Privacy Policy

Overview

Obsidian is a private document analysis platform. This policy explains what data we collect, where it goes, and how long we keep it. The data controller is CYVERRA LTD, a company registered in England and Wales (Company No 17172266) with its registered office at Dept 6723, 196 High Road, Wood Green, London, N22 8HH, United Kingdom.

Document Privacy

Your document content is stored and processed on the GPU instance rented for your vault. Uploads travel over TLS from your browser to our API, which relays them to that instance without storing them; the hop from our servers to the instance is not yet encrypted. Documents are held on the instance's own disk for the life of the vault, and destroying the vault deletes the instance and its disk at the GPU host. This is not end-to-end encryption: the instance reads your documents in order to index them and answer your questions. All AI processing runs on that instance with open-source models; no third-party AI service sees your documents. We do not read, mine, or use your document content for any purpose other than running the vault you asked for, and we never use it to train models.

Information We Collect

We collect the following information:

• Account information. Your name (optional), email address, country and password (stored hashed) when you create an account. At sign-up we also read the country of your IP address to apply the restriction in our Terms; we do not store it in our database, but it appears, with your email, in our internal sign-up alert.
• Specialist applications. If you apply to join the specialist panel: your name, email, field, credentials, LinkedIn URL, rate and notes, plus the IP address and browser the application was sent from.
• Billing information. Your card number, expiry, CVV, card-holder name and billing address, postcode and country pass through our server to the payment processor, with your email and IP address, and are never stored by us. We store the amount, currency and status of each payment.
• Vault metadata. Vault names, creation timestamps, status, model tier and usage duration. We do not store document content.
• Chat history. “Save chat history” is on by default for each vault. While it is on, every question you ask and every AI reply is stored in our database. Turn it off for a vault and nothing from its chat is stored.
• Specialist requests. If you request a specialist: your brief (redacted if you chose), the names of the files you flagged, the quote and the messages exchanged on the task.
• Audit log. Vault, document-upload and specialist events, with timestamps.
• Usage data. GPU time consumed, billing transactions and account activity, for billing and support.

How We Use Your Information

• To provide and maintain the Obsidian platform.
• To process payments and manage your billing.
• To send you account, sign-in and billing emails. We do not send marketing emails.
• To keep the service secure and to comply with legal obligations.

Where Data Is Stored

Account information, vault metadata, the audit log and saved chat history are stored in a managed database in the European Union (Frankfurt, Germany). Your documents exist only on your vault's GPU instance, rented on demand from hosts in the countries listed under Data Sharing.

Data Retention

This is the only place we state how long each kind of data is kept:

• Document content. Never stored by our servers. Documents exist only on your vault's GPU instance, which is deleted with its disk when you destroy the vault.
• Saved chat history. Kept while the vault exists; deleted from our database when you destroy the vault or delete your account. Included in the data export.
• Account and vault records. When you delete your account your profile is anonymised. Vault names, the audit log and specialist task records (including their messages) are kept.
• Billing and transaction records. Kept for 6 years after the transaction date, as UK company accounting rules require (Companies Act 2006, s.386–388), even after you close your account.

Data Sharing

We do not sell, rent, or share your personal information for marketing. We use these kinds of providers to run Obsidian:

• GPU marketplace hosts. Vault GPUs are rented from independent hosts on a third-party GPU marketplace, located in the US, Canada, the UK, Germany, France, the Netherlands, Sweden, Norway, Finland, Poland, Czechia, Austria, Ireland or Australia. Your documents are held on the instance for the life of the vault. The GPU is dedicated to your vault; the host machine's CPU, disk and network may be shared with other renters.
• Hosting provider. Runs our website and API (United States), which relay your uploads to your vault's instance without storing them.
• Database provider. Stores account, billing and vault records, the audit log and, when chat saving is on, your chat history, in the European Union (Frankfurt, Germany).
• Email delivery provider. Sends account, sign-in and billing emails.
• Product analytics provider. Only after you allow Analytics in the cookie notice. Events are linked to your account email and name; processed in the United States.
• Team messaging service. Carries internal alerts to our team about sign-ups, logins, vaults and payments. These contain your email, name and IP country.
• Payment processor. Processes your Visa or Mastercard payments (see Billing information above).
• Specialists. If you request a specialist, the specialist receives your brief (redacted if you chose) and the names of the files you flagged, not their contents.

We may also share information when required by law, regulation or legal process, or to protect the rights, safety or property of Obsidian or its users.

Cookies

Necessary cookies for signing in and for your currency choice are always on. With your consent (the Analytics category in the cookie notice) we also use product analytics to understand which features get used; these events are linked to your account email and name. You can refuse or withdraw consent at any time from the cookie notice. We do not use marketing or advertising cookies. The full list is in our Cookie Policy.

Data Deletion

You can destroy individual vaults at any time, which deletes the vault's GPU instance and its disk, and its saved chat history from our database. Once every vault on your account is destroyed, you can delete your account yourself from Settings → Privacy & Data. What is kept after that is listed under Data Retention above. You can also write to support@obsidian.expert if you'd rather we handle it.

Your Rights

Depending on where you live, you may have the right to access, correct, delete, or export your personal data, to object to or restrict its use, and to complain to a data protection authority (in the UK, the Information Commissioner's Office). You can export your account, billing and vault records and your saved chat history, and delete your account yourself, from Settings → Privacy & Data. For anything else, write to support@obsidian.expert.

Changes to This Policy

We post every change on this page and update the date at the top; for a material change we also tell you by email or by a notice on the platform before it takes effect.