Privacy Policy

1. Scope and operator

This policy explains how BigBlueYonder AI processes personal information in connection with Evidence, its website and support. For legal purposes, the data controller for personal information processed by BigBlueYonder AI in its own capacity is Alan Roche. The Evidence service is currently operated by Alan Roche.

2. Controller and processor roles

BigBlueYonder AI acts as controller for account, contact, billing, security and service-administration information. Where an organisation uses Evidence to process personal data in customer documents, the organisation generally determines the purposes and means and BigBlueYonder AI processes that data on its instructions, subject to applicable data-processing terms.

3. Information we process

We may process account, organisation, user, contact and support information; usage, activity, device, security and log information; case and document metadata; and customer-uploaded documents, questions, prompts, case material and research outputs. Evidence sets may contain confidential, personal, special-category or criminal-offence data. Customers must have lawful authority to upload and process it.

4. Purposes and lawful bases

We use information to provide and secure Evidence, administer accounts and credits, respond to enquiries, maintain auditability, prevent fraud and abuse, provide support, process payments, comply with legal obligations and improve reliability. The lawful bases may include performance of a contract, legitimate interests in operating and securing the service, legal obligation, and consent where genuinely relevant. Customers remain responsible for their own lawful basis when uploading personal data.

5. AI processing and training

Evidence uses selected enterprise AI processing providers where required to perform requested research and processing. Production AI processing uses Zero Data Retention on supported endpoints, so prompts and model responses are not retained by the AI provider after processing. Customer documents, questions, case material and research outputs are not used to train public foundation models or provider models.

6. Hosting and security

Evidence is hosted on European infrastructure in Helsinki, Finland. Data is encrypted in transit and at rest. Account, organisation, case and user isolation, access controls, monitoring, backups, recovery and auditability controls are used as appropriate. No online service can guarantee absolute security; users must protect credentials and report suspected compromise.

7. Payments and service providers

BigBlueYonder AI does not store full credit or debit card details. Card payments are processed by a specialist third-party payment provider. We may receive limited payment or transaction information needed to administer payments, credits and account records. Service providers may support hosting, AI processing, payments, communications, monitoring, integrations and storage. Providers and safeguards may change as the service develops.

8. International transfers

Where information is transferred outside the UK or European Economic Area, we use a lawful transfer mechanism and appropriate safeguards required by applicable data-protection law.

9. Retention and deletion

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including providing the service, maintaining security and auditability, resolving disputes, enforcing agreements and meeting legal, regulatory, accounting and tax obligations. Retention periods vary according to the category of information, the nature of the account or case, applicable legal requirements and operational backup cycles.

Deletion from the active service does not necessarily result in instantaneous deletion from all encrypted backups, security records or legally required records. Residual copies may remain for a limited period as part of normal backup, disaster-recovery, security and compliance processes and are not restored to ordinary operational use except where necessary for those purposes.

10. Cookies and communications

Evidence may use cookies, session storage and similar technologies that are necessary for authentication, security, preferences and service operation. We send service and account communications where necessary. Optional marketing communications, where used, are sent only as permitted by law and may be withdrawn.

11. Age

Evidence is intended for users aged 18 or over. We do not knowingly solicit personal information from children.

12. Your rights

Subject to legal conditions and exemptions, UK GDPR rights include access, rectification, erasure, restriction, objection, portability and withdrawal of consent where consent is the relevant basis. To exercise rights or raise a privacy question, use the Contact page.

13. Complaints and disclosures

You may complain to the UK Information Commissioner’s Office (ICO). We may disclose information where required by law, court order or regulation, or where reasonably necessary for fraud prevention, security investigations, legal claims, audits or business transfer/reorganisation.

14. Changes

We may update this policy as the service, law or processing arrangements change. Material changes will be communicated where reasonably appropriate.