Privacy notice
The table below is generated from the data map, not maintained alongside it. A category the system does not hold cannot appear here, and a column added to the schema without being classified stops erasure running at all rather than quietly escaping this page.
What we collect and why
Generated from the data map, so this list cannot claim less than the system holds.
Version 2026-09-24, published 24 September 2026
| Data | What it is for | Lawful basis | Kept for |
|---|---|---|---|
| Email addressEncrypted in the row | Sign-in identity, transactional notifications, invitations, approvals | Contract (account) / legitimate interests (notifications) | 30 days after account deletion, then the blind index only for suppression (C16) |
| Name | Attribution in the UI, audit records, approval trails | Contract | For the life of the account; the audit trail keeps a pseudonymised record for 12 months (M14.3, C9) |
| IP address | Session security, rate limiting, abuse investigation | Legitimate interests (security) | 180 days (C11 security logs) |
| Device and user agent | Trusted-device recognition, session list (M28.10) | Legitimate interests (security) | 180 days after the session ends |
| Contact profile fields | CRM record of a person who contacted the tenant: custom fields, company, role, location | Legitimate interests (customer relationship), assessed per C6 | Pseudonymised after 24 months with no interaction (C6); erased on request (C7) |
| Phone numberEncrypted in the row | Contacting a person on a messaging network, and matching a contact across networks | Consent (SMS/WhatsApp) / legitimate interests (contact record) | As the contact record (C6); suppression list keeps the blind index only (C16) |
| Social handle tied to a personLeaves the region | Identifying who wrote a message, a mention or a piece of user-generated content | Legitimate interests (the person addressed the tenant in public) | As the record it belongs to; listening captures only while the query is active (C6) |
| Location | Contact location on the CRM record and coarse audience geography | Legitimate interests (audience understanding) | As the contact record (C6) |
| Date of birth or age attestationEncrypted in the row | Proving the account holder is an adult, and nothing else | Legal obligation (the 18+ gate, C15) | For the life of the account; never used for targeting or personalisation |
Generated from 16 tables in the data map.
Sub-processors and transfers
Every company that processes personal data for this deployment, where it processes it, and under what transfer mechanism.
| Company | What for | Where | Transfer mechanism |
|---|---|---|---|
| Amazon Web Services | Hosting, database, object storage, queues and logs | eu-west-2 | No transfer: processing stays in the deployment’s own region |
| AnthropicAI providerZero retention | AI assist: captions, rewrites, replies and narratives (M29) | us-east-1 (United States) | UK–US Data Bridge (DPF certification) |
| Stripe | Payments, invoices and tax identifiers (M15) | Ireland and United States | UK Addendum to the EU SCCs |
| AyrshareAggregator | Aggregator fallback for networks pending direct app review (M1.14) | us-east-1 (United States) | UK Addendum to the EU SCCs |
| Sentry | Client error reporting; personal data is redacted before send (C3) | Germany | UK Addendum to the EU SCCs |
Changes are notified 30 days before they take effect.
1. Your rights, and how to use them
Access, correction, erasure, portability, restriction and objection. Email the privacy contact below and the request is logged with its statutory clock the moment it arrives; a signed-in customer can also raise it from their own account. Erasure produces a certificate naming what was deleted and from where.
We answer within the statutory period for your jurisdiction and tell you the date when the request is received, not when it is finished.
2. Where your data is held
This deployment stores data in eu-west-2. The region is chosen when a deployment is created and never changes, because there is no cross-region replication of content to move.
3. Who to contact
These clause groups are named rather than drafted. An engineering draft of contract language is worth less than an honest gap, so the gap is listed.
- The plain-language narrative notice for each processing purpose, reviewed for each jurisdiction
- The lawful-basis assessment wording for legitimate interests