RedactAgent Privacy Notice

This notice explains how RedactAgent handles personal data for the public website, demo requests, account administration, billing, support, and application use. Where a client uploads documents for review, RedactAgent will usually act as a processor for that client, and the client's own privacy notice and data processing agreement will also apply.

1. Who this notice covers

This notice covers website visitors, demo requesters, account users, administrators, billing contacts, support contacts, and individuals whose personal data appears in customer documents processed through RedactAgent.

2. Personal data we collect

• Contact details, such as name, email address, organisation, role, and request details.
• Account data, such as sign-in identifiers, tenant membership, role, workspace access, and authentication metadata.
• Billing data, such as plan, payment status, checkout metadata, Stripe customer identifiers, and credit usage records.
• Usage and activity data, such as import, processing, redaction, export, audit, quota, and error metadata.
• Support and security data, such as messages, issue reports, request IDs, IP address, user agent, and diagnostic metadata.
• Legal acceptance and contracting evidence, such as document version and hash, acceptance time and method, tenant, signatory or accepting user, authority confirmation, IP address, user agent, request ID, executed-contract metadata, and electronic-signature envelope reference.
• Marketing and enquiry data, such as landing page, referring page, campaign parameters, submitted organisation, role, use case, and a one-way hash of the request IP address.
• Customer document content where a client uploads files for OCR, redaction, DSAR review, extraction, export, or related processing.

3. How we use personal data

• To provide, secure, monitor, support, and improve RedactAgent.
• To process demo requests, onboarding, account administration, and customer support.
• To measure aggregate website performance, understand which public resources generate enquiries, and improve the public website without behavioural advertising.
• To authenticate users and enforce tenant, workspace, matter, and role-based access controls.
• To run OCR, personal-data detection, AI-assisted redaction suggestions, DSAR workflow support, exports, and audit workflows when enabled by the customer.
• To operate billing, subscription, credit, usage, and payment workflows.
• To comply with legal obligations, security obligations, audit requirements, and client instructions.

4. Legal bases

For UK/EU privacy purposes, legal bases may include contract performance, legitimate interests in operating and securing the service, compliance with legal obligations, consent where required, and documented client instructions where RedactAgent acts as a processor.

5. Client documents and processor role

Customer documents may contain personal data, special category data, legal material, privileged material, HR records, customer records, and other confidential content. RedactAgent processes this content to provide the service and follows the applicable data processing agreement where RedactAgent acts as a processor.

RedactAgent does not train or fine-tune AI models on customer documents. AI, OCR, and detection provider boundaries are explained in the AI Data-Use and Model-Training Assurance document.

6. Subprocessors and sharing

RedactAgent uses subprocessors for hosting, authentication, database, OCR, AI processing, billing, security access controls, and operational support. Current subprocessors are listed in the Subprocessor Register. RedactAgent does not sell customer documents or send source documents to Stripe.

7. International transfers

Where personal data is transferred internationally, RedactAgent will use appropriate transfer mechanisms required by applicable law, such as provider contractual terms, data processing addenda, standard contractual clauses, UK addenda, or other approved mechanisms as applicable.

8. Retention

Account, billing, security, and audit metadata is retained for operational, legal, security, and accounting purposes. Customer document retention depends on the workspace configuration, processor workflow, export continuity needs, deletion instructions, and signed client agreement. The Retention and Deletion Policy provides more detail.

9. Security

RedactAgent uses technical and organisational measures designed to protect personal data, including authentication, tenant/workspace access controls, server-side credentials, processor boundaries, audit records, provider security controls, and operational logging designed to avoid storing document content unnecessarily.

10. Your rights

Depending on applicable law, individuals may have rights to access, rectify, erase, restrict, object to processing, port data, or complain to a regulator. For personal data in client documents, requests should normally be sent to the relevant client organisation as controller.

11. Contact

For privacy questions, contact team@redactagent.io. If your request concerns documents uploaded by a RedactAgent customer, please identify the customer organisation so the request can be routed appropriately.

12. Changes

RedactAgent may update this notice as the service, providers, law, or deployment model changes. The version date above shows when this page was last updated.

This notice is provided to meet transparency obligations. A request to acknowledge that it was provided is not consent to processing that relies on contract, legal obligation, legitimate interests, client instructions, or another lawful basis.