Privacy Policy

CDIA Technologies Ltd

Effective Date: 1 October 2026
Version: 3.1

1. Introduction

This Privacy Policy explains how CDIA Technologies Ltd (“CDIA”, “we”, “our” or “us”) collects, uses, stores and protects your personal information when you:

  • visit our website;
  • download or use the CDIA desktop application;
  • register for a free trial or subscription;
  • contact us for support or enquiries; or
  • otherwise interact with our services.

We are committed to protecting your privacy and handling your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

2. Who We Are

CDIA Technologies Ltd
Company No. 17214104

Top Pen Y Parc Farm
Halkyn
Flintshire
CH8 8DH
United Kingdom

Email: contact@cdia.co.uk

CDIA Technologies Ltd is the data controller for the personal information described in this Privacy Policy.

3. Privacy by Design

Protecting confidential project information is one of the core principles behind CDIA.

CDIA is a desktop application. Your project documents are stored on your own computer, and CDIA prepares them for investigation (text extraction, text recognition of scanned pages, indexing and evidence gathering) on your own computer.

Your project documents are never uploaded to CDIA Technologies Ltd. We operate no AI service, we do not receive your documents, your questions or the answers CDIA produces, and we cannot access, read or analyse your project documents unless you deliberately send material to us for technical support.

CDIA offers two ways to run its AI processing, and you choose between them:

  • Private AI. All AI processing runs on your own computer using a local AI runtime. No project material is transmitted to any third party.
  • Cloud AI. CDIA transmits prepared material for your question from your computer directly to a third-party AI provider, while preparing and reading material as well as when an answer, draft or analysis is generated, using an API key that you have obtained from that provider. Section 6 describes exactly what is transmitted. CDIA Technologies Ltd is not a party to that transmission and does not receive the material or the provider’s response.

With Cloud AI, transmission can occur while the application prepares and reads material for your question as well as when the answer is written. The Investigation Review takes place before the final answer is written and controls what is included in that answer; deselecting material at the Review excludes it from the answer but cannot reverse processing that has already occurred.

4. Information We Collect

Depending on how you use CDIA, we may collect the following information.

4.1 Information you provide

  • name;
  • email address;
  • company name (where provided);
  • contact form submissions;
  • support enquiries;
  • feedback; and
  • information you voluntarily send to us.

4.2 Subscription and licence information

To administer software licences we may process:

  • your email address;
  • licence identifier;
  • subscription status;
  • subscription dates;
  • limited device identification information (including a machine identifier used to prevent licence abuse); and
  • transaction references.

Payment card details are never stored or processed by CDIA Technologies Ltd. Payments are securely processed by Stripe.

Where we offer a free trial without payment details, Stripe collects your name and email address (and billing address where requested) at the start of the trial so that the trial can be linked to your licence. No payment card is requested until you choose to subscribe.

4.3 Technical information

We may also collect technical information such as:

  • operating system;
  • application version;
  • device type;
  • website usage information;
  • crash reports voluntarily submitted by you; and
  • diagnostic information required to investigate support issues.

The CDIA application does not automatically submit crash reports or telemetry to us. However, if you voluntarily provide files or logs for technical support, they may contain information relating to your project.

4.4 Requests made through LinkedIn advertising

If you ask for CDIA through a LinkedIn Lead Gen Form, LinkedIn passes us the details you submit (your first name and e-mail address) and which advert you responded to. We use them only to e-mail you the trial information you asked for, to send one reminder three days later if you have not yet registered (unless you opt out on the form or by replying), and to measure which adverts lead to trials. Legal basis: steps taken at your request and our legitimate interest in measuring our advertising. If you do not start a trial we keep the request for 12 months and then delete it; if you do, the retention periods in section 14 apply. We never sell or share these details, and we delete them on request to contact@cdia.co.uk. LinkedIn’s own processing is governed by LinkedIn’s privacy policy.

5. Information We Do Not Collect

Unless you deliberately choose to provide it to us:

  • we do not upload your project documents;
  • we do not store your project files;
  • we do not analyse your project documents on our servers;
  • we do not use your project documents to train AI models;
  • we do not receive, store or have access to any material transmitted between your computer and a third-party AI provider when you use Cloud AI, nor to the provider’s responses; and
  • we do not sell your project information.

Your project documentation remains under your control.

6. Cloud AI and Third-Party AI Providers

CDIA can perform its AI processing through a third-party AI provider (“Cloud AI”) if you choose that option. Cloud AI is offered as a choice when you first use an AI feature and can be changed at any time within the application. The provider used for Cloud AI is named in the application (currently OpenAI).

What is transmitted. When you use Cloud AI, the application transmits from your computer to the provider, both while preparing and reading material for your question and when generating an answer, draft or analysis: (a) the extracts of your project documents that CDIA has selected as evidence for that task, together with the document names and page numbers; (b) where relevant, recent questions and answers from the same investigation; and (c) your question or instruction. If you ask CDIA to analyse one particular document in depth, the text CDIA requires from that document may be transmitted for that task.

What is not transmitted. Your original document files are not transmitted. Your complete project is never transmitted automatically. Material outside your source selection is not transmitted. Material you deselect at the Investigation Review is excluded from the final answer, but deselection cannot reverse transmission that has already occurred during preparation.

Under whose account. The transmission is made using an API key that you obtain directly from the provider and that is associated with your own account with that provider. The application stores that key in the Windows credential store on your computer. CDIA Technologies Ltd never receives your key.

The provider’s role. The provider processes the transmitted material under its own terms and privacy policy for API use, as an independent controller or processor as those terms provide. CDIA Technologies Ltd does not receive, store or have access to the material transmitted or to the provider’s responses. You should review the provider’s current terms before enabling Cloud AI, in particular in relation to data retention and use.

Your responsibility. You are responsible for deciding whether Cloud AI is appropriate for a given matter, having regard to your professional, contractual and regulatory obligations. Where material must not be transmitted to a third party, use Private AI.

Private AI. If you choose Private AI, the application performs a one-time setup that downloads a free local AI runtime and an AI model to your computer. That download is made from the runtime or model provider’s servers and is subject to their terms. After setup, no project material is transmitted to any third party.

Costs. Use of Cloud AI may incur usage charges payable by you to the provider under your own account. CDIA Technologies Ltd does not bill for, receive or process those charges.

7. How We Use Your Information

We use personal information only where necessary to:

  • provide and licence the software;
  • administer subscriptions;
  • validate software licences;
  • respond to support requests;
  • improve product reliability;
  • investigate technical issues;
  • maintain website security;
  • prevent fraud and licence abuse;
  • comply with legal obligations; and
  • improve our website through analytics (where consent has been provided).

We do not use your personal information for automated decision-making that produces legal or similarly significant effects.

8. Legal Basis for Processing

PurposeLegal Basis
Providing the software and subscriptionPerformance of a contract
Licence validationPerformance of a contract and legitimate interests (preventing licence abuse)
Facilitating your chosen Cloud AI transmission (the application acting on your instruction; no data received by us)Performance of a contract
Customer supportPerformance of a contract and legitimate interests
Product improvementLegitimate interests
Website analyticsYour consent
Cookies (non-essential)Your consent
Fraud preventionLegitimate interests
Legal complianceCompliance with legal obligations

Where we rely upon legitimate interests, those interests include operating, securing and improving our software while protecting our intellectual property and preventing unauthorised use.

9. Payments

Subscription payments are securely processed by Stripe.

CDIA Technologies Ltd never receives or stores your payment card details.

Stripe acts as an independent provider of payment processing and fraud prevention services and processes your personal information in accordance with its own Privacy Policy.

10. Website Analytics and Cookies

Our website uses analytics tools including Google Analytics and Microsoft Clarity.

Microsoft Clarity may record user interactions such as mouse movements, scrolling, clicks and navigation behaviour to help us understand how visitors use our website and improve the user experience.

These services are only activated after you have given consent through our cookie banner, except where cookies are strictly necessary for the operation of the website.

Further information is available in our Cookie Policy.

11. Licence Validation

The CDIA desktop application periodically validates software licences.

When it does so, the application securely transmits:

  • your licence email address; and
  • an anonymous device identifier used to prevent licence misuse.

In response, our licensing service returns information confirming your subscription status and related licence details, which the application stores locally on your device.

Licence validation is carried out solely for administering software licences, preventing unauthorised use and supporting legitimate software operation.

Licence validation never transmits any project material, document names, questions or answers.

12. Sharing Your Information

We do not sell personal information.

Where necessary we may share information with carefully selected service providers, including:

  • Stripe;
  • website hosting providers;
  • email providers;
  • analytics providers; and
  • cloud infrastructure providers supporting our licensing services.

Each provider processes information only where necessary to perform services on our behalf or as an independent controller where applicable.

Third-party AI providers used for Cloud AI are not our service providers. Material transmitted to them goes directly from your computer under your own account and is not shared by us.

We may also disclose personal information to our professional advisers, and to regulators or other authorities where we are required to do so by law.

13. International Transfers

Some of our service providers may process personal information outside the United Kingdom.

Where this occurs, transfers are protected using appropriate safeguards recognised under UK data protection law, including (where applicable):

  • the UK Extension to the EU-US Data Privacy Framework (UK-US Data Bridge);
  • the UK International Data Transfer Agreement (IDTA);
  • the UK Addendum to the EU Standard Contractual Clauses; or
  • other lawful transfer mechanisms.

Further information regarding these safeguards is available on request.

Where you choose Cloud AI, any international transfer of the transmitted material is made by you, under your own account with the provider, and is governed by the provider’s terms. We recommend that you check where the provider processes data before enabling Cloud AI.

14. Data Retention

We retain personal information only for as long as reasonably necessary.

Typical retention periods include:

  • Subscription and licence records: for the duration of your subscription and up to six years afterwards;
  • Financial and accounting records: up to six years where required by law;
  • Support correspondence: normally up to three years after the support case is closed;
  • Website analytics: in accordance with the retention settings of the relevant analytics provider; and
  • Contact enquiries: normally up to two years.

Where information is no longer required, it is securely deleted or anonymised.

15. Security

We implement appropriate technical and organisational security measures designed to protect personal information against unauthorised access, alteration, disclosure or destruction.

Although we take reasonable precautions, no internet-connected system can guarantee absolute security.

16. Your Rights

Subject to applicable law, you may have the right to:

  • access your personal information;
  • request correction of inaccurate information;
  • request deletion of your personal information;
  • restrict or object to certain processing;
  • request transfer of your personal information where applicable; and
  • withdraw consent where processing relies upon consent.

We will normally respond within one month. We may request proof of identity before responding to certain requests.

To exercise your rights, please contact: contact@cdia.co.uk

17. Children’s Privacy

CDIA is intended for use by professionals aged 18 years or over.

We do not knowingly collect personal information from children.

18. Complaints

If you have concerns about how we handle your personal information, please contact us first so we have the opportunity to resolve the matter.

You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

19. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

Material changes will be notified to registered users where appropriate.

The latest version will always be published on our website together with the effective date shown at the top of this document.

20. Contact

If you have any questions regarding this Privacy Policy, please contact:

CDIA Technologies Ltd
Company No. 17214104

Top Pen Y Parc Farm
Halkyn
Flintshire
CH8 8DH
United Kingdom

Email: contact@cdia.co.uk