Privacy policy
This policy explains what personal data Consul and ConsulR (together, “Consul”) collect, why, who processes it for us, where it is stored and how long it is kept. Consul is operated by Daertho Ltd, a company registered in Cyprus (“we”, “us”). Questions or requests: [email protected].
1. Our role
For your account and your use of Consul we are the controller. For the information you put into your workspace about your own clients, their customers or candidates (for example names you screen, documents you upload or CVs), you are the controller and we act as your processor, only on your instructions. A data processing agreement is available on request.
2. What we collect
- Account details: your name, firm name, email address and a salted hash of your password. If you sign in with Google we receive only your name, email address and whether Google has verified it — nothing else from your Google account.
- Workspace content: what you add — engagements, clients, documents, notes, agents and their outputs, screening subjects and results, leads and contacts, and for ConsulR roles, candidates and CVs.
- Identity checks (face verify): a photo of the person’s ID document, a live selfie and short videos, taken only with that person’s consent.
- Usage data: which screens are opened, which buttons are clicked and which features run. Never what anyone types.
- Technical data: IP address, browser type and security logs, used to keep the service secure.
3. Why we use it
| Purpose | Legal basis |
|---|---|
| Providing Consul: your account, workspace, checks, agents and emails about your account (sign-up confirmation, password reset) | Performing our contract with you |
| Keeping AML check records so you can meet your record-keeping obligations | Your legal obligation, and our legitimate interest in supporting it |
| Security, fraud prevention and abuse detection | Legitimate interest |
| Understanding how the product is used, to improve it | Legitimate interest |
| Identity checks on a person you are checking | That person’s explicit consent, given in the check itself |
We do not sell personal data, do not use it for advertising, and do not use your workspace content to train AI models.
4. Where it is stored
Consul is stored on a dedicated server we control in Helsinki, Finland (EU). Each firm is its own isolated tenant: every record is tagged to its firm and every request is walled to it. Encrypted backups are kept off-site so the service can be restored.
5. Who processes data for us
Some features need outside services. They receive only what the feature needs, under contract, and may process it outside the EU (for example in the United States) under appropriate safeguards such as the EU Standard Contractual Clauses.
| Service | What for | What it receives |
|---|---|---|
| Cloudflare | Delivering the site securely, blocking attacks and bots | Network traffic, IP address |
| Google sign-in (if you choose it) and delivering our emails | Your name and email; the emails we send you | |
| Anthropic | The AI model behind agents, document reading, adverse-media review and drafting | The text a feature works on at that moment. Under Anthropic’s commercial terms it is not used to train their models. |
| Web search providers | Adverse-media searches and finding new leads | The names and search terms involved |
| Contact-data providers | Finding business contact details when you ask for them | The person’s name and company |
6. How long we keep it
| Your account and workspace | While your account is open |
| AML check records (screening, adverse media, ID checks) | 5 years from the later of the check and the end of its engagement, then deleted |
| A closed firm’s records | Locked and kept 5 years from closure, then deleted |
| Selfies and videos from ID checks | Deleted within 24 hours; the ID photo and the result are kept as the AML record |
| Usage data | 180 days |
| Security logs | As long as needed to protect the service |
7. Your rights
You can ask to access, correct, delete or export your personal data, or object to or restrict how we use it. Email [email protected] and we will answer within one month. Some records must be kept for the AML retention period above; we will tell you if that applies. You can also complain to your data protection authority.
8. Cookies and browser storage
We use only what the service needs: a sign-in cookie, a cookie that remembers which app (Consul or ConsulR) you use, and, if you arrived through an invitation, an invitation cookie. Your browser also stores a few preferences, such as your display currency and theme. Cloudflare may set security cookies. We use no advertising or third-party tracking cookies.
9. Changes
We will update this page when what we do changes, and tell account holders about material changes by email.