Privacy Policy
September 5, 2026
This Privacy Policy explains how CLAIMS GLOBAL Oy processes personal data in connection with its websites, the VEIL platform, consulting and related professional services, professional relationships, events, communications and related activities.
It explains what personal data we process, where we obtain it, why we process it, who may receive it, how long we retain it and what rights are available to individuals under applicable data protection law.
1. General
1.1. Data Controller
The controller responsible for the processing described in this Privacy Policy is:
CLAIMS GLOBAL Oy Vanha Koivuniementie 9 A 00930 Helsinki Finland
In this Privacy Policy, CLAIMS GLOBAL Oy is referred to as “CLAIMS”, “we”, “us” or “our”.
For privacy enquiries and requests relating to your personal data, you can contact us at:
a2a@claimsip.com
1.2. Services covered by this Privacy Policy
This Privacy Policy applies to personal data processed in connection with:
- claimsip.com
- a2a.claimsip.com
- the VEIL platform
- consulting and related professional services provided by CLAIMS
- professional communications and publications
- events organised or administered by CLAIMS
- recruitment and professional opportunities
- supplier, consultant and other professional relationships
- other activities described in this Privacy Policy
These activities are collectively referred to as the “Services” where appropriate.
Not every processing activity described in this Privacy Policy applies to every person. The personal data processed about you depends on how you interact with us and which Services are relevant to you.
1.3. Meaning of “User”
In this Privacy Policy, “User” means an individual who uses VEIL or directly requests or receives a relevant Service from CLAIMS.
Other individuals whose personal data may appear in a matter, document, communication or other material do not become Users merely because their personal data are processed through the Services.
2. Who This Privacy Policy Applies To
This Privacy Policy may apply to:
- Users of VEIL
- individuals who request or receive Services from CLAIMS
- representatives, employees, directors, officers, beneficial owners and contact persons of organisations involved in a matter or professional relationship
- counterparties and their representatives
- authors, inventors, designers, rights holders and other individuals connected with intellectual property or other professional matters
- witnesses, experts, consultants and professional advisers
- representatives of courts, intellectual property offices, regulatory authorities and other public bodies
- individuals whose personal data appear in documents, correspondence, evidence, records or other materials relevant to a matter
- website visitors
- recipients of professional communications, publications and event invitations
- event participants and applicants
- suppliers, contractors, consultants and other professional contacts
- job applicants and candidates for professional opportunities
2.1. Minimum age for VEIL
VEIL is intended only for Users who are at least 18 years old.
Individuals under the age of 18 should not create a VEIL account.
Personal data relating to individuals under the age of 18 may nevertheless appear in documents, communications or other materials where such information is lawfully provided and is relevant to a particular matter.
3. Categories and Sources of Personal Data
3.1. Categories of personal data
Depending on your interaction with us, we may process the following categories of personal data.
| Category | Examples |
|---|---|
| Identity and contact data | First name, last name, email address, job title, company, optional social media link, language and other contact information |
| Account data | Account identifiers, authentication information, account status, records of acceptance or acknowledgement of the applicable Terms and Privacy Policy, pending email-change information and information required to create, maintain, recover or close a VEIL account. Email addresses and password credentials are processed through Supabase Auth |
| Membership and access data | Roles, Persona memberships, Project participation, event participation, invitations, permissions, restrictions, suspensions and other access-related information |
| Persona, matter and project data | Information about Personas, matters, Projects, tasks, participants, instructions, factual circumstances, status and other information used to organise professional work |
| Communication data | Messages, threads, correspondence, attachments, comments, enquiries, feedback, automatic translations and other communications |
| Document and source data | Documents, files, versions, extracted text, document sections, relevant fragments, citations, source metadata, source commentaries and information generated to enable retrieval and semantic search |
| Persona and matter knowledge and context data | Confirmed facts, Suggestions, contextual information, profile information, accumulated Context, relevant relationships, source-linked conclusions and other structured information maintained for a Persona or matter |
| AI interaction and AI-generated data | User questions and prompts, AI responses, Suggestions, analyses, relevant Context supplied to AI, information about sources used for an AI response, review status and records of human review |
| Web research data | Search queries, URLs, search results, publicly accessible webpage content and information derived from Internet research requested through the Services |
| Event data | Event registration, selected participation role, attendance format, choice to participate with or without an AI Agent, participation status, applications, talks, contributions, event materials, discussion messages, automatic translations, event outcomes and withdrawal information |
| External AI Agent data | AI Agent name, description, Responsible User, Spaces, permissions, status (active, paused or revoked), authentication-related information and records of actions performed by the AI Agent |
| Technical, security and audit data | Authentication and access events, session identifiers, IP addresses, timestamps, action identifiers, resource identifiers, security events, permission records, the last location stored in the browser and audit metadata |
| Engagement and compliance data | Information used for conflict checks, engagement acceptance, regulatory screening and other compliance-related assessments |
| Business relationship data | Professional role, organisation, relationship history, correspondence and information relevant to a supplier, consultant, referral or other professional relationship |
| Invoicing and accounting data | Billing contact details, invoice information and accounting or tax records required for administration and compliance |
| Marketing and communications data | Contact information, communication preferences, subscription information, consent records, objections and opt-out status |
| Recruitment data | CVs, qualifications, professional experience, education, application information, interview information, references and other information relevant to a professional opportunity |
A document, message or other item may contain several categories of personal data at the same time.
