Privacy Policy
Recension Data Ltd
1. Who we are and what this policy covers
Recension Data Ltd (“Recension”, “we”, “us”) runs a subscription platform that captures the contract documents vendors publish at public URLs, keeps every captured version with its source bytes and hash, splits each version into a clause tree with permanent citable URLs, shows the versions and their diffs in a web workspace and through an API, and delivers the record set as a nightly Parquet and JSONL drop into a bucket the licensee owns. We do not read your executed contracts, we do not negotiate with your vendors, and we do not connect to any system of yours.
Registered at Dockgate, Merchants Road, Galway H91 KV27, Ireland.
We handle personal data in two different situations, and different rules apply to each:
| Whose data | Our role | What applies | |
|---|---|---|---|
| Part A | People who visit this website, ask about the service or write to us | Controller: we decide why and how the data is used | This policy |
| Part B | Your watchlist, meaning the list of vendors and documents you ask us to watch, and the review and delivery accounts you name | Set out in B.1, because it depends on the data | This policy and the data processing agreement we sign with each customer |
If the data processing agreement (“DPA”) and this policy ever disagree about Part B, the DPA wins.
2. Part A: this website and our contact with you
This part covers the personal data we collect for our own purposes: running this website, answering requests, and staying in touch with people who are or might become customers.
A.1 What we collect
What you give us. When you send the form on this site, we collect what you type into it, such as your name, email address, phone number or company, and the fact that you agreed to be contacted. If you email or talk to us, we keep that correspondence and any contact details in it.
What is collected automatically. Our web server records the IP address a request came from, the browser used, the pages requested, the page you came from and the time. These logs exist to keep the site running and secure.
We don’t ask for sensitive data (the “special categories” in Article 9 GDPR) through this website, so please don’t send any through the form.
A.2 Why we use it, and what allows us to
| Why | What | Legal basis (GDPR Art. 6) |
|---|---|---|
| Answering your request and working out whether the service fits | What you sent in the form, our correspondence | Art. 6(1)(b): steps you asked for before a contract |
| Looking after customers, billing and support | Contact details, correspondence | Art. 6(1)(b): carrying out a contract |
| Keeping the site running, secure and free of abuse | Server logs | Art. 6(1)(f): our legitimate interest in running a secure service |
| Contacting you about the service | Email address, company | Art. 6(1)(f): our legitimate interest in business-to-business marketing. You can object at any time |
| Meeting tax, accounting and legal duties | Billing and contract records | Art. 6(1)(c): a legal obligation |
Where we rely on legitimate interest, we have weighed that interest against your rights, and you can ask to see the assessment.
A.3 How long we keep it
- Requests from people who don’t become customers: 12 months from our last contact, then deleted.
- Customer contact and contract records: for the length of the agreement plus 6 years, to cover legal claims and accounting rules.
- Server logs: 30 days.
- A record that you objected or opted out: kept indefinitely, so we can keep respecting it.
A.4 Your rights
If you are in the EEA or the UK, you can ask to see your data, correct it, have it deleted, limit or object to how we use it, get a copy you can take elsewhere, and withdraw consent where we rely on it. Write to [email protected] and we will answer within one month.
You can also complain to a data protection authority. If you are in the EEA, that can be the authority where you live or work.
3. Part B: data inside the service
Almost everything in the corpus is a document a vendor published to the open web, and it is not personal data and not yours. Two things are yours and both are more sensitive than they look. The first is the watchlist: which vendors a named company asks us to watch, and when it added them, is a description of that company's live purchases and renewals. The second is the delivery configuration and the people you name to receive digests and pull citations. This part sets out how each is treated.
B.1 What we handle, and in what role
Account data, meaning your work email, entity, billing contact and the people you authorize to receive digests, we hold as a controller. Your watchlist, your delivery configuration, your citation requests and the access logs against your bucket we process as your processor, on your instruction, for as long as the license runs.
- The watchlist. The vendors and document classes you asked us to watch, who on your side added each one, and when. We treat this as commercially sensitive: it is a list of the deals and renewals you are working, and it is never published, never aggregated into a public coverage statistic, and never disclosed to a watched vendor.
- Delivery configuration. The bucket identifier and region you nominate, the role we assume to write to it, the digest recipients you name, and any Slack, Teams, SharePoint, Ironclad or Juro destination you configure. We hold the credential scope needed to write and nothing wider.
- Citation requests. Which clause versions your people resolved through the reader, and when. We keep this so that a citation in a review ticket can be shown to have resolved to the same text on the date it was pasted, which is the whole point of a citation.
- Coverage requests. A vendor you ask us to add that is not yet on the published coverage list. We record the request and the requester so we can tell you when it opens. The vendor name itself is watchlist material and is handled as such.
We take no feed from your systems. There is no connector into your CLM, your ERP, your contract repository or your mailbox, and no read scope on any of them. What we hold about you is a list of vendor names, a delivery target and the people you named.
Do not send us an executed contract. If one reaches us by email we delete it and say so in writing; we are not the right custodian for your signed paper and we hold no scope for it.
A clause URL is public within your license, not public to the world: anyone at your entity, and outside counsel acting for you, can open one, and it is not indexable or resolvable outside that.
B.2 What we do with it
The record set is written to your bucket. Nightly Parquet partitions, the JSONL change file, the source files exactly as fetched and the signed manifest are written to a storage bucket you own, in your account, in the region you choose. We keep the index, the embeddings, the clause tree and the manifest hash chain in object storage in Dublin, Ireland. If you leave, what you have already received stays where it is.
