Privacy Policy

1. Information we collect

• Account data: name, business email, organisation, role and billing contact.
• Usage data: log-ins, feature usage, API calls, device and browser information.
• Customer content: documents, records and data you submit for processing.
• Support data: correspondence, tickets and diagnostic information you share.

2. How we use information

To provide and secure the services, authenticate users, process transactions, deliver support, monitor reliability, prevent abuse, meet legal obligations and improve product quality. We do not use customer content to train foundation models for other customers.

3. Data storage

Data is stored on AWS infrastructure with logical tenant isolation, encryption in transit (TLS 1.2+) and at rest (AES-256), and regional hosting options where offered by your plan.

4. Data sharing

We share data only with sub-processors that support the service (cloud hosting, model inference, payments, analytics and support tooling), each bound by contractual confidentiality and security obligations, and with authorities where legally required. We do not sell personal data.

5. Cookies and tracking

We use essential, functional and analytics cookies. Details and controls are described in our Cookies Policy, and consent is captured where legally required.

6. Security practices

Controls include role-based access, single sign-on and SCIM provisioning, least-privilege administration, secrets management, PII detection and redaction, audit logging, vulnerability management and incident response procedures.

7. Your rights

Depending on your jurisdiction, you may request access, correction, deletion, restriction, portability, or object to certain processing, and withdraw consent where processing is consent-based. Requests can be made using the contact details below.

8. Data retention

Customer content is retained for the subscription term and deleted within 30 days of termination unless a longer period is required by law. Billing and compliance records are retained for statutory periods. Aggregated, non-identifying analytics may be retained indefinitely.

9. Children's data

The services are intended for organisational use and are not directed at children. Where an education customer processes student data, that processing occurs under their instructions as controller.