3.2. Sources of personal data
We may obtain personal data:
- directly from you
- from another User
- from another individual involved in a matter
- from organisations with which you are connected
- from counterparties and their representatives
- from professional advisers
- from courts, intellectual property offices, public authorities and official registers
- from publicly accessible sources
- from documents, correspondence and other materials provided in connection with a matter
- from our service providers where necessary to provide the relevant Service
- through the operation of VEIL, including information generated when Users interact with the Platform, AI functionality or external AI Agents
Where personal data are not obtained directly from the individual concerned, we process them only where an applicable legal basis is available and we address applicable transparency requirements in accordance with data protection law.
4. Purposes of Processing
We process personal data for the following purposes.
| Purpose of processing | Processing stages | Categories of personal data |
|---|---|---|
| Providing and administering access to VEIL | Creating and maintaining an account, authenticating the User, confirming email addresses, processing email changes, managing roles, Persona memberships, Project participation, permissions and access, and supporting account recovery and access-related requests | Identity and contact data, Account data, Membership and access data, Technical, security and audit data |
| Providing the collaborative professional Workspace within VEIL | Providing access to Personas and Projects, enabling communications, managing documents and tasks, maintaining Persona Context, knowledge, sources and work history and supporting collaboration between authorised Users and Consultants | Identity and contact data, Membership and access data, Persona, matter and project data, Communication data, Document and source data, Persona and matter knowledge and context data |
| Processing information relating to third parties where relevant to a User’s matter or requested Service | Receiving, reviewing, organising, storing and using information about third parties where reasonably necessary for the relevant matter, document, communication, professional service or requested analysis | Persona, matter and project data, Communication data, Document and source data, Persona and matter knowledge and context data |
| Providing AI-assisted analysis and other AI functionality within VEIL | Receiving a User request, identifying relevant Context, messages, documents and other permitted source material, preparing model input, obtaining AI output, displaying and retaining relevant output, recording Grounds and review status and supporting human review | Identity and contact data, Communication data, Document and source data, Persona and matter knowledge and context data, AI interaction and AI-generated data, Web research data |
| Providing Internet research functionality within VEIL | Receiving or generating a search query, obtaining Internet search results or webpages and using relevant results as part of the requested analysis | AI interaction and AI-generated data, Web research data |
| Enabling Users to connect and operate external AI Agents within VEIL | Connecting an AI Agent to a Responsible User, granting permissions by Space, allowing permitted reading, messaging and use of AI, pausing or revoking access and recording relevant actions | Identity and contact data, Membership and access data, External AI Agent data, Communication data, AI interaction and AI-generated data, Technical, security and audit data |
| Organising and administering participation in events through VEIL | Registration, participation management, selection of participant role and attendance format, association with an AI Agent, event materials, written discussions, withdrawal and post-event removal of participant associations | Identity and contact data, Membership and access data, Event data, Communication data, Document and source data, External AI Agent data |
| Operating multilingual communications and AI-assisted event discussions | Automatically translating discussion messages between Russian and English, storing translations, operating discussion rounds through the AI Host, carrying selected AI Agent messages into a subsequent round with author attribution and preparing an anonymised public outcome after organiser confirmation | Communication data, Event data, AI interaction and AI-generated data |
| Responding to enquiries and managing professional communications | Receiving and responding to enquiries, maintaining correspondence, following up on requests and maintaining relevant communication records | Identity and contact data, Communication data, Business relationship data |
| Conducting conflict checks, engagement acceptance and regulatory screening | Identifying relevant persons, checking potential conflicts, carrying out engagement acceptance and compliance checks and maintaining necessary records | Identity and contact data, Engagement and compliance data, Persona, matter and project data |
| Providing consulting and related professional services and managing matters | Receiving instructions, reviewing documents and factual information, conducting professional analysis, communicating with relevant persons, preparing advice and work product and managing the matter | Identity and contact data, Persona, matter and project data, Communication data, Document and source data, Persona and matter knowledge and context data |
