Corbiere privacy notice

Corbiere is a data subject access request (DSAR) management platform operated by Comtech Solutions Limited, a company registered in Jersey with registered number 101874 and registered office at 9 Hope Street, St Helier, Jersey (“we”, “us”, “Comtech Solutions”). You can contact us about anything in this notice at dpo@comtech-solutions.co.uk or by post to our registered office. Our data protection officer, appointed under Article 24 of the Data Protection (Jersey) Law 2018, can be contacted at the same address.

This notice is issued primarily under the Data Protection (Jersey) Law 2018 (“DPJL 2018”). Because Corbiere supports cases governed by other frameworks, and because our customers and the individuals whose data passes through the platform may be located outside Jersey, we also observe the Data Protection (Bailiwick of Guernsey) Law, 2017, the UK GDPR and Data Protection Act 2018, and the EU GDPR, whichever applies to you. References below are to the DPJL 2018 unless stated otherwise; the equivalent provisions of the other frameworks apply in parallel.

We act in two distinct capacities, and it matters which one applies to you.

If you have made a subject access request to one of our customers, or your personal data appears in documents a customer has uploaded as evidence, the customer organisation, not Comtech Solutions, is the controller of that data. Their privacy notice, not this one, governs the purposes, legal bases and retention of that processing, and your data subject rights in respect of it are exercisable against them. We will refer any rights request we receive about case content to the relevant controller without undue delay.

For full transparency, we describe here what the platform does with case content on our customers’ behalf. Case content may include any category of personal data and routinely includes special category data (such as health information), criminal offence data and legally privileged material; the platform is designed on that assumption.

• Evidence files are held in private storage accessible only to the customer organisation’s own users. The platform has no administrative role and no route by which anyone outside that organisation, including Comtech Solutions personnel, can read case content through the application.
• Text extraction and OCR of evidence run in the user’s own browser rather than being sent to an extraction service. Case content is not emailed by the platform.
• Where, and only where, a customer organisation has expressly enabled the optional AI assistance, the passage or document a reviewer is working on is sent to the AI provider that organisation’s administrator has selected, to generate a suggestion. Whole case files are never uploaded to a provider, the password vault is never included, and material already marked out of scope is not sent. Organisations that have not enabled the feature make no AI calls at all, and AI can also be switched off for a single case with a recorded reason.
• The administrator selects both the model and the region it runs in, from a fixed list of four options: Claude on Amazon Bedrock in Ireland, the direct Anthropic API in the United States, or Azure OpenAI in UK South or Sweden Central. Requests go to the selected option and to nothing else, and are never routed elsewhere for capacity or failover. Anthropic does not offer a European regional endpoint, so the direct Anthropic option is a transfer to the United States and is described as one. No broker, router or evaluation service sits between the platform and the provider. Section 6 sets out each option in full, and the AI data residency and subprocessor policy gives the detail behind it.
• We retain nothing sent to the AI layer: prompts and responses pass through to produce the suggestion and are not stored by Corbiere. What the provider itself keeps depends on the option chosen and is set out in section 6; it is not zero in every case. No option permits the provider to train a model on the content. Our records show that a request was made, by whom, against which case and on which model and region, never its content. A suggestion is only ever a suggestion; a person accepts or rejects each one, and no decision about an individual is made by the model alone.
• Where a customer organisation invites a requester, a data controller or a data processor to a secure portal, we process the contact name and email address that organisation supplies, so that the invitation and the letters selected for that recipient can be delivered. Access is granted by one-time codes sent by email, which are stored only as a hash, expire after ten minutes and are locked after five failed attempts, or by an authenticator application the recipient sets up. Each grant is limited to the case and the documents chosen for it, lasts only for the period the organisation sets, and can be withdrawn at any time.
• Use of a portal is recorded: sign-ins, the documents opened or downloaded, replies and uploads, together with the time and the recipient. These entries form part of the case audit trail, and the platform emails the case owner and the organisation’s administrators to alert them to that activity. The record exists so the controller can evidence what was sent, when it was received and by whom.
• Deletion of a case removes its associated records. Retention scheduling is operated by the customer organisation, which sets and applies its own retention periods to case content.

• Account data, collected when a customer organisation invites you as a user: your name, email address, role within the organisation and account status, together with your sign-in credentials (your password is hashed and handled by our authentication provider; we never store or log it in plain text) and, where used, second-factor and trusted-device records.
• Billing data: the billing contact’s name, email address and subscription details, collected through our payment provider, Stripe. We never receive or store card numbers.
• Platform security and usage records, including an audit trail of actions taken in the platform (who did what and when; the audit log deliberately records actions and identifiers only, never document text or case content), session records, and, where AI assistance is used, metering records limited to the model, the processing region, the user, the organisation and the timestamp, never the content of a prompt or a response.
• Correspondence you send us, such as support requests.

We process account data to create and administer your access to the platform, on the basis that the processing is necessary for the performance of, or entry into, our contract with your organisation (paragraph 2 of Schedule 2 to the DPJL 2018) and, in respect of access controls, session security and the audit trail, on the basis of our legitimate interests (paragraph 5 of Schedule 2) in keeping the platform and our customers’ cases secure, demonstrating accountability, and preventing and detecting misuse.

