Privacy Policy

MiningCopilot is a document Q&A service operated by Gisande Group, SAS (RCS 104 607 379 R.C.S. Rouen; EUID FR7608.104607379), registered office Domaine du Cailly, 76230 Quincampoix, France. For any privacy question or to reach our data protection contact, email contact@miningcopilot.eu.

For the documents a customer uploads, the customer organization is the data controller and we act as its processor, processing that content only to provide the service and on the customer’s documented instructions (set out in the Data Processing Agreement).

For account and authentication data (your email, sign-in identifiers, organization membership), we are the controller.

Account data: email, authentication identifiers, and organization membership.

Customer content: the documents you upload and any personal data they contain, the text chunks and vector embeddings derived from them, and the questions you ask.

Operational data: rate-limit and spend counters, ingestion job metadata, and answer-quality telemetry (outcomes and citation counts) — keyed by identifiers only, never document content.

An append-only audit log of security-relevant actions (action, actor, target, timestamp) — no document content.

To provide, secure and maintain the service (performance of our contract). To prevent abuse, enforce usage limits and keep the service available and safe (our legitimate interests, balanced against your rights).

We do not use your documents to train any AI model — not ours, and not any provider’s.

We use a small set of sub-processors to run the service: Supabase (hosting, database, authentication, storage), Vercel (application hosting, plus cookieless audience measurement via Web Analytics and Speed Insights), Anthropic (answer generation and OCR), OpenAI (embeddings), and Upstash (rate/spend counters and the job queue). Each is bound by data-protection terms equivalent to ours. The current list, with roles and regions, is available on request and forms part of the DPA; we give notice of material changes.

Data residency is configurable per customer and stated in each customer’s DPA — it is not a blanket product-wide guarantee. What is configurable, and what is not, stated precisely: hosting and document storage can be placed in the EU (Supabase and Vercel regions), and embedding generation can be routed to an EU endpoint. Answer generation and OCR run on Anthropic’s API, which does not currently offer a European processing region — those calls are processed outside the EEA, and we do not claim otherwise. For them we rely on zero data retention under an account-level agreement, so no prompt or document content is retained by that provider. Every transfer outside the EEA is covered by appropriate safeguards (e.g. Standard Contractual Clauses).

Documents and their derived data are kept until you delete the document or erase your organization. Account data is kept for the life of the account. Operational counters expire within about two days and answer-quality telemetry within about 35 days. Audit records are kept for the life of the organization. Deletion and erasure remove the stored files, all derived data, and (on account erasure) the account and email.

Subject to applicable law you may request access, rectification, erasure, restriction, portability, and objection. You can erase your organization and account yourself in Settings → Data & privacy, or contact contact@miningcopilot.eu for any request, a data export, or a copy of our DPA. You may also lodge a complaint with your supervisory authority.

Every organization’s data is isolated from every other’s at the database level (row-level security), verified continuously. Files are stored privately and served only through short-lived, authorized links. Data is encrypted in transit. Our logging is designed never to record document content.

The public website sets no cookies at all. Nothing is stored on your device until you sign in, and we use no advertising cookies, no third-party tracking cookies, and no cross-site trackers.

Once you sign in, we store only what the workspace needs to function: your authentication session, which organization you are working in, and a few interface preferences. All of it is strictly necessary for the service you asked for, which is why no consent banner is required under the ePrivacy Directive — but you are entitled to know exactly what is stored, so it is listed below.

Audience measurement uses Vercel Web Analytics and Speed Insights, which are cookieless: they set nothing on your device and build no cross-site profile.

We may update this policy; material changes will be notified. Questions or requests: contact@miningcopilot.eu.