Privacy Policy
Cahier Ltd
1. Who we are and what this policy covers
Cahier Ltd (“Cahier”, “we”, “us”) provides a model platform to regulated enterprises: a fine-tuned language model, an inference runtime, a policy gate and a governance console, running either in the customer's own private cloud or on cloud GPU capacity we control in Paris, with an evaluation harness that scores each model version on the customer's own cases and an evidence pack for each version.
Registered at 20 Farringdon Road, London EC1M 3HE, United Kingdom.
We handle personal data in two different situations, and different rules apply to each:
| Whose data | Our role | What applies | |
|---|---|---|---|
| Part A | People who visit this website, ask about the service or write to us | Controller: we decide why and how the data is used | This policy |
| Part B | Personal data inside the documents and cases a customer's automations process | Set out in B.1, because it depends on the data | This policy and the data processing agreement we sign with each customer |
If the data processing agreement (“DPA”) and this policy ever disagree about Part B, the DPA wins.
2. Part A: this website and our contact with you
This part covers the personal data we collect for our own purposes: running this website, answering requests, and staying in touch with people who are or might become customers.
A.1 What we collect
What you give us. When you send the form on this site, we collect what you type into it, such as your name, email address, phone number or company, and the fact that you agreed to be contacted. If you email or talk to us, we keep that correspondence and any contact details in it.
What is collected automatically. Our web server records the IP address a request came from, the browser used, the pages requested, the page you came from and the time. These logs exist to keep the site running and secure.
We don’t ask for sensitive data (the “special categories” in Article 9 GDPR) through this website, so please don’t send any through the form.
A.2 Why we use it, and what allows us to
| Why | What | Legal basis (GDPR Art. 6) |
|---|---|---|
| Answering your request and working out whether the service fits | What you sent in the form, our correspondence | Art. 6(1)(b): steps you asked for before a contract |
| Looking after customers, billing and support | Contact details, correspondence | Art. 6(1)(b): carrying out a contract |
| Keeping the site running, secure and free of abuse | Server logs | Art. 6(1)(f): our legitimate interest in running a secure service |
| Contacting you about the service | Email address, company | Art. 6(1)(f): our legitimate interest in business-to-business marketing. You can object at any time |
| Meeting tax, accounting and legal duties | Billing and contract records | Art. 6(1)(c): a legal obligation |
Where we rely on legitimate interest, we have weighed that interest against your rights, and you can ask to see the assessment.
A.3 How long we keep it
- Requests from people who don’t become customers: 12 months from our last contact, then deleted.
- Customer contact and contract records: for the length of the agreement plus 6 years, to cover legal claims and accounting rules.
- Server logs: 30 days.
- A record that you objected or opted out: kept indefinitely, so we can keep respecting it.
A.4 Your rights
If you are in the EEA or the UK, you can ask to see your data, correct it, have it deleted, limit or object to how we use it, get a copy you can take elsewhere, and withdraw consent where we rely on it. Write to [email protected] and we will answer within one month.
You can also complain to a data protection authority. If you are in the EEA, that can be the authority where you live or work.
3. Part B: data inside the service
When a customer's automations send a document or a case to the model, that content can include personal data belonging to the customer's own policyholders, account holders, staff or counterparties. For that data we act as a processor on the customer's written instructions, and only on the private-cloud row; on the self-managed row the content never reaches us.
B.1 What we handle, and in what role
We process only what the customer's workflows send to the model, only inside that customer's tenant, and only for as long as the evaluation, the review queue and the meter require.
- The prompt and the proposal. the document or case the customer's automation sends, and the field values, action and confidence scores the model proposes in return; on the private-cloud row these exist in the customer's tenant in Paris, on the self-managed row they exist only on the customer's hardware.
- The held-out cases. the evaluation set the customer assembles for the pilot and for each quarterly re-evaluation, with the decisions its own people made, held in the tenant for the duration of the contract.
- Reviewer decisions. each correction a reviewer makes to a proposal, stored beside that proposal as the customer's labeled set; we read it to fine-tune that customer's model version and for nothing else.
- The meter. token counts per workflow per day, signed by the runtime. On the self-managed row this is the only thing that leaves the customer's environment, and it contains no document content.
We never read a customer's document store, case system or automation platform on our own initiative. Every prompt is a call the customer's automation made, and every call is on the meter and in the log.
The evaluation harness and the governance console compute evaluation results and review-queue statistics without anyone at Cahier reading a case. A member of our support staff reads an individual case only on the customer's written request for that case, and that access is itself logged.
