Privacy Policy

1. Who we are

1.1 This Service is operated by Enterprise Information Systems Inc., a corporation organised under the laws of the State of Florida, United States (“we,” “us,” “our”).

1.2 You can contact us at PO Box 291, Kathleen, FL 33849, United States, or through the contact form in the Service.

1.3 For the purposes of the UK and EU General Data Protection Regulation, we are the controller of the personal data described in this policy.

2. What we collect

2.1 Account information. When you create an account we record the identifier associated with the sign-in method you chose.

2.2 The information we hold about you depends on how you signed in. Where your sign-in method supplies an email address to us, we record it. Where it does not, we do not hold one. We do not require you to supply an email address by a separate route in order to read.

2.3 Content you create. Cases you create, and material you upload to them.

2.4 Service records. Records of requests made to the Service, including the time of the request and the material requested. We keep these to operate and secure the Service.

2.5 Cookies and similar technologies.

• 2.5.1 Strictly necessary. We set cookies required to keep you signed in. These are set without your consent because the Service cannot work without them.
• 2.5.2 Analytics. We use Google Analytics to understand how the Service is used. Analytics cookies are switched OFF until you turn them on. When the Service loads, analytics and advertising storage are set to denied before any analytics script is able to run, and they stay denied unless you choose otherwise in Cookie settings. You can change your choice at any time in Cookie settings, and withdrawing your consent is as easy as giving it (section 7.1(g)). We do not run advertising, and advertising storage and personalisation remain denied at all times.
• 2.5.3 Sign-in providers. If you sign in with Google, Facebook or X, that provider receives information about your sign-in.
• 2.5.4 Payments. Donations are handled on a Stripe-hosted page. Stripe’s own notice governs what it collects there.

3. Why we process it — lawful basis

3.1 We process account information and content to perform our contract with you.

3.2 We process service records for our legitimate interests in operating, securing and debugging the Service, and in detecting misuse.

3.3 Where we rely on legitimate interests, you may object — see section 7. Where we rely on your consent, you may withdraw it at any time — see section 7.1(g).

4. Who we share it with

4.1 We use service providers who process data on our instructions. These include hosting, storage and infrastructure (Microsoft Azure — which also provides the AI service described in section 4.1a), transactional email (SendGrid), payments (Stripe), analytics (Google), and the sign-in providers you choose to use.

4.1a Artificial-intelligence processing. Where you use a feature that relies on an AI model — search assistance, summaries, answers about a record, chat in a workspace, or the checks we run on an image you upload — the content needed to answer that request is sent to the AI service we use for it and processed there on our instructions. We currently use the Azure OpenAI Service, operated by Microsoft. We may change the models, model versions and providers we use.

4.2 We do not sell your personal information.

4.3 We may disclose information where we are required to by law, or where we believe in good faith that disclosure is necessary to protect our rights, your safety, or the safety of others.

4.4 Where your data is processed.

• 4.4.1 Our infrastructure is located in the United States (Azure East US 2). Data you provide is stored and processed there.
• 4.4.2 We are a United States company, and we collect your information directly from you into our systems in the United States. If you are in the United Kingdom or the European Economic Area, your personal data is therefore stored and processed in the United States, where the law protecting it is different from the law where you live.
• 4.4.3 Where we send your information on to a service provider (section 4.1), we require them to handle it only on our instructions and to protect it. Some of those providers operate in other countries.
• 4.4.4 You can ask us what safeguards apply to your information using either route in section 7.2.

5. How long we keep it

5.1 We keep account information for as long as your account is open.

5.2 We keep records of requests made to the Service for as long as necessary to operate and secure it.

5.3 Files you upload are held in a working area and removed from it automatically after one day. Source material we ingest is removed from its working area automatically after seven days.

5.4 Copies we generate from a document — page images, previews, transcripts and similar — are not subject to any automatic removal. They are kept indefinitely.

5.5 Our database backups retain data for 7 days.

5.6 We may keep information for longer than the periods above where we need it to keep the Service secure, to prevent, detect or investigate fraud or misuse, to comply with a legal or regulatory obligation, or to establish, exercise or defend legal claims. Where we do, we keep only what we need for that purpose.

6. Deletion and removal

6.1 The material in this Service is held as an archive. It is not designed to be edited or deleted once ingested, and there is currently no way for you to delete a document from it yourself.

6.2 There is currently no way to close your account yourself, and no self-service export of your data. To ask for a copy of your personal data, or for it to be erased or removed, use either route in section 7.2.

6.3 If you want material about you removed, or your personal data erased, contact us using either route in section 7.2. We will tell you what we are able to do and what we are not — see section 7.

6.4 Where material is removed from the Service, copies generated from it and earlier stored versions of it may remain in our storage systems.

7. Your rights

7.1 Depending on where you live you may have the right to:

• access the personal data we hold about you;
• have it corrected;
• object to processing;
• ask us to restrict processing;
• receive it in a portable form;
• request its erasure; and
• withdraw your consent, where the processing depends on your consent. Withdrawing consent does not affect anything we did before you withdrew it.

For analytics cookies you can also change your choice at any time in the Service’s cookie settings.

7.2 How to make a request. You can contact us through the contact form in the Service, or by post at PO Box 291, Kathleen, FL 33849, United States.

7.3 We may not be able to fulfil every request in full. Where we cannot, we will tell you what we have done and what we have not, and why.

7.4 If you are in the UK or the EEA you may complain to your data protection supervisory authority.

7.5 Checking who you are. Before we act on a request, we need to be satisfied that it comes from you, or from someone authorised to act for you. We may ask you for information to confirm that. We will ask for no more than we need for that purpose, and we will use what you give us only to check the request and to respond to it. If we cannot satisfy ourselves who you are, we will tell you, and we will not act on the request.

7.6 When we will respond. We will respond without undue delay, and in any event within one month of receiving your request. If your request is complex, or you have made several, we may need up to two further months — if so, we will tell you within the first month, and we will tell you why.

7.7 When we may not be able to act. There are situations in which we may not be able to do what you ask, or not in full. They include where:

• we cannot satisfy ourselves who you are (section 7.5);
• the law requires us to keep the information;
• doing what you ask would affect someone else’s rights or reveal their personal data;
• we need the information to establish, exercise or defend a legal claim, to resolve a dispute, or to enforce our agreements;
• we need it to keep the Service secure or to prevent, detect or investigate fraud or misuse; or
• the material forms part of the archive — see section 6.1, and note that removal from the Service is not the same as erasure from our storage systems (section 6.4).

Where any of these applies we will tell you, and we will tell you why (section 7.3).

8. Security

8.1 We take reasonable technical and organisational measures to protect the information we hold.

9. Children

9.1 The Service is not directed to children, and you must be 18 or over to use it.

10. Changes to this policy

10.1 We may update this policy. The date shown at the top is the date it last changed. Where a change materially affects how we use your personal data, we will publish the updated policy here, with a revised date, before it takes effect.

10.1a You do not need an email address to use the Service, and we may not hold one for you (section 2.2). Notice of a change is therefore given by publishing it here. Where we do hold an email address for you, we may also send notice to it; we do not undertake to do so.

11. Contact

11.1 You can reach us through the contact form in the Service, or by post at PO Box 291, Kathleen, FL 33849, United States.