Data Processing Agreement

Where Ormeval processes personal data on your behalf, you are the data controller and Ormeval is the processor. Ormeval processes such data only to provide the service and on your documented instructions.

How much Ormeval holds depends on whether your users sign in. Without an account the cockpit is browser-local and we hold nothing of it. With an account we process, under each user ID: email, display name and profile; saved cockpit configuration and follows; team membership, shared books and annotations; and any community posts, comments and messages. We also process a business email address for alerts or the digest where that is opted into, and pseudonymous usage analytics where analytics is allowed. Our sub-processor list itemises this by vendor. The intelligence itself is built from public sources, not personal data.

We keep personal data confidential and apply the technical and organisational measures described on our Security & trust page, including encryption in transit and least-data collection.

We use a short, vetted list of sub-processors (hosting and the application database today; the AI provider and a transactional-email provider once enabled), each bound by data-protection terms. The current list is published in full, including which are switched on and exactly what each one receives, and we will give notice of material changes.

Personal data is processed outside the UK, the EEA and Quebec, because our hosting and database providers operate in the United States. Each is engaged under its own data-protection terms, which include transfer clauses. The transfer mechanism for our own entity, the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, is being put in place with counsel and is not yet executed.

We help you meet data-subject requests. Users can export or delete their own data at any time from Settings, and we will assist with access, correction and erasure requests you receive.

Scope note: export and erasure cover every record we can link to the person - by account, email address, or the browser identifier described in the Cookie Policy. Telemetry recorded with none of those identifiers cannot be linked back to an individual and therefore falls outside per-person export and erasure (GDPR Art. 11); it is governed by the retention schedule instead, which deletes it on a fixed clock.

We will notify you without undue delay and in any event within 48 hours of becoming aware of a personal-data breach affecting personal data we process for you.

That notice will describe the nature of the breach, the categories and approximate volume of personal data and data subjects concerned, the likely consequences, and the measures we have taken or propose to take. It is sent with what we know at the time and is not delayed for completeness; we follow up as more becomes known.

The 48 hours runs from our own awareness, not from the incident. Where a breach originates with one of our sub-processors, our awareness depends on their notice to us, and their obligation to us is “without undue delay” rather than a fixed period.

The two clocks are cumulative and intentional: this 48-hour notice to you is separate from, and comes before, the 72-hour period for notifying a supervisory authority stated in our Privacy Policy, so that you have what your own filing needs in time to make it.

On termination, or on your request, we will delete or return the personal data we process on your behalf, save where retention is required by law.