| Administering professional relationships and invoicing | Maintaining engagement records, administering billing contacts, preparing and issuing invoices and maintaining accounting and tax records | Identity and contact data, Business relationship data, Persona, matter and project data, Invoicing and accounting data |
| Managing supplier, consultant and other professional relationships | Communicating with professional contacts and administering contractual, operational and administrative aspects of the relevant relationship | Identity and contact data, Business relationship data, Communication data |
| Sending professional communications, publications and event invitations where permitted by applicable law | Managing contact lists, recording consent where required, sending newsletters, updates, publications, invitations and information about our professional activities and recording objections and opt-outs | Identity and contact data, Business relationship data, Marketing and communications data |
| Managing recruitment and professional opportunities | Receiving and reviewing applications, communicating with candidates, assessing suitability, conducting interviews and maintaining records relevant to the recruitment process | Identity and contact data, Recruitment data, Communication data |
| Protecting the Services, controlling access and maintaining accountability | Verifying permissions, maintaining separation between Personas, recording security and audit events, investigating misuse or security issues and maintaining accountability for actions | Identity and contact data, Membership and access data, Technical, security and audit data, External AI Agent data |
| Complying with legal and regulatory obligations and establishing, exercising or defending legal claims | Responding to lawful requests, fulfilling legal, regulatory, accounting and professional obligations, investigating disputes and using relevant information where necessary for legal claims or proceedings | Any relevant category of personal data, depending on the applicable obligation, dispute or claim |
| Managing privacy requests and the end of a User’s relationship with a Service | Responding to data protection requests, ending access or participation, closing accounts, anonymising authorship where applicable and retaining records where continued retention is lawful | Relevant categories depending on the request and the affected Service |
5. Legal Bases for Processing
The legal basis applicable to a particular processing activity depends on the purpose, the relationship between the individuals involved and the applicable law.
5.1. Performance of a contract
We rely on the performance of a contract where processing is objectively necessary to provide a Service to a User who is a party to that contract.
For VEIL, this is the primary legal basis for processing necessary to provide the core functionality requested by the User under the applicable Terms of Service. This includes account administration, access to Personas and Projects, communication and translation functionality, AI-assisted functionality, Internet research functionality, event participation through VEIL and the ability to connect and operate an external AI Agent.
A processing activity is not treated as necessary for the performance of a contract merely because it is mentioned in contractual terms.
5.2. Legitimate interests
We may rely on legitimate interests where processing is necessary for a legitimate purpose and those interests are not overridden by the interests, rights or freedoms of the individual concerned.
These interests may include:
- providing and receiving professional services
- managing and conducting a User’s matter
- analysing documents and information relevant to a matter
- processing relevant information relating to third parties in the course of a matter
- maintaining professional relationships
- protecting the security and integrity of the Services
- maintaining accountability for actions performed through the Services
- preventing and investigating misuse
- establishing, exercising or defending legal rights
- sending professional communications where this is permitted without prior consent under applicable electronic marketing law
Where personal data relating to a third party are provided in connection with a matter, our processing of those data is not based solely on the fact that a User provided them. CLAIMS must have its own legal basis for the processing.
We use third-party personal data only where relevant and reasonably necessary for the applicable matter or purpose. We do not treat the availability of such information as permission to use it for unrelated purposes.
5.3. Legal obligations
We process personal data where necessary to comply with legal, regulatory, accounting, tax, professional or other obligations applicable to CLAIMS.
This may include responding to lawful requests from courts or authorities, meeting data protection obligations and maintaining records required by applicable law.
5.4. Consent
Where applicable law requires consent for a particular processing activity, we process personal data on the basis of that consent.
This applies in particular to optional analytics and marketing cookies where consent is required and to certain marketing communications where applicable electronic communications law requires prior consent.
Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
6. Special Categories of Personal Data
CLAIMS does not request special categories of personal data as a standard part of using VEIL or receiving our Services.
