Draft: not yet reviewed by counsel
This is a working draft. It has not been approved and is not final, and it should not be relied on as the agreement between you and us. 17 items are still to be confirmed, highlighted where they occur.
Privacy Policy
What personal data we collect, why, who receives it, and your rights, including how the AI assistant uses your data.
Version 2026-09-21Effective 21 September 2026
Who we are
Change8 Ltd ([[TO CONFIRM: full registered company name]], company number [[TO CONFIRM: company registration number]], [[TO CONFIRM: registered office address]]) runs the Data Migration Agent. You can reach us about anything in this policy at [[TO CONFIRM: privacy / data protection contact email]].
[[TO CONFIRM: whether a Data Protection Officer or representative is required, and who]]
Our two roles
We handle personal data in two different ways, and the rules differ.
- As a controller, for information about you and your account: who you are, how you use the Service, and how we run and secure it. This policy is about that.
- As a processor, for the data you migrate through the Service. That data, read from your IFS environment and held in your workspace, belongs to your organisation. Your organisation decides why and how it is used, and we process it only on its instructions, under the Data Processing Agreement. If someone’s personal data is in your workspace and you are that person, ask the organisation that holds it.
What we collect
| What | Details | Where it comes from |
|---|---|---|
| Account details | Your email address, name, role, and a hashed password (we never store the password itself). If you sign in with Google or Microsoft, the email address and basic profile that account gives us. | You, or your organisation’s Owner or an Admin who added you |
| Organisation details | Your organisation’s name and workspace address, and optionally its website, industry, size and a contact email and phone number. | You |
| Sign-in and security records | When you last signed in, sessions that are active, failed sign-in attempts, and the IP address and browser details recorded when you accept our terms. | Created as you use the Service |
| Your workspace | Flows, mappings, settings and the data you migrate. This is processed for your organisation under the Data Processing Agreement. | You, and your IFS environment |
| ERP connection credentials | The details you give us to connect to your IFS environment. Stored encrypted. | You |
| Activity and job records | A log of actions taken in the Service and of migration jobs, including any error messages, so we can show you what happened and keep the Service running. | Created as you use the Service |
| AI assistant usage | How much the assistant was used, by which feature, and what it cost, per organisation. See the section on the AI assistant for what is sent. | Created as you use the assistant |
| Plan and usage figures | Your plan, its limits, and how many members, migration runs and rows you have used. | Created as you use the Service |
| Email we send you | Verification, invitation and plan notices, and a record that they were queued. | Created by us |
The AI assistant and your data
The AI assistant sends data to a third-party AI provider, DigitalOcean, whose model runs the assistant. If you do not want that, do not use the assistant. Nothing else in the Service depends on it.
When you use the assistant, we send the provider:
- what you type, and the last few messages of the conversation;
- the names of the tables and columns in your workspace, and the names of the fields and IFS entities in the flow you are working on;
- example source values, but only if you include them in a request for conversion suggestions;
- the error text of a failed migration job, if you ask the assistant to explain it. That text is what your IFS environment reported, and it can contain values from your data;
- search queries to a knowledge base that holds our own product documentation.
The assistant is built to send names and what you type, not the contents of your tables. [[TO CONFIRM: engineering to re-verify this against every AI feature immediately before publication]] Anything you type is sent as you typed it, so do not put in personal or confidential data you are not permitted to share.
We keep a record of each assistant request's size and cost, but not what you asked. [[TO CONFIRM: what DigitalOcean retains from inference requests, whether it uses them to train models, and the region it runs in. Check its terms and record the answer here]]
Why we use it, and our legal basis
[[TO CONFIRM: counsel to confirm the legal basis for each purpose below, for the jurisdictions that apply. Proposed as a starting point.]]
| Purpose | Proposed basis |
|---|---|
| To provide the Service you signed up for, and to run your account | Performance of a contract |
| To keep the Service secure, prevent abuse and fix faults | Legitimate interests |
| To email you about your account, your plan and limits, and changes to our terms | Performance of a contract; legitimate interests |
| To keep a record of what you agreed to, so we can prove it | Legitimate interests; legal claims |
| To meet legal obligations | Legal obligation |
The Service contains no advertising and no analytics, and we do not use your data to advertise to you.
Where it is processed
The Service runs on DigitalOcean, and our deployment configuration uses its New York (United States) region. [[TO CONFIRM: the region of the production database, queue and backups, and of the AI and email providers]]
Where personal data leaves the UK or the European Economic Area we rely on [[TO CONFIRM: transfer mechanism, e.g. adequacy decision, standard contractual clauses or the UK addendum, and whether a transfer risk assessment has been done]].
How long we keep it
| What | How long |
|---|---|
| The activity log (actions taken in the Service) | 365 days |
| Migration job records and their messages | [[TO CONFIRM: retention period for job records, which the code does not currently prune]] |
| Per-request AI usage breakdown | 180 days (the running total per organisation is kept) |
| Signed-in sessions | Up to 7 days, or until you sign out |
| Plan usage receipts | 90 days |
| Account and workspace data | While your organisation uses the Service; then [[TO CONFIRM: retention and deletion period after the workspace ends, consistent with the Terms and CDMT-1650]] |
| Records of what you accepted, and when | [[TO CONFIRM: retention period and basis. These are kept as evidence, so they are not deleted with the account by default]] |
How we protect it
- Each organisation’s workspace is held in its own isolated database schema.
- Passwords are stored only as hashes, and must be at least 12 characters.
- Credentials for your IFS environment are stored encrypted.
- Sessions use cookies that scripts on the page cannot read, and traffic is encrypted in transit.
- Access inside the Service is controlled by role, and actions are logged.
- Sign-in and sign-up are rate limited, and new workspaces must verify their email address.
No system is perfectly secure. [[TO CONFIRM: encryption at rest for the database and backups, and any certifications or audits, once confirmed with the hosting provider]]
Your rights
Depending on where you live, you can ask us for a copy of the personal data we hold about you, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable format. You can also withdraw consent where we rely on it.
Write to [[TO CONFIRM: privacy / data protection contact email]]. For data in a customer’s workspace, we will pass your request to that customer, who is responsible for it. If you are unhappy with how we have handled your data you can complain to [[TO CONFIRM: supervisory authority customers may complain to]].
Children
The Service is for businesses and is not aimed at children. [[TO CONFIRM: minimum age, if counsel wants one stated]]
Changes to this policy
We may update this policy. Each version has a date, shown at the top. When it changes we will ask you to accept the new version the next time you sign in, and we record that you did.