Privacy Policy

Data controller. The consulting agency or organisation whose workspace (tenant) you belong to determines why and how the personal data in that workspace is processed.

Data processor. The platform operator hosts and maintains the application and processes personal data only on the controller's instructions, under a data processing agreement consistent with Article 28 GDPR.

• Account data: full name, email address, optional phone number, role, tenant, and a securely hashed password.
• Usage & security data: audit records of actions you take, the role you held at the time, and the IP address from which a recorded action originated.
• Business contact data: names and contact details of company representatives entered as part of client onboarding.
• Billing data (paid plans): billing contact details and VAT identification number.

The platform is not designed to process special categories of personal data (Article 9 GDPR). Please do not enter such data into free-text fields unless it is necessary and lawful for the controller.

• To provide the service (account management, assessments, documentation, reporting) - performance of a contract, Article 6(1)(b).
• To secure the platform and keep audit trails - legitimate interests in security and accountability, Article 6(1)(f), and legal obligation, Article 6(1)(c).
• To handle billing and tax where a paid plan is used - contract and legal obligation, Article 6(1)(b) and (c).
• To send essential service notifications (for example, account or security messages) - legitimate interests and/or contract.

The application uses a third-party large language model to assist users with drafting governance documents and producing analyses. This processing is designed to keep humans in control:

• AI output is always presented as a draft, clearly labelled as AI-generated (EU AI Act Art. 50).
• A qualified human reviews every output, and a certified reviewer must sign off before a document can be finalised or exported (EU AI Act Art. 14).
• The platform does not make automated decisions that produce legal or similarly significant effects about individuals within the meaning of Article 22 GDPR.
• Data sent to the AI provider is limited to what the task requires and is not used to train third-party foundation models.

Personal data is shared only with:

• Users within your own tenant who are authorised by their role to see it;
• Infrastructure sub-processors that host the application and provide AI inference, bound by confidentiality and data-protection terms;
• Payment and tax-verification providers, only where a paid plan is in use;
• Public authorities where disclosure is required by law.

We do not sell personal data.

The service is intended for EU use. Where a sub-processor processes data outside the EEA, an appropriate safeguard under Chapter V GDPR (such as an adequacy decision or Standard Contractual Clauses) is relied upon.

Personal data is retained while your account or your tenant's contract is active, and afterwards only as long as needed for legal, tax, audit, or compliance obligations. After that it is deleted or anonymised.

Under the GDPR you have the right to:

• access the personal data held about you (Article 15);
• have inaccurate data corrected (Article 16);
• request erasure where applicable (Article 17);
• restrict or object to certain processing (Articles 18 and 21);
• receive your data in a portable format (Article 20);
• lodge a complaint with your national data protection authority.

You can view and update your own name and phone number directly on the Profile page. For other requests, contact your tenant administrator (acting as controller), who will action the request with the platform operator's support.

We apply technical and organisational measures appropriate to the risk, including password hashing, encryption of sensitive credentials at rest, encrypted connections in transit, role-based and tenant-scoped access control, and comprehensive audit logging. See the Data Management page for details.

This policy may be updated to reflect changes in the service or the law; the "last updated" date above will change accordingly. For privacy questions or to exercise your rights, contact your tenant administrator. The specific controller identity and data protection contact for your workspace are configured by your organisation.