Privacy Policy

This privacy policy applies between you, the User of the Caelum AI mobile app and related services (together, the Service), and Mindrops UK Ltd., the owner and provider of the Service. Mindrops UK Ltd. takes the privacy of your information very seriously. This privacy policy applies to our use of any and all Data collected by us or provided by you in relation to your use of the Service.

This privacy policy should be read alongside, and in addition to, our Terms and Conditions and our Cookie Policy.

Please read this privacy policy carefully.

Definitions and interpretation

In this privacy policy, the following definitions are used:

Term	Meaning
Data	Collectively all information that you submit to Mindrops UK Ltd. via the Service. This definition incorporates, where applicable, the definitions provided in the Data Protection Laws.
Data Protection Laws	Any applicable law relating to the processing of personal Data, including but not limited to the UK GDPR, the EU GDPR where applicable, the Data Protection Act 2018, and any national implementing laws, regulations and secondary legislation.
GDPR	The General Data Protection Regulation (EU) 2016/679, and the UK GDPR as retained in UK law.
Mindrops UK Ltd., we or us	Mindrops UK Ltd., a company incorporated in England and Wales with registered number 13021417 whose registered office is at 11-12 Hallmark Trading Centre, Fourth Way, Wembley, HA9 0LB.
User or you	Any third party that accesses the Service and is not either (i) employed by Mindrops UK Ltd. and acting in the course of their employment or (ii) engaged as a consultant or otherwise providing services to Mindrops UK Ltd. and accessing the Service in connection with the provision of such services.
Service	The Caelum AI mobile app (iOS and Android), the Caelum AI web dashboard and API, and the Website.
Website	caelum.ai and any of its sub-domains, unless expressly excluded by their own terms and conditions.

In this privacy policy, unless the context requires a different interpretation:

• the singular includes the plural and vice versa;
• references to sub-clauses, clauses, schedules or appendices are to sub-clauses, clauses, schedules or appendices of this privacy policy;
• a reference to a person includes firms, companies, government entities, trusts and partnerships;
• “including” is understood to mean “including without limitation”;
• reference to any statutory provision includes any modification or amendment of it;
• the headings and sub-headings do not form part of this privacy policy.

Scope of this privacy policy

• This privacy policy applies to the actions of Mindrops UK Ltd. and Users with respect to the Service, including the mobile app, the web dashboard, the API and the Website. It does not extend to any websites or apps that can be accessed from the Service including, but not limited to, links to social media websites, or the sign-in pages of Google and Microsoft.
• For purposes of the applicable Data Protection Laws, Mindrops UK Ltd. is the data controller. This means that Mindrops UK Ltd. determines the purposes for which, and the manner in which, your Data is processed.
• The Caelum AI Android app is published on Google Play by GRG Professional Services Ltd, in collaboration with Mindrops UK Ltd. Mindrops UK Ltd. provides the Service through the app and remains the data controller for all Data described in this privacy policy.

Data collected

We may collect the following Data, which includes personal Data, from you.

Account and contact Data

• your name, email address and telephone number (where you give it);
• your sign-in details: your password is stored only in hashed form, and we never receive or store your Google or Microsoft password;
• details of your team, where your account has team members;
• your settings and preferences, such as language and notification choices.

Documents and what is read from them

• documents you upload or scan, such as bank and credit card statements, invoices and receipts, as PDFs or images;
• the data read from them, such as transactions, balances, line items and totals;
• details about each file, such as its name, number of pages, when it was uploaded and its processing status;
• documents you send for signature, and the names and email addresses of the people you ask to sign them.

Device and technical Data (collected automatically)

• IP address;
• device type, operating system, browser and app version;
• diagnostic and crash information, where crash reporting is enabled, with personal identifiers removed where reasonably practicable;
• information about how you use the Service, such as documents processed and credits used, which we need to run it and bill for it.

Sign-in with Google or Microsoft

When you sign in with Google or Microsoft, we receive, only after you agree on their sign-in screen:

• your email address, and whether Google or Microsoft has verified it;
• your name;
• a unique account identifier from Google or Microsoft, which lets us recognise you the next time you sign in.

We don’t request access to your emails, files, contacts, calendar or any other data held in your Google or Microsoft account, and we don’t receive or keep your Google or Microsoft password.

Payments

• the identifiers and status of your plan, purchases and invoices, from our payment provider. Card details are handled by the payment provider; we do not receive or store full card numbers.

How we collect Data

We collect Data in the following ways:

• Data is given to us by you; and
• Data is collected automatically.