We process billing data because it is necessary for the performance of the contract and to comply with our legal obligations in respect of accounting and tax (paragraph 3 of Schedule 2).

We process correspondence on the basis of our legitimate interests in responding to and supporting our users. Where any processing relies on legitimate interests, we have balanced those interests against your rights and freedoms and concluded they are not overridden; you may request a copy of that assessment.

We use a small, fixed set of service providers, each acting as our processor (or, for case content, sub-processor) and each bound by contract. No other outbound transfers are made from the application. We do not sell personal data, and we do not share it with anyone else except where the law requires us to. The table below lists each provider, what it does, whether the data it handles leaves the European Union, and the transfer mechanism we rely upon; where data stays within the EU, the transfer is to an adequate jurisdiction from a Jersey perspective and no additional mechanism is required.

AI assistance is switched off unless a customer organisation turns it on. When it is on, an administrator chooses one of four fixed model-and-region combinations, and that choice decides where personal data in a request is processed and which organisation acts as our subprocessor. Nothing outside this list can be selected, so the residency position is always one of the four below.

Whichever option is selected: requests are not routed to another region for capacity, failover or load balancing; the selected provider is the only party that processes the content of a request; no broker, evaluation or analytics service sits in between; and OpenAI never receives content under the Azure options, because those models run inside Microsoft’s own tenancy, and Anthropic never receives content under the Amazon Bedrock option. Comtech Solutions staff do not read prompts or responses. Provider-side retention and any human review of flagged content are as stated against each option above, and are not the same for all four.

Only an administrator can change the model or region, and every change is recorded with the person, the time, the previous value and the new value. The full policy, including the assessment a controller should make before selecting a region, is in the AI data residency and subprocessor policy.

Our database and file storage are hosted on Supabase infrastructure provisioned through Lovable Cloud in the European Union; Jersey treats that as an adequate jurisdiction. Where personal data is transferred out of Jersey to any other jurisdiction, we do so only in accordance with Articles 66 and 67 of the DPJL 2018, that is, to a jurisdiction providing an adequate level of protection or subject to appropriate safeguards, and with the equivalent transfer provisions of the Guernsey, UK and EU frameworks where they apply. The transfer position and mechanism for each provider are set out in the table in Section 5, and for each AI option in Section 6.

The table below sets out how long we keep each category of data where we are the controller, and why.

Please note that deletion and retention of case content is controlled and operated by the customer organisation as controller: the platform provides deletion functions and records their use but does not apply an automatic retention schedule of its own. Your organisation’s own retention policy therefore governs how long case content is kept, and we delete case content within 30 days of the end of that organisation’s contract with us.

We protect personal data as required by Article 21 of the DPJL 2018. Key measures include:

• strict tenant isolation, with no administrative account or route capable of reading another organisation’s data;
• server-side verification of identity and organisation on every request;
• row-level security on all application tables;
• signed, HttpOnly session cookies with a two-stage sign-in requiring a second factor;
• encryption of all traffic in transit and of stored data at rest, with additional application-layer encryption of reviewer working material;
• private storage buckets with short-lived signed download links;
• redactions permanently burned into disclosure documents rather than overlaid; and
• an append-only, tamper-evident audit trail that records actions without recording content.

No system is perfectly secure, and we will notify the Jersey Office of the Information Commissioner and, where required, affected individuals of any personal data breach in accordance with Article 20 of the DPJL 2018 (and the equivalent duties under the other applicable frameworks).

Where Comtech Solutions is your controller, you have the right to request access to your personal data (Article 28), rectification of inaccurate data (Article 31), erasure (Article 32), restriction of processing (Article 33), and portability of data you provided to us (Article 34), and to object to processing carried out on the basis of our legitimate interests, including any direct marketing (Articles 35 and 36). We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects (Article 38).

We will respond to a request within four weeks of receiving it, extendable by up to a further eight weeks for complex requests, as provided by Article 27, and we may ask you to verify your identity before acting. Exercising these rights is free of charge except where a request is manifestly unfounded or excessive. If you are in Guernsey, the UK or the EU, the corresponding rights under your framework apply on equivalent terms.

If your data is inside a DSAR case, please direct rights requests to the organisation handling that case, as explained in Section 2.

If you are unhappy with how we have handled your personal data, please contact us first and we will try to put it right. You also have the right to complain to the Jersey Office of the Information Commissioner (jerseyoic.org) or, as applicable, to the Office of the Data Protection Authority in Guernsey, the Information Commissioner’s Office in the UK, or your EU supervisory authority.

We will update this notice when our processing changes and will notify account holders of material changes by email. This version, v1.2, was published on 17 September 2026 and replaces v1.1 of 5 September 2026; it describes the secure portals used to send letters to requesters, controllers and processors, the contact details and access codes held for those recipients, and the record kept of portal activity. Version 1.1 added the AI processing, subprocessor and data residency section and the full retention table.