Privacy Policy

1The short version

What is left is the ordinary business of running a website and a subscription: an account, an email address, a payment, a message you send us. This document says what that is, who else sees it and what you can make us do about it.

2Who is responsible

The controller for the data described here is the operator of combobulating: Ohmyfin Limited, a company registered in England and Wales under company number 15431563, with its registered office at 275 New North Road, Islington Suite 1422, London, England, N1 7AA . Write to hello (at) combobulating (dot) ai for anything in this document, including a request under section 9. We answer from that address, and we answer people, not ticket numbers.

We have not appointed a data protection officer, because we are not required to. If that changes we will name one here.

3What we collect, and why

We do not sell data, we do not rent it, and we do not use it for advertising by anyone else. We do not profile you or make automated decisions with legal effects about you.

4Your server, and who is responsible for what is on it

Two different things share one machine and the law treats them differently.

• Your account and your subscription: we decide what to collect and why, so we are the controller, and section 3 is the list.
• Everything you or your agents put on the server: you decide what it is and what it is for, so you are the controller and we are your processor for the hosting of it. If that data includes personal data about other people, having a lawful basis for it is your job, as clause 6 of the Terms of Service says.

If you need a data processing agreement under Article 28 GDPR, ask us at hello (at) combobulating (dot) ai and we will sign one.

5Who else processes data

These are everyone outside the team who handles data for us, what they do and where. We use no others, and we will update this list before we add one.

Transfers outside the EEA. Anthropic is in the United States, and Stripe and Google have group companies there. Those transfers are made under the European Commission's standard contractual clauses, together with the measures those providers publish. Everything else in the list stays in the EU.

6Cases you send us, and the pipeline that reads them

If you offer us a case, what you upload goes through an automated pipeline that uses a language model to check it for problems, work out whether it says enough, structure it, expand it and translate it. That is Anthropic processing your material, on our account, as our processor.

Two things follow, and they are the reason this has a section of its own. First, do not upload anything confidential, personal or secret: strip customer names, credentials and anything under an NDA before you send it, as clause 14 of the Terms of Service requires. Second, this is the one place where a machine of ours reads something you wrote, and it happens because you sent it to us to be published. It is nothing to do with the server you rent, which nobody reads.

Uploaded files are held on a quarantine store, are scanned for malware, are never served to the web, and are deleted with the submission.

7Cookies and analytics

The site sets two cookies of its own and neither one needs your consent: a session cookie, so you stay logged in, and a CSRF token, so a form you submit is the form we sent you. Both go when the session ends. If you answer the cookie banner we set a third, holding nothing but the word you pressed, so that we do not have to ask you again on the next page. It lasts twelve months.

Google Analytics runs only if you press accept. We use it to count visits, so that we can tell whether anything we write here is read. It does not load, and it sets nothing, until you have pressed accept on the banner, wherever in the world you are, and we do not treat carrying on browsing as consent. When it does run it sets two cookies of its own, holding a random identifier for the browser rather than anything that names you; they last up to two years. We do not send Google your name, your email address or anything you have written to us.

The footer of every page carries a one click control to take that consent back, which is the same one click it took to give. Take it back and the tag stops loading on the very next page you open; the cookies Google has already set stay in your browser until they expire or you clear them, which your browser can do at any time.

We put the banner in front of visitors in the EEA and the UK, and in front of anyone whose country we cannot work out. To decide which you are, we look your IP address up in a copy of the MaxMind GeoLite2 country database that sits on our own server. That lookup happens in memory, we do not store your address to do it, and nothing about it leaves our machines: asking a geolocation service would mean handing your address to a company in order to decide whether we are allowed to track you.

We also count presses, and that one is not about you. When you press something on this site the browser sends us the name of the button, the page it was on and the language you were reading in, and our own server adds one to a total for that day. That is the whole of it. Nothing is written to your browser and nothing is read from it, no identifier of any kind is made, the address the message arrived from is thrown away rather than stored, and if you are signed in your account is not mentioned. The table it lands in holds a day, a button, a page and a number, which means it cannot answer the question «what did this person do», by design and not by policy. That is why it runs for everyone, including anyone who pressed reject: there is nothing here to consent to under the cookie rules, because nothing is stored on your device and nothing about you is stored on ours.

There is no advertising, no advertising network and no tracking pixel on this site.

8Security

Passwords are stored hashed and never in a readable form. The site is served over TLS. Uploads are scanned before they are stored and are kept off the web. Administrative access to the servers is by key, limited to the people who need it, and used only for the purposes in clause 8 of the Terms of Service.

No security is perfect. If a breach puts your rights at real risk we will tell the supervisory authority within 72 hours and tell you without undue delay.

9Your rights

Under the GDPR and the UK GDPR you can ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or hand it to you in a portable form. You can object to anything we do on the basis of legitimate interest, and you can withdraw a consent at any time, which does not undo what we did before you withdrew it.

Write to hello (at) combobulating (dot) ai. We answer within one month. You do not have to give a reason, and we will not make it hard. Some things we have to keep whatever you ask, mainly invoices, and we will tell you which and why.

You can also complain to a supervisory authority in the country you live or work in. We would rather you told us first, and we will still fix it if you do not.

10Children

The service is for adults and is not directed at children. We do not knowingly collect data about anyone under 18. If you think we have, tell us and we will delete it.

11Changes

We will publish a new version here with a new date, and where a change matters we will tell you by email at least 30 days beforehand. The date at the top of this page is always the date of the version you are reading.