Ecorva AI
Last updated: 30 July 2026
Ecorva AI provides software tools designed to support ecological consultants in the UK, including species data processing and report writing applications.
We are committed to protecting your privacy and being transparent about how we handle personal data. This Privacy Policy explains how Ecorva AI collects, uses, stores, and protects personal data in compliance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).
Ecorva AI is operated by Jack Flynn trading as Ecorva AI, Birmingham, United Kingdom. Ecorva AI is the data controller for the personal data described in this policy.
If you have questions about how your data is used, or you wish to exercise your data protection rights, you can contact us at:
Email: info@ecorva-ai.co.uk
We collect personal information directly from you when you register for an account or contact us.
This information is stored securely by our authentication provider for the sole purpose of managing your account login.
Important: Our applications process data locally on your device. Species data, survey records, site coordinates, survey footage and any ecological data you work with are stored locally on your machine and are not transmitted to or stored on our servers. The only exception is footage you actively choose to share with us, which is covered in the next section.
You may optionally choose to share bat survey footage with us to help improve our detection models. This is entirely voluntary. Nothing is uploaded automatically and the applications work fully without it.
Lawful basis. We rely on your consent (Article 6(1)(a) UK GDPR). You can withdraw consent at any time by emailing info@ecorva-ai.co.uk.
How it is submitted. Footage is currently shared with us via Google Drive. Google therefore acts as a sub-processor for those files; see International Transfers below.
What we use it for. Shared footage is used only to develop and improve our bat detection models. It is never sold, never shared with advertisers, and never used to train third-party public models.
Retention. We keep shared footage only for as long as it is relevant to model development, and we delete source footage on request.
Withdrawal. An honest limitation. If you withdraw consent we will delete the source footage and exclude it from future training runs. We cannot, however, remove the influence of footage that has already been incorporated into a trained model. We would rather say that plainly than imply otherwise.
Site locations and protected-species records. We treat site identifiers, coordinates, embedded location metadata and any protected-species information in shared footage as confidential. It is not published, not passed to record centres, and not shared with other customers. Please only share footage you are permitted to share under your own client agreements, and strip client or site identifiers where you can.
People in footage. Thermal and infrared survey footage may incidentally capture identifiable individuals such as surveyors or passers-by. Please avoid submitting clips where people are the focus. We do not attempt to identify anyone appearing in footage and do not use it for any purpose other than bat detection model development.
We use the personal information we collect to:
We rely on the following lawful bases under Article 6(1) of the UK GDPR:
No. There is no public self-service checkout on this website and we do not collect or store card details. The invite-only beta is free.
After the beta, paid subscriptions will be handled by Stripe. When that happens, payment and billing information will be collected and stored securely by Stripe on their systems, not by us. We will update this policy before any paid checkout goes live.
Our beta application page (/join), our contact page (/contact), our unsubscribe page (/unsubscribe) and the county-coverage form in our map all load an embedded form from Tally. Loading those pages (or opening the county-coverage window) loads third-party content from Tally. Information you enter into a Tally form is submitted to and processed by Tally on our behalf for the relevant application, enquiry or unsubscribe request. Per Tally’s documentation, form data is encrypted and stored in the EU; a DPA is available from Tally.
Ecorva AI remains the controller of the information you submit through that form. We review submissions manually and reply by email. No account is automatically created, no payment is taken, and Tally submissions are not written into our other systems.
Please do not submit ecological records, client documents, site details or protected-species location data via the Tally form. If we need those to run a data search for you, we’ll agree a secure way to share them separately.
Because our applications process ecological data locally on your machine, your clients’ data, site records and protected-species locations do not reach us. For that data, Ecorva AI is generally not a processor acting on your behalf, because we never receive it in the first place.
Ecorva AI is the controller of the limited account and contact data described in this policy. Where we do process personal data on a customer’s behalf, for example an agreed data-search service, that processing is governed by a separate Data Processing Agreement setting out purpose, duration, security measures and sub-processors. We are happy to supply a DPA on request; email info@ecorva-ai.co.uk.
We do not sell, trade, or rent your personal information. We share data only with the following recipients:
All service providers are contractually required to maintain confidentiality and security of your data. We will update this list when our sub-processors change.
Our primary systems are hosted in the United Kingdom and European Economic Area. Some of our providers, notably Google, may process data outside the UK and EEA.
Where personal data is transferred outside the UK, we rely on the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with any additional measures required by UK GDPR.
We use strictly necessary cookies and browser local storage only. These are used to keep you signed in to your account (a session token stored by our authentication provider). We do not use advertising or analytics cookies, and there is no public self-service checkout on this website.
We do not use Google Analytics, Facebook/Meta Pixel, or any analytics, advertising or third-party tracking technologies. Strictly necessary storage is exempt from consent requirements under PECR, which is why the site does not show a cookie banner.
On pages with an embedded Tally form, Tally may set its own cookies or local storage in order to run the form. That is governed by Tally’s own privacy notice.
We implement appropriate technical and organisational measures to protect personal data, including encrypted data transfer (HTTPS), secure access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure.
We retain your account information (name and email) for as long as your account remains active. If you request deletion of your account, we will remove your personal data within 30 days, unless we are required by law to retain it for longer.
Encrypted backups may retain a copy for a short period beyond that window before they are overwritten on our normal backup cycle. Backups are not used for any operational purpose and are deleted on the usual rotation.
We do not carry out automated decision-making, including profiling, that produces legal effects concerning individuals or similarly significantly affects them within the meaning of Article 22 of the UK GDPR.
Our species and habitat tools are deterministic. The bat detection pipeline uses a small model that runs locally on your device. In both cases the output is a draft or a candidate detection: an ecologist reviews, edits and signs off every result.
Under UK data protection law, you have the following rights:
To exercise any of these rights, contact us at info@ecorva-ai.co.uk. We will respond within one month.
If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
We would appreciate the opportunity to address your concerns before you contact the ICO, so please contact us first if possible.
We may update this Privacy Policy from time to time. Material changes will be communicated via email or through our website. The date at the top of this policy indicates when it was last updated.