B.2 What we do with it
Where it runs. On the private-cloud row, inference, evaluation, fine-tuning and the review queue store run single-tenant on cloud GPU capacity we control in Paris, and no copy leaves that tenant. On the self-managed row everything runs on the customer's own hardware and only the signed meter reaches us.
No third-party model. No prompt, document, proposal or reviewer decision is sent to any hosted model API. The model is ours, served in the tenant; the sub-processor list for the private-cloud row names the Paris hosting provider and nothing else.
Isolation. Each customer has its own tenant, its own model version and its own labeled set. Nothing is pooled across customers for evaluation, fine-tuning, or improving the service.
The review queue. Cases below threshold go to the customer's own review tooling. We hold the proposal and the decision; the customer's system holds the case.
Deletion. At termination the tenant, its model version, its held-out set and its labeled set are deleted within 30 days, after the customer has taken the exports listed under records.
B.3 AI models: where they run and what they learn from
Where models run. On the private-cloud row inference runs single-tenant on cloud GPU capacity we control in Paris, inside the EEA, and the sub-processor list names the Paris hosting provider and no model provider. On the self-managed row inference runs on the customer's own hardware and we see only the signed token meter. No prompt, document, proposal or reviewer decision is ever sent to a third-party hosted model API, ours or anyone else's.
Training. No customer document, prompt, proposal or reviewer decision is used to train or improve any model we serve to another customer, and nothing is pooled across tenants. The one exception is the customer's own labeled set, the pairs of proposal and reviewer decision kept in their tenant, which is used to fine-tune that customer's next model version only on their written instruction and for no other customer.
Where a person decides. The model proposes field values and an action with a confidence score; the policy gate drops anything outside the workflow's allow-list, sends anything below the threshold the customer set to the customer's own review queue, and a named reviewer decides. No proposal with a legal effect on a person, a claim outcome, an account closure or a credit decision, is executed by the model at any confidence. The customer's own team sets the thresholds and the allow-list in the governance console; no one at Cahier sets a threshold or decides a case.
B.4 Where the data is kept
Private-cloud row: cloud GPU capacity we control in Paris, France, single-tenant per customer, holding the model version, the runtime, the evaluation sets, the review-queue store and the meter.
Self-managed row: the customer's own private cloud or on-premises hardware, wherever the customer has placed it; we receive only the signed token meter and hold it in Paris.
The evidence packs, the meter records and the invoices are held in Paris, France. Nothing is replicated outside the European Economic Area.
The suppliers that handle data in the service are named on our subprocessor list, which comes with the data processing agreement and which we send to anyone who asks: write to [email protected].
B.5 How long we keep it, and what deleting can’t remove
Prompts and proposals are kept for 30 days in the tenant by default, and the customer may set that to as low as 24 hours; the review queue keeps a case until the reviewer decides it.
The held-out set and the labeled set are kept for the life of the contract and deleted with the tenant.
Meter records are kept for six years because they are the basis of an invoice, the period the Companies Act 2006 sets for a company’s accounting records.
Evidence packs are kept for the life of the contract plus five years, so that a board that approved a version can still read what it approved.
B.6 Requests from people whose data is in the service
If your personal data appears in a document a Cahier customer's automation sent to the model and you wish to exercise your rights, contact that customer, which is the insurer, bank or public body whose case it was. They are the controller. If you contact us directly we will pass the request to that customer without undue delay and support them in answering it from the tenant.
For everyone
4. Moving data between countries
Cahier Ltd is a company in United Kingdom, inside the EEA. Section B.4 says where the data in the service is kept. If any personal data we control ever has to leave the EEA, for example because a supplier named on our subprocessor list handles it elsewhere, it is protected by the European Commission’s Standard Contractual Clauses or another safeguard the GDPR accepts. You can ask us for a copy.
5. Security
We protect data in line with the risk. That includes encryption in transit and at rest, access limited to the people and systems that need it, each customer’s data kept separate from every other’s, and a log of every access to production systems.
If a personal data breach affects you, we tell you without undue delay, and at the latest within 36 hours of finding out, with the information you need to meet your own reporting duties.
6. Children
The service is sold to businesses and is not meant for children. We don’t knowingly collect personal data from anyone under 16.
7. Changes to this policy
We may update this policy. If a change matters, we email customers at least 30 days before it takes effect. The version number and date at the top of this page change every time.
8. Contact
Privacy questions and anything else: [email protected]
By post: Cahier Ltd, 20 Farringdon Road, London EC1M 3HE, United Kingdom