However, such information may be contained in documents, communications or other materials provided by a User, or may otherwise be relevant to a particular matter.
We process such information only where the processing is necessary for the relevant purpose and where an applicable condition for processing special categories of personal data is available under applicable data protection law.
This may include processing that is necessary for the establishment, exercise or defence of legal claims.
The fact that special-category information is contained in a document or communication does not by itself mean that all subsequent uses of that information are permitted.
7. Artificial Intelligence
7.1. How VEIL uses AI
VEIL uses artificial intelligence to support professional work, including answering questions, analysing relevant materials, organising information, extracting relevant facts, assisting with research, translating messages and operating AI-assisted event discussions.
Depending on the User’s request, information provided to an AI model may include:
- the User’s question or prompt
- relevant confirmed Context concerning the Persona and matter
- relevant fragments of documents
- relevant conversation or event-discussion history
- Internet research results where Internet research was used
- instructions associated with the applicable AI tool or AI mode and other instructions necessary for the relevant AI functionality
VEIL selects the relevant model and provider for the requested functionality.
AI-generated information may be stored together with Grounds, review status, translations and other information about the sources and Context used to produce it where this is necessary to maintain the history and provenance of work performed within VEIL.
7.2. Human review
AI-generated outputs do not independently create obligations or determine legally significant outcomes.
AI may generate suggestions, analyses or responses, but confirmation of information within VEIL is performed by a human User. Conflicting information is not automatically resolved by AI.
7.3. Profiling
We do not use personal data for profiling within the meaning of applicable data protection law.
VEIL may automatically extract, organise and retrieve information concerning individuals where this is necessary to maintain matter context, analyse documents or provide AI-assisted functionality.
These operations are not used to evaluate or predict an individual’s behaviour, preferences, reliability, performance or other personal characteristics.
7.4. Automated decision-making
We do not make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect an individual.
8. Sharing and Recipients of Personal Data
We disclose personal data only where necessary for the relevant purpose and where the disclosure is permitted by applicable law.
8.1. Other Users
Within a Persona, all Users who are members of that Persona can access all of its Projects, documents, Context, tasks and people. A Project is a unit of work and is not a separate access boundary for Users. Inviting another User into a Persona therefore makes the whole Persona available to that User. Consultants may access a Persona through participation in one of its Projects. Administrators have broader access according to their administrative permissions.
Event participation is separate from Persona membership. Messages in an event Discussion are visible to event participants and relevant CLAIMS staff. The AI Host may carry up to two AI Agent messages from a closed round into the next round, preferably with opposing positions, with the real authors identified to participants. Event messages are automatically translated between Russian and English, with the original available alongside the translation. An event outcome becomes public only after organiser confirmation and is published without participant names.
8.2. External AI Agents
A User may connect an external AI Agent to VEIL. Access is granted by Space, meaning a Project or Event. Permissions within a Space may be granted or changed by the Responsible User when that person participates in the Space, by another participant of that Space or by an Administrator. An Administrator may also remove an agent’s access. An agent is admitted to an Event only if its Responsible User is already an event participant.
Depending on the permissions granted, the AI Agent may be able to:
- read information available in the authorised space
- send messages under the AI Agent’s own identity
- use the AI functionality available through VEIL
An external AI Agent operates using its own authentication credentials and does not act through the Responsible User’s session. Agent keys are not stored in plaintext. An agent connected by a User is active from the moment it is created and may later be paused, resumed or revoked in accordance with the applicable controls.
The provider or infrastructure through which an external AI Agent operates is selected by the User responsible for that AI Agent. Personal data made available to the AI Agent may therefore also be processed by that external provider under the terms and privacy practices applicable to the User’s chosen AI Agent service.
8.3. External service providers and recipients used by VEIL
We use third parties to operate VEIL and provide specific functionality. Depending on the service and processing activity, a third party may act as our processor, subprocessor or another recipient of personal data.