Nothing is silently corrected. An extraction error is fixed by publishing a new version of the clause with an errata note naming what changed and why, never by editing a version already issued. Every version we have ever published stays resolvable, including the wrong one, because a citation taken against it has to keep resolving.
The watchlist is not merged. Watchlists are held per licensee and are not combined, cross-referenced or used to weight what we crawl for anyone else. If two licensees watch the same vendor, neither can learn that from anything we publish.
The alignment corpus contains public documents only. The labeled clause pairs come from the platform's review queue, where a low-confidence match is held and confirmed before publication. They are shared across the service, and every pair in them comes from documents the vendor published publicly. No watchlist, no delivery configuration and no text of yours enters it, because none of that is a clause pair from a public document. Training on it runs on Azure Machine Learning in Microsoft's North Europe region, also in Ireland.
B.3 AI models: where they run and what they learn from
Where models run. Day-to-day inference runs on GPU capacity we control in Dublin, Ireland: the clause-boundary token classifier, the embedding model used to propose cross-version matches, and the similarity scoring. From Q2 2027 it runs on reserved GPU capacity in the same region. Re-embedding backfills for a new embedding model run on Azure Machine Learning managed GPU compute in Microsoft Azure North Europe, also in Ireland, over public vendor documents only. No third-party inference endpoint is used, no Azure OpenAI, and no fragment of a document, a diff or a watchlist is sent to a hosted model API. Our subprocessor register lists our cloud infrastructure provider and Microsoft for the machines, and no model vendor at all, because no model vendor is in the path.
Training. We do not train on your data, and here the boundary is precise rather than rhetorical. The one corpus we do train on is the set of labeled clause pairs from the platform's review queue: two clause versions from a document a vendor published at a public URL, plus a decision about whether they are the same clause. That corpus is shared across the service, and training on it runs on Azure Machine Learning managed GPU compute in Microsoft Azure North Europe, in Ireland. Your watchlist, your delivery configuration, your citation history and the identity of anyone at your entity are excluded from it entirely and are never used to train, tune or evaluate a model.
Where a person decides. The model proposes an alignment; a person decides whether it holds. An alignment is published only when the embedding match and the token-similarity margin both clear a fixed threshold. Below the threshold nothing is published as a diff: the pair enters the platform's review queue, the affected section is marked unaligned and in review in the delivered file and in the reader, and the match is confirmed or corrected in the queue before it ships. There is no automated decision producing legal effects for any individual anywhere in this service. We publish what a document said on a date; every judgment about what that means is made by your people.
B.4 Where the data is kept
Processing stays in Ireland. Crawling, extraction, the index, the citation reader, the review queue and model serving run on cloud infrastructure in Dublin; model training and re-embedding backfills run on Azure Machine Learning in Microsoft's North Europe region.
Your delivery bucket is yours and you choose its region. If you place it outside Ireland, the delivered files live there while our index and all processing stay in Ireland.
No inference runs on a third-party endpoint. The models are served on cloud GPU instances we control in Dublin, and trained and re-embedded on Azure Machine Learning compute in North Europe, and no fragment of a document or a watchlist is sent to a hosted model API.
Vendor documents are fetched from the public web over ordinary HTTPS requests, unauthenticated, with a declared user agent. We do not log in to a vendor portal to obtain a document, and we do not accept one from you under NDA.
The suppliers that handle data in the service are named on our subprocessor list, which comes with the data processing agreement and which we send to anyone who asks: write to [email protected].
B.5 How long we keep it, and what deleting can’t remove
Captured document versions, source files, clause trees and manifests: for the life of the corpus. These are the record and we do not expire them.
Your watchlist and delivery configuration: for the life of the license, deleted within 30 days of its end.
Citation request logs: 24 months, then aggregated to counts with the identity dropped.
Clause URLs your people cited during the license: resolvable for the license term plus 24 months, so a citation in a closed review ticket does not rot when you stop paying.
Account and billing records: six years after the license ends, as Irish company and tax record rules require.
Delivery and reader access logs, without payloads: 90 days.
B.6 Requests from people whose data is in the service
The corpus itself carries almost no personal data, though a vendor's own published document occasionally names a signatory or a notice contact, and we keep those as published because redacting them would break the citation. About you, we hold your work email, your entity, who added which vendor to the watchlist and who resolved which citation. Write to [email protected] and we will answer within 30 days. If a person named inside a vendor's published document contacts us, we tell them plainly that the source is the vendor's own public page and point them there.
For everyone
4. Moving data between countries
Recension Data Ltd is a company in Ireland, inside the EEA. Section B.4 says where the data in the service is kept. If any personal data we control ever has to leave the EEA, for example because a supplier named on our subprocessor list handles it elsewhere, it is protected by the European Commission’s Standard Contractual Clauses or another safeguard the GDPR accepts. You can ask us for a copy.
5. Security
We protect data in line with the risk. That includes encryption in transit and at rest, access limited to the people and systems that need it, each customer’s data kept separate from every other’s, and a log of every access to production systems.
If a personal data breach affects you, we tell you without undue delay, and at the latest within 36 hours of finding out, with the information you need to meet your own reporting duties.
6. Children
The service is sold to businesses and is not meant for children. We don’t knowingly collect personal data from anyone under 16.
7. Changes to this policy
We may update this policy. If a change matters, we email customers at least 30 days before it takes effect. The version number and date at the top of this page change every time.
8. Contact
Privacy questions and anything else: [email protected]
By post: Recension Data Ltd, Dockgate, Merchants Road, Galway H91 KV27, Ireland