How we handle your data.
What we ask for, where it is kept, how AI is used on it, and when it is deleted.
The short version
We ask for as little as possible, as late as possible. The free Snapshot needs supplier names and services only. Contracts come later, under a signed agreement. We use AI to process documents, a person makes every judgement, and we tell you exactly where your data goes before you share it.
This page is a summary. You get the full two-page data-handling statement, with our data processing agreement, before you share any contracts. Ask for it at any time.
What we ask for
- Free Snapshot: your supplier list only: names and the service each provides. Leave out people's names, spend and contracts, and rename anything sensitive. We hold the list in confidence, use it only to produce your Snapshot, and delete it within 30 days unless you engage us.
- Register Ready and other paid work: contracts for material and borderline arrangements, your important business services, and your existing outsourcing register. Only after the engagement letter and our data processing agreement are signed.
- We never ask for your customers' personal data, passwords, or access to your systems.
Where it is kept
Each client's files sit in a separate, access-controlled folder on our Google Workspace account, stored in Google's data centres, which may be outside the UK, including in the United States. Access is limited to the named individuals delivering your engagement. Every account uses multi-factor authentication and devices are encrypted.
How we use AI
We use Claude, from Anthropic, to extract and compare information from supplier lists and contracts, to fill in templates, to check for gaps and to prepare drafts. Every judgement is made and signed off by a person. We use no other AI service on your data.
We use Claude only under Anthropic's commercial terms. Your data is not used to train Anthropic's models. Claude stores data in the United States, and may process it there and in other countries where Anthropic operates.
UK-only or EU-only AI processing is not available from us today. If your policy needs it, or no AI on your data at all, tell us before you share anything: we can do the work without AI, and we will agree the approach in writing.
Who else handles your data
Two companies, and no others:
| Company | What it holds | Where |
|---|---|---|
| Google (Workspace: Drive and Gmail) | Your documents and our email with you | Stored in Google's data centres, which may be outside the UK, including in the United States |
| Anthropic (Claude) | The lists and contracts we process for you, and the drafts produced from them | Stored in the United States; processed there and in other countries where Anthropic operates |
We give you at least 14 days' written notice before adding or replacing a company on this list, so you can object.
When it is deleted
We delete the documents you gave us within 30 days of the engagement ending, and sooner if you ask. We keep our deliverables and the record of who signed off each judgement for six years, so that we can stand behind the work.
If something goes wrong
If we become aware of a breach affecting your data, we tell you within 48 hours, with what we know at that point and what we are doing about it, and we keep you updated until it is closed.
Who we are
AEDRA Ltd, registered in Scotland, company number SC904905. ICO registration ZC266414. AEDRA does not give legal advice and is not authorised by the FCA.
For how we use your own contact details, see our privacy notice.