Privacy Notice (interim)

This is an interim privacy notice for the Quorums beta period. It will be replaced by a notice prepared with our lawyers, and the date and version above will change when it is.

Who we are

Quorums is operated by The Gorilla Factory LLP, a limited liability partnership registered in England and Wales under number OC418578, registered office Plimsoll Building, 1 Handyside St, London, N1C 4BP, UK. We are the controller for the personal data described in sections 1, 2 and 4 below. For board documents, we act as a processor on behalf of the organisation that uploads them (see section 3). You can contact us about this notice at legal@quorums.ai.

1. Your account

When you are invited to Quorums and sign up, our authentication provider records your name, email address and sign-in details, and we record which boards you belong to. We use this to run your account, keep it secure and let the right people see the right boards. Our basis is performing our contract with you or with the organisation that invited you.

2. How you use the service

We keep records of what features are used and when, so that we can operate, support and improve the service and keep it secure. Our basis is our legitimate interest in running a reliable service. These records do not include the content of board documents. We also collect aggregate page-view statistics through our hosting provider's analytics, which set no cookies and do not identify you.

3. Board documents and what we extract from them

Organisations upload board packs, minutes and similar documents, and Quorums extracts a structured record from them and answers questions about them. The organisation that uploads a document decides what it contains and who may see it; it is the controller of any personal data in it, and we process that data on its instructions under our Data Processing Agreement. If you have a question about personal data in a board document, the organisation that uploaded it is the right place to start, and we will help it respond.

4. Support and correspondence

If you write to us, we keep the correspondence for as long as we need it to deal with your request and to keep a record of what was agreed.

5. Who else processes your data

We use a small number of service providers to run Quorums: AI document processing, database and file storage, authentication, and hosting. The current list, with each provider's legal entity and location, is at www.quorums.ai/subprocessors. We do not sell personal data, and we do not use it for advertising.

6. Artificial intelligence

Board documents and the questions asked about them are processed by an AI provider under a contract that prohibits using the content to train its models. Our AI provider retains API inputs and outputs for up to 30 days by default; content its systems flag as a possible breach of its usage policy may be kept for longer, as set out in its terms. We do not make any decision about you by automated means that has legal or similarly significant effects.

7. Where your data is kept

Our database and files are hosted in London. Some of our providers process data in the United States; those transfers are made under the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or under the UK Extension to the EU-US Data Privacy Framework where the provider is certified.

8. How long we keep it

Account data is deleted when you ask us to delete your account, and when the data of every organisation whose boards you belong to has been deleted. Board documents and the records extracted from them are kept for as long as the organisation's subscription runs and are deleted within 30 days of the end of its export period, with copies in routine backups removed within a further 8 days. Security details are at www.quorums.ai/security.

9. Your rights

You have the right to ask for a copy of the personal data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable form, in each case subject to the conditions in UK data protection law. Write to legal@quorums.ai. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

10. Cookies

Quorums uses only the cookies needed to keep you signed in and to protect your session. We do not use advertising or analytics cookies.

11. Age

Quorums is for use at work by adults. It is not intended for anyone under 18.

12. Changes

We will post changes to this notice on this page with a new version number and date. Material changes will be notified to board administrators by email.