Privacy Policy

Overview

This policy explains how Codified London Ltd (trading as Deputy) collects, uses, and protects your data when you use our service. We're committed to protecting your privacy and being transparent about our data practices.

What We Collect

Account Information

• Email address (for login and notifications)
• Organisation name
• Team member details (for users you invite)

Content You Provide

• Documents you upload (PDFs, spreadsheets, text files)
• Database connection details
• Workflow instructions and configurations
• Email and Slack messages processed through Deputy
• AI-generated drafts and your edits to them

Usage Data

• How you interact with the platform
• Workflow execution logs
• Error reports and diagnostics

Technical Data

• IP addresses
• Browser type and version
• Device information

How We Use Your Data

We use your data to:

• Provide the service — Process your workflows, generate AI drafts, send messages
• Improve Deputy — Understand how the platform is used and fix issues
• Communicate with you — Send service updates, security alerts, and support responses
• Ensure security — Detect and prevent fraud or abuse

How We Share Your Data

We share data with third-party services that help us operate Deputy:

• Anthropic — Your documents and messages are sent to Anthropic's Claude API for AI processing. Anthropic's data policies apply to this processing.
• Slack — When you connect a Slack workspace, we access messages in channels you configure and send replies on your behalf.
• Google — When you connect Google Sheets or Docs, we access the specific files you authorise.
• Resend — Email addresses and message content for email delivery.
• Cloudflare — Uploaded files are stored in Cloudflare R2.

We don't sell your data. We only share what's necessary to provide the service you've requested.

Data Security

We take security seriously:

• All data is encrypted in transit (HTTPS)
• Uploaded files are stored encrypted at rest
• Each workflow runs in an isolated container with network restrictions
• Database credentials are stored securely and only accessible during workflow execution
• We use multi-tenant isolation to keep your data separate from other customers

Data Retention

We keep your data for as long as your account is active. When you close your account:

• Your uploaded files are deleted
• Your workflow configurations are deleted
• Execution logs are retained for up to 90 days for debugging purposes, then deleted
• We may retain anonymised usage data for analytics

Your Rights (GDPR)

If you're in the UK or EU, you have the right to:

• Access — Request a copy of the personal data we hold about you
• Rectification — Ask us to correct inaccurate data
• Erasure — Ask us to delete your data (subject to legal requirements)
• Portability — Request your data in a portable format
• Object — Object to certain processing of your data
• Restrict — Ask us to limit how we use your data

To exercise these rights, contact us using the details below. We'll respond within 30 days.

Cookies

We use minimal cookies—primarily for authentication (keeping you logged in). We don't use tracking cookies or third-party advertising cookies.

Children's Privacy

Deputy is designed for business use and is not intended for children under 16. We don't knowingly collect data from children.

Changes to This Policy

We may update this policy from time to time. We'll notify you of significant changes via email or through the platform. The "Last updated" date at the top shows when this policy was last revised.

Contact Us

If you have questions about this policy or want to exercise your rights:

If you're not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO).