Privacy Policy

Last updated: 19 October 2026 · Effective: 19 October 2026

This Privacy Policy explains how Substanto Ltd, a company registered in England and Wales with company number 17447004, whose registered office is at Unit 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE (“Substanto”, “we”) collects, uses, and protects information when you use Substanto (the “Service”).

Substanto is the controller of the account, billing, usage and website data described below. Where we process content you upload to the Service on your instructions, we act as a processor on your behalf, and our Data Processing Agreement applies.

1. Information we collect

Account information: your company name, work email, and a password (stored only as a salted hash, never in plain text).
Content you upload: security questionnaires, trust documents (e.g., SOC 2 reports, security policies), and the answers you approve. We call this “Your Content.”
Usage data: basic operational data such as counts of questionnaires processed and answers generated, used for metering and to run the Service.

2. How we use your information

We use your information solely to provide and operate the Service: to authenticate you, to generate and store answers to your questionnaires, to enforce plan limits, and to process payments. We do not sell your data, and we do not use Your Content to train our own or any third party’s AI models.

2a. Our lawful bases

Under the UK and EU GDPR we rely on: performance of a contract to create your account, provide the Service, and process payments; our legitimate interests in securing the Service, preventing abuse, and understanding aggregate product usage; and your consent for any marketing communications, which you can withdraw at any time.

3. AI processing and subprocessors

To generate answers and power semantic search, Substanto sends questionnaire questions and the documents and prior answers you provide to third-party AI providers via their APIs. Through each provider's terms or our account settings, your inputs and outputs are not used to train their models (see §3a for the detail per provider). We share only what each feature needs to deliver the Service to you.

The current list of subprocessors, with each one's legal entity, country, purpose, and the data shared, is maintained on our Subprocessors page. We keep a data processing agreement in place with each subprocessor.

3a. Where your data is processed

Database (where Your Content is stored). Your account data and the content you upload (questionnaires, policies, and answers) are stored in the European Union (Ireland), on Supabase (region eu-west-1).

Application and frontend. Our application server runs on Render in the United States (Oregon), and our website and app frontend are served by Vercel (United States). Your Content is transmitted to and processed by the application server to operate the Service, but is stored in the EU as described above.

AI processing. Substanto uses two AI subprocessors, both processing in the United States:

Anthropic (answer drafting). When an answer is drafted, we send the question text and the short document and answer excerpts relevant to that question. Anthropic does not train its models on API inputs or outputs, and deletes API inputs and outputs within 30 days (longer only if flagged for a usage-policy breach or if required by law).
Voyage AI (semantic search). When you upload a document, its full text is split into chunks and sent to Voyage to create the embeddings that power semantic search across your content. We have opted out of Voyage using our data to train its models.

4. Data retention and deletion

We retain Your Content for as long as your account is active so the Service can reuse your approved answers. You can delete documents in the app at any time, and deletion takes effect immediately in our database. When you close your account in Settings, we immediately delete your account, Your Content and your security log (sign-ins, IP addresses and browser details), and remove your account from our product analytics so what remains is anonymous counts. Our encrypted weekly backups are deleted after 28 days, so we delete or anonymise your personal data within 30 days of account closure, except where retention is required by law. To request deletion, contact us at privacy@substanto.com.

5. How we protect your data

Passwords and API tokens are stored as hashes, never in plain text.
Data is encrypted in transit (TLS) and at rest.
Access to the Service is scoped to your organization; your content is used only to answer your own questionnaires.
We apply rate limiting and other safeguards against abuse.

6. Your rights

Depending on your location (e.g., under the UK or EU GDPR, or CCPA), you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. To exercise these rights, contact privacy@substanto.com. If we process personal data on your behalf as a processor, we will support your obligations to your own customers, including via a Data Processing Agreement on request.

If you are in the UK, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority, at ico.org.uk. If you are in the EU, you may complain to your local data protection authority.

7. Cookies and local storage

The app stores an authentication token in your browser’s local storage to keep you signed in. We do not use third-party advertising or tracking cookies. For website analytics we use Vercel Web Analytics, a cookieless service that collects only aggregate usage such as page views and referrers (no cookies and no personal data); see our Subprocessors page.

8. International transfers

Your Content is stored in the EU (Ireland). Operating the Service also involves transfers to the United States, where our application server (Render) and our AI subprocessors (Anthropic and Voyage AI) process data (see §3a). Where personal data is transferred out of the UK or EEA, we rely on the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum (or the UK IDTA where it applies standalone).

9. Children

The Service is not directed to individuals under 18, and we do not knowingly collect their data.

10. Changes to this policy

We may update this policy; material changes will be posted here with a new “Last updated” date.

11. Contact

Privacy questions or requests: privacy@substanto.com. General enquiries: hello@substanto.com.

ICO registration number: ZC243069.

← Back to Substanto

Substanto Ltd. Registered in England and Wales, company number 17447004. Registered office: Unit 82a James Carter Road, Mildenhall, Bury St Edmunds, IP28 7DE.

Version 2.2, 10 October 2026. Supersedes the version dated 4 October 2026.