Evidence Bank

Legal

Privacy policy

What we collect, why we collect it, where it is held, and what you can ask us to do with it.

Last updated 30 September 2026

Draft, pending legal review. This describes how Evidence Bank actually works today and is written to be accurate, but it has not been reviewed by a solicitor. Have it checked before relying on it in a contract.

Who we are

Evidence Bank is operated from the United Kingdom. For the account information we hold about you, we are the data controller. For the evidence your team puts into the product, your organisation is the controller and we are a processor acting on your instructions.

What we hold

  • Account information: your name, work email address, role, and which team you belong to.
  • Content you create: evidence, insights, opportunities, bets, outcomes, boards, notes and decisions, including anything you paste in, such as an interview transcript.
  • Operational records: standard server logs held by our hosting provider, and the enquiries sent through the contact form on this site.

We do not use tracking or advertising cookies, and there is no analytics script on the product. See the cookie policy.

Personal data in your evidence

Evidence Bank is designed for observations, not personal records. Interview transcripts are the one place personal detail commonly arrives: when a transcript is processed, names and personal details are left out of the suggested evidence, but anything in the text you paste is stored as the source. Remove what should not be kept before pasting, and delete a stored transcript when it is no longer needed.

Where it is held

  • The application runs on Vercel, with server functions in London.
  • Data is stored in a PostgreSQL database hosted by Neon, in the London region.
  • Transcript processing and answers use Anthropic's API; meaning-based search uses Voyage AI. Both are configured so your content is not used to train models.

Every sub-processor is listed, with what it handles, on the sub-processors page.

How long we keep it

Your content is kept until you delete it or ask us to. If your organisation stops using Evidence Bank, we will export your data on request and delete it within 30 days of being asked. Enquiries from this website are kept for up to 24 months so we can pick up a conversation where it left off.

Your rights

Under UK GDPR you can ask for a copy of your personal data, ask us to correct it, ask us to delete it, or object to how we use it. Write to hello@chrisberridge.com and we will respond within one month. If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes

If this policy changes in a way that affects you, we will tell the admins of every team in the product before the change takes effect.