Data processing

This page summarises, in plain English, how Sinatra AI Ltd processes personal data when you use Emily Politics. It is written for the person running a procurement or GDPR check. It is a summary, not the contract: Team and enterprise customers can request a signed Data Processing Agreement (see below), and our privacy policy remains the authoritative statement of our privacy practices.

Who does what

• You are the controller of the material you put into Emily: client names, stakeholder notes, engagement records, uploaded documents, and the questions you ask. You decide why that data exists and how long it should.
• Sinatra AI Ltd is the processor of that material. We process it only to provide the service you configured: answering your questions, generating your briefings and drafts, and running the monitoring you set up.
• For your account itself we are the controller: your name, email, billing status and usage records, which we need to operate, bill and secure the service.

Legal basis

We process personal data under UK GDPR. For the service itself the basis is the performance of our contract with you; for security, abuse prevention and service improvement it is legitimate interests; where consent is required (for example, analytics cookies) we ask for it and act only on a yes.

Where data lives and who touches it

• Customer data is stored in a PostgreSQL database hosted by Supabase in AWS eu-west-2 (London).
• We use a small number of third-party sub-processors (hosting, AI models, email, payments). Every one of them, what it processes, and where it runs is listed on the sub-processors page, which we update before material changes.
• Where a sub-processor operates outside the UK/EU, transfers rest on UK adequacy decisions, Standard Contractual Clauses, or the EU-US Data Privacy Framework, as set out on that page.
• We do not use your data to train AI models. The basis for that statement, per provider, is on the security page.

Retention and deletion

Your data stays in the service while your account is active. When you delete your account, or your subscription ends and the wind-down period passes, we delete the personal data we process for you, subject to what the law requires us to keep (for example, billing records). Details and timescales are in the privacy policy, and you can ask us to delete sooner at any time.

Getting a signed DPA

A signed Data Processing Agreement, incorporating the commitments above and the sub-processor list, is available for Team and enterprise customers. Email support@emilypolitics.com with your organisation name and we will send it for signature. If your organisation requires its own template, send it with the request and we will review it.