Privacy Notice — Aletheia platform
Last updated: 10 October 2026
This notice explains how Aletheia GI Ltd ("Aletheia", "we", "us") handles personal data in the Aletheia platform, the web application our clients use to analyse documents. Our marketing website has its own Privacy Policy, and the processing of your organisation's own documents and analyses is governed by the agreements between us and your organisation.
Who we are
Aletheia GI Ltd is registered in England and Wales, company number 17051441, registered office 1st Floor 314 Regents Park Road, Finchley, London, England, N3 2LT. For the data your organisation puts into the platform, your organisation decides what is processed and why, and we act on its instructions. For your account and how you use the platform, we decide those things ourselves and are the data controller.
Signing in with Google or Microsoft
You sign in to the platform with your Google or Microsoft work account. Sign-in is handled by Amazon Cognito, operated for us by Amazon Web Services in its London region. Aletheia never sees or stores your Google or Microsoft password.
What we receive. When you sign in, we ask Google or Microsoft only for basic profile information: your name, your email address, and an identifier for your account. From Microsoft we also receive the identifier of your organisation's directory and whether you completed multi-factor authentication.
What we do not access. We do not request or receive access to your email, calendar, files, contacts or any other data held in your Google or Microsoft account, and we cannot act in those accounts on your behalf.
How we use it. Your email address is used to match you to the account your organisation has set up for you, so we can check that you are allowed in and apply your role and permissions. Your name is shown in the platform and in the record of the work you do. Your organisation's directory identifier and multi-factor status are used to apply your organisation's sign-in rules and for security. We use this information for nothing else.
Sign-in records. Each sign-in is recorded for security: when it happened, whether you used Google or Microsoft, your organisation's directory identifier and whether multi-factor authentication was used. These records are kept for 24 months and then deleted automatically.
Google user data. Aletheia's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We do not sell information received from Google or Microsoft, do not use it for advertising, and do not use it to train AI models.
You can remove Aletheia's access at any time from your Google account (Security → Third-party apps & services) or your Microsoft account (My Apps). Doing so stops you signing in; it does not delete the data described in this notice, which you can ask us to delete as described under "Your rights".
What else we collect
Your account. Your name, email address and the organisation you belong to, together with your role and permissions.
How you use the platform. Which features you use and when, the analyses and questions you run, the documents you upload, and the compute each one consumes.
Technical context. Your IP address, browser and device information, and timestamps, recorded in access and security logs.
The record of the work. Every analysis is recorded as it happens: the documents retrieved, the standards applied and the answer produced, each with a trace that can be checked later for alteration. Your account identifier appears in that record, because who asked is part of what makes it auditable.
How and why we use it
- To sign you in, give you access to the platform and run the analyses you ask for — to perform our contract with your organisation.
- To keep the audit trail that makes an answer defensible later — a legal obligation of ours in some cases, and our legitimate interest in all of them.
- To keep the platform secure and to apply fair-use limits — our legitimate interests.
- To support you, and to understand and improve how the platform performs — our legitimate interests.
Your documents and our models
We do not use your organisation's documents or analyses to train public foundation models. Where a model provider processes text on our behalf, it does so under contract and without retaining that text for training.
Who we share it with
We do not sell personal data. We use service providers who process data only on our instructions: Amazon Web Services (hosting, storage and sign-in, UK region), Google and Microsoft (as the sign-in providers you choose), and AI model providers that process document text on our behalf. Our sub-processor list is available to clients on request.
Where it is held
Your data is hosted in the United Kingdom (Amazon Web Services, London). Some providers may process limited data outside the UK or EEA under appropriate safeguards, such as the UK International Data Transfer Agreement or Standard Contractual Clauses.
Storage in your browser
The platform stores your sign-in tokens in your browser's local storage so that you stay signed in, and remembers a few choices, such as the organisation and project you last worked in. These are strictly necessary for the platform to work, are not used for tracking or advertising, and the sign-in tokens are removed when you sign out.
How long we keep it
Audit records are kept for the duration of your organisation's agreement with us, and for six years afterwards, so that a decision taken on an answer can still be examined. Sign-in records are kept for 24 months. Data held only for the length of a single analysis is deleted when that analysis ends. Access and security logs are kept for 365 days.
How we protect it
Encryption in transit and at rest, access on a least-privilege basis, tenant separation between organisations, and an audit record that shows what was done and makes alteration detectable.
Your rights
Under UK GDPR you may ask for access to your personal data, correction of it, erasure, restriction of or objection to its processing, and portability, and you may withdraw consent where processing relies on it. Erasure has one limit worth stating plainly: we cannot remove entries from an audit record without destroying the thing that makes it an audit record, so those are kept for the period above and then deleted.
Contact your organisation's administrator first, since they control the data you work with. You can also reach us using the form below, and you have the right to complain to the Information Commissioner's Office (ico.org.uk).
Changes to this notice
We may update this notice. The date above reflects the most recent change, and material changes will be notified to your organisation.