← Back to the home page

This is the document a business customer's lawyer asks for. It covers the personal data of your customers that passes through Datum when you forward an enquiry: their name, their email address, and whatever they wrote about the job they want done.

You are the controller of that data. the operator of Datum is your processor. You decide why it is processed; we only do what running the service requires.

1. What we process, and why

	Detail
Subject matter	Drafting replies and priced quotes from enquiries you send us, and recording what was produced.
Duration	For as long as your account exists, plus up to 30 days for a backup to age out.
Categories of data	Names, email addresses, and the free text of an enquiry, which may describe a property or a site.
Categories of person	Your customers and prospective customers, and your own staff who use Datum.
Special categories	None expected. Datum is for pricing building work. Do not send health, biometric or similar data through it; nothing here is designed for that.

2. What we will and will not do

• Process only on your documented instructions, which for practical purposes means: what the product does when you use it.
• Never use your customers' data to train any AI model. Datum does not train models at all.
• Never sell it, and never share it beyond the sub-processors listed below.
• Keep it separated from every other account at the database row level, enforced by a test that fails if one account can read another's.

3. Sub-processors

Generated from this deployment's own configuration, so it cannot quietly go out of date. You will be told by email before a new one is engaged, and you may object.

Who	What they do	What they see	Where	On here?
Railway	Application hosting and the PostgreSQL database where all account data lives	Everything stored by the product	United States	in use
Resend	Sending and receiving email on your behalf	Message content, sender and recipient addresses, and any quote PDF attached	United States	in use
Cloudflare R2	Encrypted off-site database backups	A full database backup, kept for 30 days	Automatic, Cloudflare's global network	in use
Stripe	Subscription billing	Billing contact and payment details. Card numbers are handled by Stripe and never reach Datum	United States	not in use
Your chosen AI model provider	Drafting replies and quote wording, only if you supply an API key. With no key, Datum uses its built-in rule engine and no message ever leaves this system for a model	The text of the enquiry being processed	Depends on the provider you choose	per account

This table is generated from the deployment's own configuration, not maintained by hand, so it cannot drift out of date. A sub-processor list that says something is not in use when it is would be a contractual problem rather than an untidy page.

The AI model provider is your choice, and by default there is none. With no key configured, no enquiry text leaves this system. If you supply one, enquiries you process go to the provider you chose, and your agreement with them governs what they do with it.

4. Security

The measures in place are listed in full on the privacy page rather than summarised differently here, because two descriptions of the same controls is how they drift apart. In short: encryption in transit, passwords hashed with scrypt, model keys encrypted at rest, strict session and CSRF protection, per-account isolation tested, and encrypted off-site backups.

Not in place today: two-factor authentication and remote session revocation. Stated here rather than omitted, because a security annexe that lists only what exists reads as complete when it is not.

5. If something goes wrong

the operator of Datum will tell you without undue delay after becoming aware of a personal data breach affecting your data, with what is known at the time: what happened, which data, and what is being done. You are the controller, so notifying a regulator or the people affected is your decision and your obligation, and we will give you what you need to make it.

6. When someone exercises their rights

If one of your customers asks you for access, correction or erasure, you can act on it yourself: the export and the deletion are both in the product and neither needs us. If you need help beyond that, ask and we will assist.

7. Deletion and return

Delete your account and every record belonging to it is erased from the live database immediately, including sent mail and its attachments. Backups already taken still hold it until they age out after 30 days, and are then pruned. Export first if you want a copy.

8. Audit

On reasonable notice, the operator of Datum will provide the information needed to demonstrate compliance with this agreement. The source code is available to customers under a mutual non-disclosure agreement, which is a stronger form of assurance than most vendors of this size can offer and is offered because the argument of the product is that the workings should be inspectable.

9. International transfers

The sub-processors above are in the United States. If you are subject to UK or EU data protection law, transfers rely on the relevant standard contractual clauses. Confirm this with your own adviser before relying on it: it is the ordinary arrangement, and whether it fits your circumstances is a question for somebody who knows them.

10. Signing it

A contact address has not been configured for this deployment.