Legal
Privacy Policy
Effective 5 September 2026 · Chainsilience AI
01Scope and our role
This policy covers the Chainsilience AI website and platform, operated by Chainsilience AI. It explains what we do with personal data.
We act in two capacities. For your account and billing data we are the controller: we decide why and how it is processed. For the content you put into your workspace — which may name your employees, your suppliers’ staff or your customers — you are the controller and we are your processor, handling it on your instructions to run the service for you.
We grant the rights in section 11 to everyone who uses the platform, wherever they are. We would rather run one standard than a different one per region.
02What we collect
Account and identity
| Data | Detail |
|---|---|
| Email address | Your login identifier; also where verification and reset mail is sent. |
| Full name | Shown in the interface and on actions you own. |
| Password | Stored only as a pbkdf2_sha256 hash. We never hold the password itself and cannot recover it. |
| Role | Administrator, manager, analyst or viewer — determines your permissions. |
| Verification codes | A one-time sign-up code, stored only as an HMAC-SHA256 hash, with a ten-minute expiry and an attempt counter. |
| Password-reset tokens | Stored only as a hash, single-use, valid for 30 minutes, deleted once used. |
Company profile
Company name, industry, countries of operation, primary products and risk tolerance. This is what the risk engine matches world events against, so it is business information rather than personal data — but it is commercially sensitive, and we treat it that way.
Content you create in the platform
- Your digital twin — suppliers, factories, warehouses, ports, routes, products and components, with their names, locations, countries and attributes such as lead time, capacity and dependency share.
- Risks and actions — generated risks, and the mitigation actions you track, including the owner’s name, department and deadline you assign.
- Email drafts — subject and body of communications drafted for suppliers, customers, executives or procurement, saved so you can edit them.
- Feedback — the 1–5 rating and free-text comment you leave on a recommendation.
If you put personal data into these fields, we process it as your processor. Please put in only what you actually need.
Billing
If you subscribe, we store the Stripe customer and subscription identifiers, your plan status and whether it is set to cancel at period end. We never receive your card number. Stripe collects and holds payment details directly.
Technical
- An authentication token (a JWT, valid for 24 hours) held in your browser’s
localStorage— not a cookie, and never sent anywhere but our API. - Server-side operational logs from our hosting providers, which include IP addresses and request metadata, kept for security and debugging.
The enquiry form on our website composes a message in your own email client — it does not submit anything to our servers. What you send arrives as ordinary email.
03Where it comes from
Almost everything comes from you or from people in your workspace. Two exceptions: Stripe returns billing status to us after a payment, and the platform continuously ingests publicly published news from around twenty RSS feeds — general and business outlets alongside shipping and logistics trade press — refreshed roughly every thirty seconds.
Those articles are public reporting, not personal data we have gone looking for. We store the headline, link, summary and publication time, and the structured disruption event extracted from them.
04Why we process it, and on what basis
| Purpose | Basis |
|---|---|
| Creating your account, authenticating you, and running the platform | Performance of our contract with you |
| Verifying your email address and processing password resets | Performance of our contract; our legitimate interest in account security |
| Scoring risks, generating recommendations and drafting communications | Performance of our contract |
| Taking payment and managing subscriptions | Performance of our contract; legal obligation for tax and accounting records |
| Protecting the platform against abuse, and diagnosing faults | Our legitimate interest in a secure, working service |
| Replying to you when you contact us | Our legitimate interest in responding to enquiries |
We do not use your data for advertising or profiling, and we do not make automated decisions that produce legal or similarly significant effects about individuals. The platform scores supply-chain risk, not people.
05What we send to AI providers
To score a risk and explain it, we send an AI provider the context it needs: the disruption event drawn from public news, and the relevant part of your supply-chain model — typically supplier and site names, locations, countries and the dependency attributes you have recorded.
Requests go to NVIDIA (Nemotron) where configured, and otherwise to OpenAI. If both are unreachable, a deterministic scorer runs locally and nothing leaves our servers. Each call has a hard timeout so a slow provider degrades to that fallback rather than holding your data in flight.
We do not send these providers:
- your password hash, verification codes or reset tokens;
- your payment details, which we do not hold in the first place;
- your users’ login identifiers or authentication tokens.
We send this data through the providers’ business APIs, under terms that do not permit training on it. We do not consent to such training, and if a provider changed that position we would move to one that had not.
08International transfers
Our infrastructure and our providers are largely United States-based, so your data will be transferred to and processed in the United States and potentially other countries whose data-protection law differs from your own.
Where we transfer personal data out of the UK, the EEA or another region with transfer restrictions, we rely on the appropriate safeguards our providers offer — typically Standard Contractual Clauses in their data processing agreements. You can ask us which mechanism applies to a particular provider.
09How long we keep it
| What | How long |
|---|---|
| Account and workspace data | While your account is open |
| After you ask us to delete | Removed from live systems within 30 days; residual copies age out of backups within a further 90 days |
| Verification codes | Ten minutes, then expired and cleared |
| Password-reset tokens | 30 minutes, or immediately once used |
| Billing records | As long as tax and accounting law requires, typically seven years |
| Operational logs | Short-lived, on our hosting providers' retention schedules |
| Public news items and extracted events | Retained as reference data; not personal to you |
We may keep an anonymised or aggregated record that cannot be traced back to you or your company — for example counts of how often a feature is used.
10How we protect it
- Passwords are hashed with
pbkdf2_sha256. Sign-up codes and reset tokens are stored only as keyed HMAC-SHA256 hashes, so the values themselves exist nowhere in our database. - Every database read is scoped to the requesting workspace’s
company_id, and that scoping lives in the data-access layer rather than being re-applied by each endpoint — so it cannot be forgotten in a new one. - Traffic to the site and API is encrypted in transit with TLS.
- Sessions expire after 24 hours, and sign-up codes are bounded by a short expiry and an attempt limit.
No system is perfectly secure, and we will not pretend otherwise. If a breach affects your personal data and is likely to present a risk to you, we will notify you and the relevant regulator without undue delay, and tell you what happened and what we did about it.
If you find a vulnerability, please report it to chainsilienceai@gmail.com. See the Acceptable Use Policy for how to test safely.
11Your rights, and how to use them
Whoever and wherever you are, you can ask us to:
- tell you what personal data we hold about you, and give you a copy;
- correct anything inaccurate;
- delete your data, or your whole workspace;
- export your workspace in a portable format;
- restrict or object to a particular processing activity;
- withdraw consent, where we relied on it.
Email chainsilienceai@gmail.com from the address on the account. There is no self-service delete button yet — these requests are handled by a person, and we will complete them within 30 days and confirm when it is done. We may need to verify who you are before acting, and we do not charge for this.
If the personal data is content inside a customer’s workspace, that customer is the controller: we will pass your request to them and support them in answering it.
If you think we have handled your data badly, please tell us first — but you are entitled to complain to your local data-protection authority, and nothing here removes that right.
12Children
The platform is a business tool, not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a child has given us personal data, write to us and we will delete it.
13Changes to this policy
When this policy changes materially — a new category of data, a new purpose, a new subprocessor handling personal data — we will update the effective date at the top and email account administrators at least 30 days before it takes effect, so you have time to object or leave.