Data that is given to us by you

Mindrops UK Ltd. will collect your Data in a number of ways, for example:

• when you create an account, sign in, or update your profile;
• when you upload, scan, process, export or send documents for signature;
• when you buy a plan or credits, or manage billing;
• when you contact us through the Website, by telephone, post, e-mail or through any other means;
• when you elect to receive marketing communications from us;

in each case, in accordance with this privacy policy.

Data that is collected automatically

To the extent that you use the Service, we will collect your Data automatically, for example:

• technical and device information needed to keep your sessions secure, deliver the app, the dashboard and the API, and diagnose faults;
• information about how you use the Service, such as documents processed and credits used, to run billing and support and to improve the Service.

Device permissions (mobile app)

The Caelum AI mobile app may ask for access to:

• Camera: to scan documents when you choose Scan;
• Photos and files: to choose documents or images when you choose Upload;
• Network: to sign in and to send and receive your documents and data.

Each permission is asked for only when you start the action that needs it. You can withdraw a permission at any time in your device settings; the features that need it will then be unavailable.

Our use of Data

Any or all of the above Data may be required by us from time to time in order to provide you with the best possible service and experience when using the Service. Specifically, Data may be used by us for the following reasons:

• creating and managing your account, and signing you in (including with Google or Microsoft);
• uploading, scanning, reading, checking and exporting your documents, and sending documents for signature;
• managing your plan, credits, invoices and support requests;
• internal record keeping;
• improvement of our products and services;
• security, fraud prevention and preventing abuse of the Service;
• sending you emails about your account and the Service, and, where permitted, marketing materials that may be of interest to you;
• contact for market research purposes, which may be done using email, telephone or mail;

in each case, in accordance with this privacy policy.

We use your Data where it is necessary to perform our contract with you, where we have a legitimate interest in doing so, where we must by law, or with your consent. If you are not satisfied with this, you have the right to object in certain circumstances (see Your rights below).

Direct marketing

For the delivery of direct marketing to you via e-mail, we’ll need your consent, whether via an opt-in or soft-opt-in:

• soft opt-in consent is a specific type of consent which applies when you have previously engaged with us (for example, you contact us to ask us for more details about a particular product or service, and we are marketing similar products or services). Under soft opt-in consent, we will take your consent as given unless you opt out;
• for other types of e-marketing, we are required to obtain your explicit consent; that is, you need to take positive and affirmative action when consenting, for example by checking a tick box that we’ll provide;
• if you are not satisfied about our approach to marketing, you have the right to withdraw consent at any time (see Your rights below).

Signing in with Google or Microsoft

We use the information we receive from Google or Microsoft only to:

• create your Caelum account, or link the sign-in to your existing account;
• sign you in;
• send you account and security emails at that address, such as a notice when a new sign-in method is added to your account.

What we don’t do:

• we don’t sell this information, or share it with anyone for advertising or marketing;
• we don’t use it to train AI models;
• we don’t transfer it to anyone else, except the service providers who host and run Caelum for us, on our behalf and under contract.

Caelum’s use of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

This information is stored with your account on our servers in the UK for as long as your account is open. You can remove it by closing your account (see Delete your account), or remove Caelum’s access from your Google account at myaccount.google.com/connections or from your Microsoft account at account.microsoft.com/privacy/app-access. You will then need another sign-in method to use Caelum.

Who we share Data with

We may share your Data with the following groups of people for the following reasons:

• any of our group companies or affiliates, to ensure the proper administration of the Service and our business;
• our employees, agents and/or professional advisors, to obtain advice from professional advisers;
• third party service providers who process personal data on our behalf and under contract, so that the Service runs securely: for example hosting and storage, reading the pages of your documents, email delivery, sign-in, spam protection on our forms, and crash diagnostics;
• our payment provider, to process payments and refunds;
• relevant authorities, to facilitate the detection of crime or the collection of taxes or duties;

in each case, in accordance with this privacy policy.

We do not sell your personal Data.

Where your Data is stored and processed

Your account and your documents, including the names of your files, are stored encrypted on servers in the United Kingdom. To read a document, its pages are processed by our AI service providers in the European Union, under contract and only to provide the Service to you. Where Data is transferred outside the UK, we make sure it is protected by safeguards recognised by UK law, such as the UK’s adequacy regulations for the EU.

Keeping Data secure

We use technical and organisational measures to safeguard your Data, for example:

1. access to your account is controlled by sign-in details unique to you and a second step at sign-in;
2. your Data is stored on secure servers, and every document is encrypted with its own key;
3. in the mobile app, sensitive items such as sign-in tokens are kept in the device’s encrypted storage where the device supports it;
4. the password of a password-protected PDF is used only on your own device to unlock the file, and is never sent to Caelum.

