Draft — pending legal review
Privacy policy
1. Who we are
CorpusReady is operated by Trove Distribution Limited, company number 10187717, registered in England and Wales.
2. Our two roles
Your account. We are the controller of your account details: your name, email address, country, plan and payment status. We use them to run your account, take payment and send you service emails.
Data you upload. For the business data you upload, you are the controller and we are your processor. We process it only to provide the service you ask for.
3. Laws we follow
We follow the UK GDPR and the Data Protection Act 2018. For Malaysian users and data subjects, we follow the Personal Data Protection Act 2010 (PDPA).
4. How we handle uploaded data
- We check uploads for data we refuse (health, biometric, children’s, financial-account and government-ID data). Refused files are deleted straight away.
- Detection and redaction of personal data are deterministic, using pattern matching, dictionaries and Microsoft Presidio running on our own server.
- No language model ever receives raw, un-redacted data.
- Raw uploads are deleted 24 hours after your pack is written; 30 days after payment if you have paid for a pack but not run it; or 7 days after upload if no pack is bought. An hourly job deletes them and logs each deletion.
- We never sell, resell or license your data. A pack goes to a marketplace only when you choose to submit it.
5. Where your data is stored
CorpusReady runs on a server in a UK datacentre in London. Uploaded files, packs and our database are stored there. Our sub-processors below may process limited data outside the UK under their own safeguards.
6. Sub-processors
| Sub-processor | Purpose | Data |
|---|---|---|
| Stripe | Payments | Account and payment details |
| Resend | Transactional email | Email address and message content |
| Anthropic | Drafting narrative sections of the provenance document | Redacted metadata and redacted samples only, never raw data |
7. Retention
Raw uploads are deleted in one of three ways. If you buy a pack and run it, 24 hours after the pack is written. If you pay for a pack but do not run it, 30 days after payment (or after you upload the file again, if that is later); we email you a reminder on day 7 and day 25, and your payment does not expire, so you can upload the file again and run the pack later. If you do not buy a pack, 7 days after upload. Refused files are deleted straight away. Packs, redaction logs, manifests and scorecards: kept until you delete them or close your account. Audit records of uploads, refusals, redactions and deletions: kept for 2 years.
Account details: when you close your account, we keep your account details for 30 days, then delete them. The exception is records we must keep by law, such as payment and tax records, which we keep only for as long as the law requires.
8. Marketing email
We will not send you marketing email without your consent. Service emails, such as sign-in links, receipts and reminders that a paid pack has not been run, are not marketing. You can withdraw consent at any time.
9. Your rights
You can ask to access, correct or delete your personal data, object to processing or ask for a copy of your data. Under the PDPA you can also ask to access and correct your data and to limit its processing. Contact us using the email address in the footer. In the UK you can complain to the Information Commissioner’s Office. In Malaysia you can complain to the Personal Data Protection Commissioner.
10. Cookies
We use only essential cookies, to keep you signed in and protect sign-in forms. Our analytics are self-hosted and do not use cookies.