Privacy notice
Last updated 23 August 2026
This notice describes what Calder Standard does with personal data. It is written to be checkable: where a claim can be verified against how the software is actually built, it says so specifically rather than generally.
Who is responsible
Calder Standard is operated by [LEGAL ENTITY NAME], registered at[REGISTERED ADDRESS]. For questions about this notice or about your data, contact [CONTACT EMAIL].
Where your firm uses Calder Standard to hold its own compliance records, your firm is the controller of the material it enters and we act as its processor. For your account itself, and for the operation of the service, we are the controller.
What we hold
- Account details. The email address you register with, and an encrypted form of your password. We never store your password itself.
- Firm details. The firm name, jurisdiction, and any licence number, licence status, contact name and contact telephone number you choose to enter. These fields are optional except the firm name and jurisdiction.
- Compliance content. The evidence narratives you write, the status you set against each regulatory principle, the documents you upload, and the cryptographic inventory and migration roadmap you record. This is your firm's material, held on its behalf.
- Operational records. Server logs generated when the service is used, including request paths, timestamps and error detail. These are used to keep the service working and to investigate faults.
We do not use tracking or profiling of any kind, and the service carries no advertising.
Why we hold it
- To provide the service you asked for. Holding your compliance records, showing you the regulatory principles in force, and telling you when something published may affect evidence you hold. The lawful basis is performance of a contract.
- To keep the service secure and working. Server logs, error records and access control. The lawful basis is our legitimate interest in operating a secure service.
Where it is held
Your data is stored in the European Union (Ireland, AWS eu-west-1), with our database provider Supabase. Uploaded evidence files are held in the same region.
The application itself runs on Vercel, with its server functions pinned toDublin (region dub1) — the same location as the database. Requests are therefore processed in the European Union, not merely stored there.
Requests are first received by Vercel's edge network, which has locations worldwide and will normally be the one closest to you, but the processing of your data happens in Dublin.
Who else processes it
We use a small number of sub-processors, listed in full with their purpose and location on thesub-processors page. Two points worth stating here:
- Our AI provider never receives your data. Calder Standard uses Anthropic to assess published regulatory material — a regulator's headline, a standards body's news item, a statutory title. It is never sent your evidence text, your cryptographic inventory, your documents, your firm name or your contact details. This is a property of how the software is built, not a policy applied afterwards.
- We do not sell personal data, and we do not share it for anyone else's marketing.
How long we keep it
Your compliance records are kept for as long as your account is active, because their value is that they remain answerable years later. Attestation history is deliberately preserved rather than overwritten: a submitted attestation cycle is frozen, so that what your firm recorded in a given period stays available.
If you close your account we will delete your firm's data within [RETENTION PERIOD], except where we are required to retain something by law. Server logs are retained for a shorter period as part of normal operation.
Your rights
You have the right to ask for a copy of the personal data we hold about you, to have it corrected, to have it deleted, to restrict or object to how we use it, and to receive it in a portable form. Where your firm is the controller of the material, we will direct such requests to your firm and assist it in responding.
Contact [CONTACT EMAIL] to exercise any of these. If you are not satisfied with our response you may complain to the relevant supervisory authority: in Gibraltar the Gibraltar Regulatory Authority, and in the United Kingdom the Information Commissioner's Office.
Security
Access to your firm's records is restricted at the database level, so a signed-in user of one firm cannot read another firm's evidence, documents or quantum readiness data. Uploaded files are held in private storage and served only through short-lived signed links. Transport is encrypted throughout.
Changes
If this notice changes materially we will update the date at the top and, where the change affects how your data is handled, tell account holders directly.