Technical and organisational measures include measures to deal with any suspected data breach. If you suspect any misuse or loss of, or unauthorised access to, your Data, please let us know immediately at privacy@caelum.ai.

For general guidance on protecting your information online, see Get Safe Online, supported by HM Government and leading businesses.

Data retention

Unless a longer retention period is required or permitted by law, we will only hold your Data for the period necessary to fulfil the purposes outlined in this privacy policy, or until you ask us to delete it. In particular:

• Documents and the data read from them: kept for a year while you have a plan or have bought credits; for 90 days once a subscription ends; and for 30 days on a free trial. We email you before anything is deleted, so you can download what you need. You can delete any document yourself at any time.
• Documents shared on a support ticket: kept until 30 days after the ticket is last closed.
• Signed documents: documents signed through Caelum, with their audit trail, are kept for six years after signing, as a record for everyone who signed. Documents that were not signed are kept for up to a year.
• Your account: kept until you close it. See Delete your account.
• Payment records: kept as long as the law requires for tax and accounting purposes.
• On the mobile app: temporary copies made on your device (for example scans, or unlocked copies of a password-protected PDF) are kept only while they are needed and are removed when you sign out.

Even after we delete your Data, it may remain for a short time in encrypted backups until they are overwritten, or be kept where the law requires it.

Your rights

You have the following rights in relation to your Data:

• Right to access: the right to request (i) copies of the information we hold about you at any time, or (ii) that we modify, update or delete such information. If we provide you with access to the information we hold about you, we will not charge you for this, unless your request is “manifestly unfounded or excessive”. Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you the reasons why.
• Right to correct: the right to have your Data rectified if it is inaccurate or incomplete.
• Right to erase: the right to request that we delete or remove your Data from our systems.
• Right to restrict our use of your Data: the right to “block” us from using your Data or limit the way in which we can use it.
• Right to data portability: the right to request that we move, copy or transfer your Data.
• Right to object: the right to object to our use of your Data, including where we use it for our legitimate interests.

You can download your data and close your account yourself: in the Caelum dashboard, go to Account & security → Your data. In the mobile app, the same options are under Account → Privacy; some steps may complete on the web dashboard. See Delete your account for the details.

To make enquiries, exercise any of your rights, or withdraw your consent to the processing of your Data (where consent is our legal basis), contact us at privacy@caelum.ai.

If you are not satisfied with the way a complaint you make in relation to your Data is handled by us, you may be able to refer your complaint to the relevant data protection authority. For the UK, this is the Information Commissioner’s Office (ICO).

It is important that the Data we hold about you is accurate and current. Please keep us informed if your Data changes during the period for which we hold it.

Links to other websites and services

The Service may, from time to time, provide links to other websites, and relies on third-party sign-in and payment services. We have no control over such websites or services and are not responsible for their content. This privacy policy does not extend to your use of them. You are advised to read their privacy policies before using them.

Changes of business ownership and control

Mindrops UK Ltd. may, from time to time, expand or reduce our business and this may involve the sale and/or the transfer of control of all or part of Mindrops UK Ltd. Data provided by Users will, where it is relevant to any part of our business so transferred, be transferred along with that part and the new owner or newly controlling party will, under the terms of this privacy policy, be permitted to use the Data for the purposes for which it was originally supplied to us.

We may also disclose Data to a prospective purchaser of our business or any part of it.

In the above instances, we will take steps with the aim of ensuring your privacy is protected.

General

• You may not transfer any of your rights under this privacy policy to any other person. We may transfer our rights under this privacy policy where we reasonably believe your rights will not be affected.
• If any court or competent authority finds that any provision of this privacy policy (or part of any provision) is invalid, illegal or unenforceable, that provision or part-provision will, to the extent required, be deemed to be deleted, and the validity and enforceability of the other provisions of this privacy policy will not be affected.
• Unless otherwise agreed, no delay, act or omission by a party in exercising any right or remedy will be deemed a waiver of that, or any other, right or remedy.
• This privacy policy will be governed by and interpreted according to the law of England and Wales. All disputes arising under it will be subject to the exclusive jurisdiction of the English and Welsh courts.

Changes to this privacy policy

Mindrops UK Ltd. reserves the right to change this privacy policy as we may deem necessary from time to time or as may be required by law. Any changes will be posted on the Website, and shown in the Service where applicable, and you are deemed to have accepted the terms of the privacy policy on your first use of the Service following the alterations.

Contact

Address	Mindrops UK Ltd., 11-12 Hallmark Trading Centre, Fourth Way, Wembley, HA9 0LB
Privacy	privacy@caelum.ai
Support	support@caelum.ai
Phone	+44 330 350 3560

Mindrops UK Ltd. is registered in England and Wales, company number 13021417.