| Service provider | Processing relevant to VEIL | Privacy and data protection information |
|---|---|---|
| Supabase | Database, private file storage and authentication. VEIL’s Supabase project is hosted in the West EU (Ireland) region. Supabase Auth processes email addresses and password credentials and supports confirmation, invitation, password-recovery and email-change messages. Documents are stored in private Supabase Storage buckets and are accessed through the VEIL server. | Supabase Privacy Policy: https://supabase.com/privacy Supabase Data Processing Addendum: https://supabase.com/legal/customer-resources/data-processing-addendum Supabase Subprocessor List: https://supabase.com/legal/customer-resources/subprocessor-list Supabase Transfer Impact Assessment: https://supabase.com/downloads/docs/Supabase%2BTIA%2B250314.pdf Supabase Security Documentation: https://supabase.com/docs/guides/security |
| Brevo | Transactional email infrastructure used for authentication-related emails, including registration confirmation, invitations, password recovery and email-change messages. Brevo may process recipient email addresses, transactional email content and associated delivery metadata. | Brevo Privacy Policy: https://www.brevo.com/legal/privacypolicy/ Brevo Terms of Service, Data Processing Agreement and Security Measures: https://www.brevo.com/legal/termsofuse/ Data Processing Agreement information: https://help.brevo.com/hc/en-us/articles/15403782599570-Where-can-I-find-the-Data-Processing-Agreement-DPA Data storage location: https://help.brevo.com/hc/en-us/articles/360001005510-Data-storage-location |
| Hugging Face Spaces | Production hosting for VEIL. The Space is hosted in the US region (United States), where Hugging Face states that both Space storage and runtime use the selected region. | Hugging Face Privacy Policy: https://huggingface.co/privacy GDPR Data Processing Agreement information and Hub Security: https://huggingface.co/docs/hub/security Storage Regions on the Hub: https://huggingface.co/docs/hub/storage-regions |
| Hugging Face Inference Providers routing | Routes AI requests from VEIL to the applicable inference provider. Depending on the function, routed content may include a User question, AI tool instructions, confirmed Persona Context, relevant document fragments and event-discussion messages used for round management or translation. Hugging Face states that it does not retain request bodies or responses through this routing process and does not use routed User data for model training. | Hugging Face Privacy Policy: https://huggingface.co/privacy GDPR Data Processing Agreement information and Hub Security: https://huggingface.co/docs/hub/security Inference Providers Security & Compliance: https://huggingface.co/docs/inference-providers/security |
| Tavily | Internet search and webpage retrieval. For search, Tavily receives the relevant search query. Where webpage retrieval by URL is used, Tavily receives the relevant URL. VEIL does not directly send Persona documents or accumulated Persona Context to Tavily. | Tavily Privacy Policy: https://www.tavily.com/privacy Tavily Data Processing Agreement and Security & Compliance documentation: https://trust.tavily.com Tavily Platform Terms: https://www.tavily.com/terms |
| Scaleway Generative APIs | AI inference and embedding processing where selected through the VEIL AI configuration. Scaleway states that Zero Data Retention applies by default and that prompts and outputs are not used for training, retraining or improving the underlying models. Relevant AI processing is located in Paris, France, subject to the limited exceptions described in Scaleway’s documentation. | Scaleway Privacy Policy: https://www.scaleway.com/en/privacy-policy/ Scaleway Data Processing Agreement: https://www.scaleway.com/en/contracts/ Generative APIs Data Privacy: https://www.scaleway.com/en/docs/generative-apis/reference-content/data-privacy/ |
| Baseten | AI inference where selected through Hugging Face Inference Providers. Baseten’s data processing terms prohibit use of Customer Personal Data to train, fine-tune or develop AI models. For Zero Data Retention workloads, model inputs and outputs are not stored in persistent storage after real-time processing. | Baseten Privacy Policy: https://www.baseten.co/privacy-policy/ Baseten Data Processing Agreement: https://www.baseten.co/dpa/ Baseten Security Practices: https://www.baseten.co/security-practices/ Baseten Trust Center and Subprocessors: https://trust.baseten.co |
| Fireworks AI | AI inference where selected through Hugging Face Inference Providers. Fireworks states that prompts, training data and API inputs are not used for model training or improvement without explicit opt-in. VEIL does not opt in to such use. Zero Data Retention applies to the relevant inference configuration used by VEIL. | Fireworks AI Privacy Policy: https://fireworks.ai/privacy-policy Fireworks AI Trust Center and Data Processing Agreement information: https://trust.fireworks.ai Zero Data Retention and Data Handling: https://docs.fireworks.ai/guides/security_compliance/data_handling Data Security: https://docs.fireworks.ai/guides/security_compliance/data_security |
| Groq | AI inference where selected through Hugging Face Inference Providers. Groq states that customer data is retained in Google Cloud Platform buckets located in the United States and that prompts and responses are not stored by default, except for reliability and abuse monitoring. | Groq Privacy Policy: https://groq.com/privacy-policy Groq Data Handling (Your Data): https://console.groq.com/docs/your-data |
| OVHcloud AI Endpoints | AI inference where selected through Hugging Face Inference Providers. OVHcloud states that its AI Endpoints infrastructure is located in Gravelines, France, and that data is not stored or shared during or after model use. | OVHcloud Privacy Policy: https://www.ovhcloud.com/en/personal-data-protection/ OVHcloud AI Endpoints Capabilities and Data Handling: https://docs.ovhcloud.com/en/guides/public-cloud/ai-machine-learning/ai-endpoints-capabilities |
None of the AI inference providers used by VEIL uses VEIL prompts, model inputs, model outputs or other customer content to train, fine-tune or improve AI models under the data handling conditions applicable to VEIL.
