Privacy Policy

Who is responsible for your data

ChatNEC is operated by [[LEGAL_ENTITY]], a company registered in England and Wales under company number [[COMPANY_NUMBER]], with its registered office at [[REGISTERED_ADDRESS]]. We are registered with the Information Commissioner's Office under registration number [[ICO_NUMBER]].

This policy covers the website at chatnec.com and the service at app.chatnec.com. For anything about it, write to founders@chatnec.com.

Two kinds of data, two different roles

The distinction runs through everything below, so it is worth two sentences up front.

• Your account and billing details. We decide what to collect and why, so for this we are the controller and this policy is your privacy notice.
• The documents you upload. Contracts, payment applications, timesheets and correspondence belong to you or your client. We hold and process them on your instructions and for no purpose of our own, so for this we are a processor and you are the controller. See if you are a business customer.

What we collect and why

We do not buy personal data, we do not sell it, and we run no advertising of any kind. The usage analytics described in cookies and analytics stays first party: it is never shared with advertisers or ad networks, and it never follows you to other sites.

Your documents and how the AI uses them

When you ask a question or upload a document, the relevant text is sent to Anthropic and processed by its Claude models to produce the answer, the draft or the findings. This is how the product works, and it is worth being plain about what it means.

• Anthropic processes your material under commercial terms and a data processing agreement, as our sub-processor and on our instructions.
• Under those terms Anthropic does not use your material to train its models.
• Anthropic deletes API inputs and outputs from its systems within 30 days, other than what it must keep to enforce its usage policy or to comply with law.
• Your documents themselves stay in your own workspace. What travels to Anthropic is the text needed to answer the request in front of it.

Anything you upload may contain personal data about other people: site staff on timesheets, names in correspondence, signatories on a contract. You decide what to upload, and the Terms of Service ask you to confirm you are entitled to. We handle it as described here and for nothing else.

Training, and why we do not do it

Nothing you put into ChatNEC is used to train an AI model. Not by us, and not by Anthropic. There is no opt-out to find in a settings page, because there is nothing to opt out of.

We also do not read your documents. Access by our staff is limited to the circumstances in who else sees it, which in practice means fixing a fault you have reported to us.

Where your data is held

Your workspace, your documents and everything ChatNEC drafts for you are held on servers in London, United Kingdom.

Three parts of the service sit outside the UK, and we would rather tell you than have you find out:

• Accounts and sign-in. Clerk holds your name, email and session records in the United States.
• AI processing. Anthropic processes the text of your questions and documents on infrastructure in the United States.
• Usage analytics. PostHog holds analytics events and session replays in the European Union. See cookies and analytics.

Both transfers are covered by written data protection terms that include the UK International Data Transfer Addendum to the European Commission's standard contractual clauses, and both providers are certified under the UK extension to the EU-US Data Privacy Framework. Payment data handled by Stripe is transferred on the same footing.

The providers we use

Delivering ChatNEC means relying on other companies. This is the current list. We will update it here before adding anyone new, and business customers on a data processing agreement are notified in advance.

Each of them acts under a written contract that limits them to our instructions and holds them to security obligations at least as strict as our own.

Who else sees it

Nobody, beyond the providers above, except in these cases:

• Us, to fix something. A small number of named people can reach production systems. Access is logged, and it happens to investigate a fault or a security incident, not to browse.
• Your organisation. If your subscription is held by your employer or is part of a team arrangement, the account administrator can see who holds a seat and what is in the shared workspace.
• The law. If we are required by a court order or a lawful request, we comply. Where we are permitted to tell you, we will.
• A sale of the business. If ChatNEC is ever acquired, data may transfer to the buyer, who would be bound by this policy. We would tell you before it happened.

How long we keep it

Ask us to delete your material sooner and we will, except where we have to keep a billing record to satisfy HMRC.

How we protect it

• Each subscriber gets a private, isolated workspace. Your material is not pooled with anyone else's, and there is no shared index across customers.
• Everything travels over encrypted connections, and data is encrypted at rest.
• Sign-in is handled by Clerk, with multi-factor authentication available on every account. We recommend you turn it on.
• We never handle your card number. Card details are captured by Stripe, a PCI DSS Level 1 certified service provider, and transmitted directly to it. Our systems receive only a token and the last four digits.
• Access to production systems is restricted to named people, requires multi-factor authentication, and is logged.
• Anthropic, Clerk, Stripe and DigitalOcean are each independently audited. Anthropic holds SOC 2 Type II, ISO 27001 and ISO 42001 certification.

If there is ever a breach that puts your rights at risk, we will tell the ICO within 72 hours and tell you without undue delay. If you think you have found a security problem, email founders@chatnec.com and we will take it seriously.

Cookies and analytics

We use PostHog, a product analytics service, on chatnec.com and app.chatnec.com. All analytics data is sent to and held by PostHog in the European Union. It is first party only: nothing is shared with advertisers, and nothing follows you to other sites.

Here is what it does, plainly:

• It sets cookies and uses local storage to recognise the same browser across visits, so we can tell one returning visitor from ten new ones.
• It records which pages you view and what you click, on this site and in the app.
• It records session replays: a reconstruction of what was on your screen, including text you could see in the app. Anything typed into a password or other input field is masked and never recorded. Replays are visible only to us, and are deleted after 30 days.
• Once you sign in, this activity is linked to your account (your account id, email address and plan), so we can, for example, watch the session behind a fault you report.

Because replays can show documents and answers that were on your screen, they are handled with the same care as the documents themselves: EU storage, access restricted to the same named people, and the retention above.

You can switch analytics off for this browser at any time, no account needed:

Turn analytics off for this browser

The app also sets cookies that are strictly necessary to keep you signed in and to keep the session secure; those are exempt from the consent requirement under the Privacy and Electronic Communications Regulations. We run no advertising or marketing cookies anywhere, and no third party ad tracking of any kind.

Your rights

Under the UK GDPR you can ask us to:

• Show you the personal data we hold about you, and give you a copy.
• Correct anything that is wrong.
• Delete it, where we have no overriding reason to keep it.
• Restrict or object to how we use it, including anything we do on the basis of legitimate interests.
• Port it, in a common machine readable format.

Write to founders@chatnec.com. We will answer within one month, and it costs you nothing. We may ask you to confirm who you are first, which protects you rather than us.

If you are unhappy with how we have handled it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. We would rather you came to us first, but it is your right either way.

If a request concerns personal data inside documents you uploaded, it usually belongs to your organisation rather than to us, because you are the controller of that material. We will pass it to you and help you answer it.

If you are a business customer

Where we process personal data contained in your documents, we do so as your processor under Article 28 of the UK GDPR. A data processing agreement covering the required terms, including our sub-processors, security measures, breach notification, and return or deletion at the end, is available on request from founders@chatnec.com. Most procurement teams ask for one, and we would rather you had it before you needed it.

Under it we act only on your documented instructions, keep your material confidential, hold the sub-processors in the list above to equivalent terms, tell you about new ones before they start, and return or delete everything when you ask.

Changes to this policy

We will update this page when what we do changes. The date at the top always shows the current version. If a change materially affects you, we will email you before it takes effect rather than quietly editing the page.

How to contact us

[[LEGAL_ENTITY]]
[[REGISTERED_ADDRESS]]
founders@chatnec.com

Data protection questions go to the same address. There is no separate department, and that is the point: you get an answer from someone who knows how the system is built.