Data retention policy
Wordsmith's data retention policy is to retain personal data for no longer than necessary, with specific retention periods depending on the type of data and the purposes for which it is used. The policy includes the following key points:
1. Basic information about customers, such as Identity, Contact, Financial and Payment Data, and Business Information, is kept for six years after they cease being customers, as required by law.
2. Personal data is retained while products and/or services are being provided and thereafter as needed to address any questions, complaints, or claims, to demonstrate fair treatment, and to comply with legal record-keeping obligations.
3. Upon termination or expiry of a Master Agreement, Wordsmith will securely delete or destroy the personal data in its possession or control, unless directed otherwise by the customer.
4. A draft Data Processing Agreement (DPA) indicates that personal data is retained for up to 90 days or earlier upon request.
Personal information is destroyed in accordance with applicable laws and regulations when it is no longer necessary to retain it. For further details on the mechanisms used when transferring personal information out of the UK or the EEA, or for any other inquiries regarding data retention, employees or customers may contact Wordsmith.
Data archiving and removal policy
Wordsmith's data archival and removal policy is designed to retain personal data for as long as necessary to fulfill service obligations, comply with legal requirements, and address any related inquiries. The company commits to not holding onto personal data for longer than necessary. Specific policies include:
1. Retaining personal data for varying periods depending on the type of data and its use, ensuring it is kept only while products and/or services are being provided and thereafter as needed for compliance and addressing questions, complaints, or claims.
2. By law, certain basic customer information is retained for six years after they cease being customers.
3. Upon termination or expiry of a Master Agreement, Wordsmith will securely delete or destroy, or if directed, return and not retain any of the Personal Data related to the agreement in its possession or control.
4. A general retention period of personal data for up to 90 days or earlier upon request is also mentioned in the company's Data Processing Agreement draft.
The company ensures that when it is no longer necessary to retain personal information, it will be securely destroyed in accordance with applicable laws and regulations.
Data storage policy
Wordsmith's data storage policy encompasses several key aspects:
1. Retention Periods: Personal data is retained for varying periods depending on the type of data and the purposes for which it is used. The company does not hold onto personal data for longer than necessary and ensures that personal data is kept while products and/or services are being provided and thereafter as needed for legal compliance.
2. Security Measures: Wordsmith has implemented a range of technical, organizational, and physical measures to ensure the security of personal data. This includes encryption of data in transit and at rest, pseudonymization, and regular testing and evaluation of security measures.
3. Data Destruction: When personal information is no longer necessary to retain, Wordsmith securely destroys it in accordance with applicable laws and regulations. Certain types of information are kept for six years after customers cease being customers.
4. Data Transfer: The company does not transfer personal data outside of the EEA, ensuring compliance with data protection laws.
5. Encryption Standards: Data at rest is encrypted using AES-256, and the company adheres to NIST recommended standards for database encryption and password storage. Backup copies are also encrypted within the AWS environment.
6. Record Keeping: Wordsmith maintains accurate, complete, and relevant records of personal data through data minimization, regular data auditing, user consent, and transparency. Detailed records regarding the processing of personal data are kept and reviewed annually.
7. Compliance: The company's policies and procedures for data storage and handling are reviewed annually to ensure compliance with data protection legislation and the company's information and security policies.
Data center location(s)
United Kingdom
Data hosting details
The data is hosted in cloud (AWS), located in EU datacenter.
Data hosting company
Amazon (AWS)
App/service has sub-processors
yes
Guidelines for sub-processors
App/service uses large language models (LLM)
yes
LLM model(s) used
Claude 4 Sonnet
LLM retention settings
Zero data retention.
LLM data tenancy policy
Zero data retention policy, the model is served via AWS Bedrock from EU datacenter.
LLM data residency policy
Zero data retention policy, the model is served via AWS Bedrock from EU datacenter.