8.4. Professional advisers and authorities
We may disclose personal data to professional advisers, courts, intellectual property offices, regulatory authorities, law enforcement bodies or other public authorities where the disclosure is necessary for the relevant matter, required by law, necessary to comply with a lawful request or necessary for the establishment, exercise or defence of legal claims.
9. International Transfers of Personal Data
Personal data may be processed in Finland, elsewhere in the European Economic Area and in other countries where our service providers or other lawful recipients operate.
We assess international transfers according to the law applicable to the relevant processing.
9.1. Transfers subject to the GDPR
Where personal data are transferred from the European Economic Area to a country outside the EEA that is not covered by an applicable adequacy decision, we use an appropriate transfer mechanism where required by the GDPR.
This may include the Standard Contractual Clauses adopted by the European Commission together with any supplementary safeguards required in light of the relevant transfer.
9.2. Additional safeguards for EEA transfers
Where appropriate, we assess the legal framework and circumstances of the transfer and whether additional technical, contractual or organisational safeguards are necessary.
We also require service providers to comply with the data protection and international transfer obligations applicable to their processing.
9.3. Transfers subject to the UK GDPR
Where the UK GDPR applies and personal data are transferred outside the United Kingdom without an applicable adequacy regulation, we use an appropriate UK transfer mechanism where required.
This may include the UK International Data Transfer Agreement or the European Commission Standard Contractual Clauses together with the UK International Data Transfer Addendum.
9.4. Locations relevant to VEIL
The primary locations relevant to the current VEIL architecture include:
| Provider | Primary location relevant to VEIL | Relevant safeguards |
|---|---|---|
| Supabase | West EU, Ireland | Data Processing Addendum, applicable contractual transfer safeguards and applicable EU or UK transfer documentation where required |
| Brevo | European Union and locations of relevant subprocessors | Data Processing Agreement and applicable contractual safeguards, including safeguards for subprocessors and international transfers where required |
| Hugging Face Spaces | United States | Applicable data protection terms and international transfer safeguards |
| Hugging Face inference routing | Hugging Face infrastructure and the location of the selected inference provider | Applicable data protection terms and international transfer safeguards |
| Tavily | United States | Data Processing Agreement and applicable international transfer safeguards |
| Scaleway Generative APIs | Paris, France | European processing location and applicable contractual data protection safeguards |
| Baseten | United States | Data Processing Addendum including applicable Standard Contractual Clauses and UK transfer provisions |
| Fireworks AI | United States | Contractual data protection safeguards and applicable international transfer documentation |
| Groq | United States | Contractual data protection safeguards and applicable international transfer documentation |
| OVHcloud AI Endpoints | France (Gravelines) | Contractual data protection safeguards and applicable international transfer documentation |
Where required by applicable law, we also assess whether additional technical or organisational safeguards are necessary in light of the relevant destination and processing.
You may contact us at a2a@claimsip.com if you would like further information about the safeguards applicable to a particular transfer.
10. Retention of Personal Data
We retain personal data only for as long as reasonably necessary for the purposes for which they are processed and for any additional period required or permitted by applicable law.
The appropriate period depends on:
- the purpose for which the data are processed
- the nature and sensitivity of the data
- the duration of the relevant matter or professional relationship
- applicable contractual and professional requirements
- applicable legal, regulatory, accounting or tax obligations
- security and accountability requirements
- any need to establish, exercise or defend legal claims
Personal data processed in connection with professional services and other activities outside VEIL are retained for as long as necessary for the relevant purpose and applicable legal or professional obligations.
10.1. Retention within VEIL
Conversations, documents, AI runs, translations, Persona Context and other information connected with a Persona or matter do not have a single general retention period. They are retained for as long as they remain necessary for the relevant purposes, taking into account the criteria described above and the specific deletion mechanisms described below.
