Privacy Policy & Data Protection Standards

1. Institutional Identity and Scope

This Privacy Policy governs the processing of personal and commercial data by Chipperycuriousvalt Legal AI Technologies Ltd. (Registration No: 14892015), having its registered office at 44 Chancery Lane, Holborn, London WC2A 1JE, United Kingdom ("Chipperycuriousvalt," "we," "us," or "our").

We operate an artificial intelligence document examination and clause explanation platform. This policy clarifies our duties as both a Data Controller (for website visitor inquiries, account credentials, and billing metrics) and a Data Processor (for client contractual documentation uploaded to our analytical engines).

2. Categories of Information Collected

We collect and process only the minimum necessary categories of information required to provide accurate document explanation and maintain operational security:

• Direct User Information: Names, business email addresses, job titles, and telephone numbers submitted through our contact forms or service inquiries.
• Contractual Payload Data: Commercial agreements, terms of service, schedules, amendments, and related legal instruments uploaded to our parsing pipelines. We strongly recommend redacting personally identifiable details of individuals prior to upload where feasible.
• Technical Telemetry: IP addresses, browser user-agent strings, session timestamps, and interaction logs captured to defend against distributed denial-of-service attacks and ensure platform stability.
• Cookie Identifiers: Minimal session and preference tokens stored strictly in accordance with user consent choices.

3. Contract Processing Boundaries & Model Training Commitments

A foundational concern in automated contract analysis is the unauthorized use of proprietary commercial data to train foundational models. We maintain a strict data isolation policy:

Zero Model Training on Customer Payloads: Text, clauses, exhibits, or terms extracted from client agreements are processed in ephemeral memory. They are never used to fine-tune, retrain, or improve publicly accessible machine learning models or general foundational weights. Client documents remain logically and cryptographically partitioned within dedicated tenant environments.

4. Legal Bases for Processing under UK GDPR / EU GDPR

We process personal data only when authorized by applicable statutory grounds:

• Performance of Contract (Article 6(1)(b)): To execute document parsing, generate clause summaries, and fulfill our contractual obligations to enterprise subscribers.
• Legitimate Interests (Article 6(1)(f)): To safeguard infrastructure integrity, prevent fraudulent exploitation, and ensure platform performance.
• Legal Compliance (Article 6(1)(c)): To maintain required accounting records and cooperate with lawful statutory discovery orders.
• Explicit Consent (Article 6(1)(a)): For non-essential performance tracking cookies, which can be withdrawn at any time.

5. Third-Party Data Processors

To deliver enterprise-grade performance, we engage verified third-party infrastructure providers bound by strict Data Processing Agreements (DPAs):

• Cloud Hosting: Dedicated European data center providers adhering to ISO/IEC 27001 and SOC 2 Type II audit standards.
• Database & Encryption Infrastructure: Enterprise-managed key storage leveraging AES-256 at rest and TLS 1.3 in transit.
• Transactional Communications: Hardened enterprise email delivery services for operational alerts and service responses.

6. Retention and Erasure Schedules

Contractual payloads processed during ad-hoc demonstrations are automatically purged from active memory buffers within twenty-four (24) hours of session conclusion. Registered enterprise clients retain sole administrative control over their document archives, with immediate irreversible deletion available upon client initiation or contract termination. Standard transactional accounting records are retained for seven (7) years in accordance with United Kingdom statutory tax regulations.

7. Statutory Rights (GDPR, UK GDPR, and CCPA/CPRA)

Regardless of geographic location, we extend comprehensive data subject rights to all users:

• Right of Access: You may request formal verification of whether your personal information is undergoing processing, alongside an itemized copy.
• Right to Rectification: You may correct inaccurate or incomplete biographical records.
• Right to Erasure ("Right to be Forgotten"): You may demand the irreversible deletion of your data where no overriding statutory basis applies.
• Right to Restriction and Objection: You may challenge processing founded upon legitimate interests or demand temporary suspension of data handling.
• Right to Portability: You may request machine-readable exports (JSON or CSV) of all directly submitted account records.
• Non-Discrimination: California residents will never experience discriminatory pricing or service denial for exercising CPRA rights.

8. Data Protection Officer (DPO) Inquiries

To exercise any statutory right or submit questions regarding our security architecture, contact our Data Protection Officer directly: