Privacy Notice
A straightforward account of the personal data Palimpsa uses, why it is used, and the choices and rights you have.
This is a draft. Bracketed text and notes such as [CONFIRM] identify details that still need checking. See all open items ↗
Who we are
This notice explains how personal data is used when you use Palimpsa at palimpsa.com. The controller, meaning the organisation that decides why and how your data is used, is [LEGAL NAME OF CURRENT TRADING ENTITY], company number [NUMBER], registered office [ADDRESS] (“we”). From the Transfer Date described in section 12, the controller will be Aleten [LEGAL FORM], company number [NUMBER], registered office [ADDRESS].
Privacy contact: [PRIVACY EMAIL ADDRESS]. We have [not appointed a data protection officer, as none is required].
What we collect
Full card numbers are handled by Stripe and never reach us. We do not ask for special category data, but you decide what you write, so your documents may contain it. Please do not put other people’s personal data into AI requests unless you are entitled to.
Why we use it, and our legal basis
Where we rely on legitimate interests, you have the right to object (section 8).
The AI research feature and Google Gemini
AI features run only when you click them. Each click is a separate request, and you can switch AI features off in Settings [CONFIRM THIS EXISTS IN THE REBUILT PRODUCT].
What is sent. The excerpt you select, your query and our fixed instructions are sent to Google through the Gemini API. We do not send your whole document, or your other documents, unless you select them.
How Google handles it. We use Google’s paid API service. Under Google’s terms for paid services, Google does not use prompts or responses to improve its products, and processes them on our behalf under a data processing addendum, as our processor.
What Google may keep. Google may keep logs of requests for a limited period to detect misuse and meet legal requirements. A 2024 Google notice put this at 55 days for paid use [CONFIRM CURRENT PERIOD]. So we do not say that requests are deleted immediately. [IF ZERO DATA RETENTION IS ARRANGED FOR OUR PROJECT, REPLACE THIS PARAGRAPH WITH THAT FACT.]
What we do. We do not use your content to train AI models, and we do not allow our providers to do so for the Service. We do not make decisions about you by automated means that have legal or similarly significant effects.
Your part. Do not include in a request anything you are not allowed to share with a service provider, including other people’s personal data or confidential material covered by an agreement.
Research is user-initiated. According to this draft, only the excerpt and query you choose are sent for that request. A whole document is sent only if you choose it. The exact Google retention period still needs checking.
Who else receives data
We do not sell personal data, and we do not use advertising or analytics trackers [CONFIRM].
International transfers
Google, Stripe and some other providers may process data outside the UK, including in the United States. Where they do, we rely on a UK adequacy arrangement where one applies, or on the UK International Data Transfer Agreement or the UK Addendum to standard contractual clauses, together with the provider’s other safeguards. You can ask us for a copy of the safeguards in use at [PRIVACY EMAIL ADDRESS].
[CONFIRM THE PROCESSING REGION FOR THE GEMINI API AND HOSTING.]
How long we keep data
You can ask us to delete data sooner (section 8), subject to what we must keep by law.
Your rights
You have the right to:
- be told what we hold about you, and get a copy (access);
- have inaccurate data corrected;
- have your data deleted, in some circumstances;
- restrict how we use your data, in some circumstances;
- receive your data in a portable format, where we use it under contract or consent;
- object to use based on legitimate interests, and object to direct marketing at any time;
- withdraw consent where we rely on it; and
- not be subject to a decision based solely on automated processing that has legal or similarly significant effects.
Email [PRIVACY EMAIL ADDRESS] to use these rights. We reply within one month, normally free of charge, and may ask you to confirm who you are. If you are unhappy with our answer, you can complain to the Information Commissioner’s Office (section 13).
Security
We use Google Firebase Cloud Firestore to store and sync document data, alongside a local working copy on your device. The Firestore database is in the Europe multi-region (eur3). Retention periods, backup handling and applicable security safeguards still need confirmation before this notice is final. No system is completely secure. If a breach is likely to put you at risk, we will notify you and the Information Commissioner’s Office as the law requires.
Children
You must be 13 or over to hold a Palimpsa account. If you are under 16, you must consult your parent or guardian before using the Service. We have aligned this draft with the Terms of Service, which set the minimum age at 13.
The supplied draft said “18 and over”. That conflicted with the Terms of Service and your instruction. This page uses 13 as the required minimum age.
Transfer to Aleten and changes to this notice
We intend to transfer the Service to Aleten, as set out in section 13 of our Terms of Service. We will give you at least [30] days’ notice by email and on our website. On the Transfer Date, Aleten becomes the controller of your personal data and takes over our responsibilities under this notice. The purposes, safeguards and your rights stay the same, and your data moves only as part of the transfer of the Service.
We may update this notice. The date at the top shows when it last changed, and we will email you about material changes.
Contact and complaints
For any privacy question or request, email [PRIVACY EMAIL ADDRESS]. You can also complain to the Information Commissioner’s Office, the UK data protection regulator, at ico.org.uk. We would appreciate the chance to put things right first.