Your data, in plain English
We tell people not to paste a child's record into a general purpose chatbot. That invites a fair question back, so here is the answer without the legal register.
Do you keep the documents we upload?
No. A document is sent for analysis and never written to our database. It exists as a temporary file with our AI provider for the length of the review, is deleted when the review finishes, and carries an automatic one hour expiry on top of that in case the deletion ever fails.
Where is our data held?
Account data is held in London, in the United Kingdom. When a document is analysed it is sent to our AI provider in the United States for the length of the review, under a contract carrying UK International Data Transfer Agreement clauses, and is not stored there. The full sub-processor list, with the location and transfer mechanism for each, is in the Data Processing Agreement below.
Is any of it used to train an AI model?
No. Our AI provider does not use submitted content for training. It keeps operational logs of API calls for up to 30 days, then deletes them.
Who is the data controller?
You are, for anything about a child. You decide why that document is being reviewed, and we process it on your instruction. We are the controller only for account data: the names, work email addresses and usage records of the people who hold logins.
How long do you keep what you do keep?
Usage records for 24 months. Account data for 12 months after the account closes. A free account with no sign-in for 6 months is treated as closed from that point, and we email three warnings before that happens.
Can we give this to our local authority?
Yes. The Data Assurance Statement below is signed and written to be put on file and shown to a commissioner or an inspector.
The documents behind all of that
This page is the summary. These three are the authority, and they are where the detail lives.
Data Assurance Statement
PDFSigned, one page, written for a commissioner or an inspector. This is the one to attach to a tender.
Data Processing Agreement
PageThe Article 28 contract, with the sub-processor list, transfer mechanisms and what happens when a subscription ends.
Privacy Policy
PageEverything else: lawful basis, your rights, cookies, and how to reach us to exercise any of them.
If your commissioning team needs something these do not cover, ask. We would rather answer a hard question once than have it sit unanswered in a procurement pack.