Privacy

1. Data controller

SUTURA TECHNOLOGY determines the purposes and means of the processing described below. For documents uploaded by the customer and conversations held by their own users, SUTURA TECHNOLOGY acts as a processor, on the customer's instructions.

2. Data processed

Account: name, email address, hashed password, organisation, language, sign-in dates.

Corpus: the documents uploaded by the customer and the fragments derived from them for search.

Conversations: the questions put to assistants and the answers produced, together with the passages cited.

Technical: IP addresses in salted-hash form, request identifiers, error logs.

3. Purposes

Providing the service, billing usage, preventing abuse, ensuring security and improving answer quality.

Conversation content is never written to application logs. IP addresses are kept only in hashed form, which allows abuse to be limited without identifying individuals.

4. No training

Customer documents and conversations are used to train no model, neither at SUTURA TECHNOLOGY nor at its language-model providers, with whom this exclusion is contractually stipulated.

5. Retention periods

Conversations are retained for the period set by the subscribed plan — from seven days to two years — then deleted automatically.

Account data is retained for the duration of the contractual relationship, then thirty days after cancellation.

Billing records are retained for the applicable statutory period.

6. Sub-processors

The service relies on language-model providers, an infrastructure host, a payment provider and a transactional email service. The detailed, current list is available on request.

Customers whose plan allows it may use their own model keys: those calls are then billed directly by their provider, without passing through our accounts.

7. Your rights

Access, rectification, erasure, restriction, portability and objection may be exercised at any time in writing at the address below. A response is provided within one month.

Exporting conversations and documents is also available directly from the console.

8. Security

Encryption in transit and at rest, tenant separation by four successive barriers including a row-level security policy in the database, API keys stored hashed, customer model keys encrypted using envelope encryption.

Any data breach likely to create a risk is notified to affected customers without undue delay.