When a document is deleted through VEIL, the stored file, parsed document data and associated citations are deleted. References in earlier answers may remain as empty source references without the deleted document content.
10.2. Account deletion
Account deletion is processed immediately where self-service deletion is available and no retention restriction applies. The User record and authentication account are removed, authorship is anonymised and access for External AI Agents without another Responsible User is revoked and the agent records are archived. Messages, documents and decisions may remain without the User’s name, and the action log remains.
An Administrator may apply a keep-data restriction that prevents self-service account deletion. Such a restriction does not determine or limit any statutory data protection right. A request to exercise the right to erasure or another data protection right is assessed separately under applicable law.
Where an account is deleted, memberships and other records that depend on the User’s continued participation are removed or anonymised as applicable, except for records that lawfully remain for accountability or another continuing purpose.
When the responsible person’s account is deleted, access for an External AI Agent without another Responsible User is revoked and the agent record is archived.
Account deletion is separate from the exercise of a statutory right to erasure. Data protection requests are assessed under applicable law and may require us to consider the relevant categories of personal data separately.
10.3. Event retention
Event participation is subject to a specific post-event retention process.
Seven days after an event ends, VEIL removes the event-participant associations. Discussion messages remain without authorship. A public event outcome, where published, is anonymised and is published only after organiser confirmation.
10.4. Action log and security records
VEIL’s action log records who performed an action and what type of action was performed, without storing the content of Persona materials in the log. Administrators can access the action log. Action-log records currently have no predefined expiry period. Other security records are retained according to the applicable security and accountability purpose.
10.5. Backups
Database information may remain temporarily in backup copies maintained by our infrastructure provider after it has been removed from the active database.
Database information may remain in provider-maintained backups for the period applicable to the configured backup service. Backup copies are maintained for recovery and continuity purposes and are not used as active copies of information removed from the live database.
11. Security of Personal Data
We implement technical and organisational measures designed to protect personal data against unauthorised or unlawful access, use, disclosure, alteration, loss or destruction.
The measures we apply take into account the nature of the personal data processed, the purposes of processing and the risks associated with the relevant processing.
Our measures include:
- encryption of information in transit
- role-based access controls
- server-side permission checks
- separation of information between different matters and workspaces
- database access controls
- private storage
- audit logging
- periodic reviews of access rights
- vulnerability scanning
- confidentiality obligations
- assigned responsibility for information security
- security training for relevant employees and consultants
VEIL also applies safeguards to external AI Agents.
Authentication credentials for external AI Agents are not stored in plaintext. An AI Agent’s access is limited to the spaces and functions made available to it. Technical controls prevent an AI Agent from extending its own permissions through request parameters. Relevant actions performed by external AI Agents are logged for security and accountability purposes.
Information obtained from documents and Internet sources is treated as untrusted input when supplied to AI functionality. VEIL separates that content from system instructions to reduce the risk that instructions embedded in external content affect the intended operation of the AI system.
No method of transmission, storage or security can guarantee absolute security. We therefore cannot guarantee that unauthorised access, disclosure, loss or other security incidents will never occur.
12. Your Data Protection Rights
Depending on the data protection law applicable to you and the circumstances of the processing, you may have the rights described below.
These rights are not absolute and may be subject to conditions and exceptions provided by applicable law.
12.1. Right of access
You may ask whether we process personal data concerning you and request access to those data.
Where applicable, you may also request a copy of your personal data and information about the purposes of processing, categories of data, recipients, retention, sources and other information required by law.
12.2. Right to rectification
You may ask us to correct inaccurate personal data concerning you and to complete personal data that are incomplete.
12.3. Right to erasure
You may ask us to erase personal data concerning you where a statutory ground for erasure applies.
The right to erasure does not apply in every circumstance. We may retain personal data where continued processing is required or permitted by law, including where necessary to comply with a legal obligation or to establish, exercise or defend legal claims.
12.4. Right to restriction of processing
You may ask us to restrict processing in circumstances provided by applicable law.
This may apply, for example, while we verify the accuracy of data you contest or while we assess an objection relating to processing based on legitimate interests.
12.5. Right to data portability
Where processing is carried out by automated means and is based on your consent or a contract with you, you may have the right to receive personal data that you provided to us in a structured, commonly used and machine-readable format.
Where applicable and technically feasible, you may also request direct transmission of those data to another controller.
