identity Data: first name, last name, work email address.
Content Data: voice recordings you make, photos you take, transcripts generated from your voice, and the reports produced from that content. Captured during a Walk & Talk survey.
Property Data: the address of the property being surveyed, and geotag information on captured photos.
Usage Data: how you interact with our app and dashboard, collected via Mixpanel EU (analytics identifier scoped per-app to your user account).
Technical Data: device model, operating system, IP address and diagnostics captured via Sentry and Firebase Crashlytics.
We do not collect Billing Data, Financial Data or Transactional Data. There are no in-app purchases in Walk & Talk.
Legal basis for collecting that data
The main avenues we rely on are:
Contractual Obligations — where we need information to deliver the service to you or your employer.
Legal Compliance — where we are required by law to collect or process data.
Legitimate Interest — for security, fraud prevention, product analytics and understanding usage.
Consent — for opting in to marketing communications.
For content captured through Walk & Talk on behalf of a housing association, the housing association’s lawful basis (typically their statutory duties under housing and building safety legislation) governs the underlying processing; we process on their instructions.
3. How we use your Personal Data
We will only use your Personal Data when the law allows us to.
What we use your data for
To provide the app, dashboard or website you signed up for.
To generate reports from your voice recording, photos and captured content.
To email your report or (for Walk & Talk) to file it to your employer’s SharePoint or send it to recipients your employer has configured.
To improve how our product works, through analytics and understanding usage.
To improve our AI models using anonymised content, with all identifying detail removed as described in Section 4. This is covered by the terms of the Data Processing Agreement with your employer.
To carry out academic and independent research into damp, mould, retrofit and related housing conditions, and to publish findings — always using anonymised content only.
To keep accounts secure and prevent misuse.
To meet legal and regulatory obligations.
Change of purpose
We will only use your Personal Data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.
4. Voice recordings, photos and anonymisation
Voice recordings are captured only when you tap the microphone button. We convert your voice to text on your device using Apple’s Speech Recognition on iPhone or an on-device model on Android — on-device transcription needs no upload. Separately, the raw audio we upload may be transcribed server-side by OpenAI to catch speech the on-device model missed. The resulting transcript is used to generate a structured report. The raw audio is uploaded to our infrastructure so it can be reviewed against the report if needed.
Photos are captured only when you tap the camera button. They are attached to your report. For damp / mould surveys, we may pass photos to an image-analysis model to help write the report; those photos are transmitted encrypted and are not retained by the analysis provider beyond the request itself.
Voice recordings and photos are stored securely and are accessible to you as the surveyor, to your employer’s admin users, and to us as the processor.
Anonymisation standard
Before any personal content is used for research, model training or shared with third parties for those purposes, we anonymise it. Anonymisation means:
Removing image metadata and GPS coordinates.
Removing or obscuring faces and other directly identifying features in photos.
Removing indicators that reveal personal, political or religious characteristics of any individual.
Removing or generalising address information so that a specific person cannot be identified from the record.
Our anonymisation standard is designed to meet the ICO’s guidance on effective anonymisation. We are seeking independent legal confirmation of the appropriate standard and will update this policy if any refinements are needed.
5. Two data layers, and how we use your data for research
We hold your Personal Data in two connected but separately governed layers.
The operational layer holds everything needed to deliver the service — accounts, surveys, reports, and the emails we have sent on your behalf. This layer is subject to the retention periods in Section 8 and to the access controls described throughout this policy.
The anonymised research layer holds content that has been through the anonymisation process in Section 4. This layer is what we use to train and improve our AI models and to conduct academic and independent research (including in partnership with universities).
We keep the two layers separate. Content only ever enters the anonymised layer after the anonymisation steps in Section 4 have been applied.
6. Your rights and how you are protected by us
Under data protection laws you have the following rights in relation to your Personal Data:
Right to be informed about how we process your data.
Right of access — to receive a copy of the Personal Data we hold about you.
Right to rectification — to have inaccurate or incomplete data corrected.
Right to erasure — to ask us to delete your Personal Data where there is no good reason for us continuing to process it.
Right to restrict processing.
Right to object to processing based on legitimate interest, including direct marketing.
Right to data portability.
Right to withdraw consent where consent is the basis.
If you wish to make a request under any of these rights, please contact us at ask@projectalix.com.
You may also delete your account at any time from within the mobile app. Doing so removes your account and cascading data from our systems after a short grace period.
How we protect your Personal Data
We hold Cyber Essentials certification. We use industry-standard security practices including encryption in transit and at rest, multi-factor authentication for our staff, a documented breach response plan and regular reviews.
7. Sharing your data with third parties
We use a small number of trusted service providers (“sub-processors”) to run our infrastructure. The current list is maintained at projectalix.com/sub-processors and includes providers for hosting (Google Cloud, Supabase), report generation (OpenAI and Anthropic), image analysis on damp / mould surveys (Anthropic Claude vision), analytics (Mixpanel EU), error reporting (Sentry, Firebase Crashlytics), messaging (Twilio), outbound email (Resend) and filing to your employer’s SharePoint via Microsoft Graph.
We may share your content with third parties on your employer’s instructions — for example, emailing findings to a contractor they have nominated. That happens under your employer’s controllership.
We do not sell your Personal Data.
8. How long we retain your data
We retain your Personal Data for as long as reasonably necessary to fulfil the purposes we collected it for.
Account data is kept for the life of your account plus 30 days after you delete it.
Walk & Talk survey content is kept for the retention period agreed with your employer in our Data Processing Agreement. Default is 7 years. Some housing associations require up to 10 years where longer retention is required by legislation such as Section 20 leaseholder consultation records.
Records of emails we have sent (“Sent by Alix”) are kept for 2 years.
Product analytics are kept for 2 years.
Sign-in and device logs are kept for 90 days.
Video content (if introduced) is kept in line with the same rules as voice and photos above.
Backups: rolling 30 days after the primary record is deleted.
9. International transfer of data
Some of our sub-processors are based outside the UK (OpenAI, Anthropic, Firebase Crashlytics, Namecheap). Where Personal Data is transferred outside the UK, we rely on the UK International Data Transfer Agreement or the European Commission’s Standard Contractual Clauses as recognised by the UK, and we have carried out a Transfer Risk Assessment for each such provider. You can request a copy by emailing us.
10. Notification of changes and acceptance of policy
We keep our Privacy Policy under review and will place any updates here. This version is dated 16 September 2026.
By using Walk & Talk or projectalix.com, you consent to the collection and use of data by us as set out in this Privacy Policy. Where a change materially widens what we do with your Personal Data, we will notify you and, where required by law, ask for your consent before the new processing begins.
11. Contact us
If you have any questions or concerns about the way in which we collect, hold or process your data, or simply wish to exercise your rights, please contact us at ask@projectalix.com.