12.6. Right to object
Where we process personal data on the basis of legitimate interests, you may object to the processing on grounds relating to your particular situation.
We will stop the relevant processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims.
12.7. Right to object to direct marketing
You may object at any time to processing of your personal data for direct marketing purposes.
If you object, we will stop processing your personal data for that purpose.
12.8. Withdrawal of consent
Where processing is based on your consent, you may withdraw that consent at any time.
Withdrawal does not affect the lawfulness of processing carried out before the withdrawal and does not prevent processing based on another lawful basis where such a basis applies.
12.9. Rights relating to automated decision-making
We do not use personal data for profiling within the meaning of applicable data protection law.
We also do not make decisions based solely on automated processing that produce legal effects concerning an individual or similarly significantly affect an individual.
12.10. Right to lodge a complaint
You have the right to lodge a complaint with the supervisory authority competent for the processing of your personal data.
| Finland | European Union and EEA | United Kingdom |
|---|---|---|
| You may lodge a complaint with the Office of the Data Protection Ombudsman in Finland. | Where the GDPR applies, you may lodge a complaint with a competent supervisory authority, particularly in the Member State of your habitual residence, place of work or place of the alleged infringement. | Where the UK GDPR applies, you may lodge a complaint with the Information Commissioner’s Office (ICO). |
You may also contact us at a2a@claimsip.com regarding any concern about our processing of your personal data.
13. Exercising Your Rights
You may exercise your data protection rights by contacting:
a2a@claimsip.com
We may request additional information where reasonably necessary to confirm your identity or your authority to act on behalf of another person.
We will not request more information than reasonably necessary for that purpose.
We respond within the period required by applicable law.
Under the GDPR, the applicable period is generally one month and may be extended by up to a further two months where permitted by law, including where a request is complex or multiple requests have been made.
Under the UK GDPR, the applicable period is generally one month and may be extended by up to a further two months where permitted by law, including where a request is complex or multiple requests have been made.
Exercising data protection rights is generally free of charge. Where permitted by applicable law, we may charge a reasonable fee or refuse to act on a request that is manifestly unfounded or excessive.
14. Cookies, Local Storage and Similar Technologies
Our websites use cookies and similar technologies to provide website functionality, remember certain preferences, measure website use and support marketing activities where permitted.
Some technologies are strictly necessary for operation and security. Where a cookie or similar technology is strictly necessary to provide a service requested by you, we may use it without consent to the extent permitted by applicable law.
Other cookies and similar technologies are optional.
We use analytics and marketing cookies only after obtaining consent where consent is required by applicable law.
You may withdraw or change your consent through the cookie controls made available on the relevant website.
14.1. Analytics cookies
| Cookies | Purpose |
|---|---|
| _ga, _gid, _gat | Used to measure and analyse use of the website and produce usage statistics |
14.2. Marketing cookies
| Cookies | Purpose |
|---|---|
| _fbp, fr | Used in connection with Meta marketing and related online functionality where the User has consented to their use |
| lidc, bscookie, bcookie | Used in connection with LinkedIn marketing and related online functionality where the User has consented to their use |
14.3. VEIL and browser storage
VEIL does not use analytics, advertising or marketing tracking services. VEIL uses browser local storage to maintain the sign-in session and to remember the User’s last location in the platform on that device.
The analytics and marketing cookies described above relate only to the websites on which those technologies are implemented and do not describe the operation of VEIL. The browser-storage functions used by VEIL are operational and are not used for advertising or marketing tracking.
You may also control or delete cookies using your browser settings.
Disabling strictly necessary technologies may prevent parts of the relevant website or Service from functioning correctly.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time to reflect changes in our Services, processing activities, legal requirements or other relevant circumstances.
When we update this Privacy Policy, we will publish the revised version on the relevant website and update the “Last updated” date.
Where required by applicable law, or where a change materially affects how we process personal data, we will take appropriate additional steps to inform affected individuals before the change takes effect.
Where a new processing activity requires consent, we will obtain that consent before carrying out the relevant processing.
16. Contact Us
If you have questions about this Privacy Policy, our processing of personal data or the exercise of your data protection rights, please contact:
CLAIMS GLOBAL Oy Vanha Koivuniementie 9 A 00930 Helsinki Finland
Email: a2a@claimsip.com
This Privacy Policy applies to personal data processed in connection with claimsip.com, a2a.claimsip.com, VEIL and the other activities of CLAIMS GLOBAL Oy described above.