1. Who is responsible and how to contact us
The UK-registered operator of Borage is responsible for personal information it uses to operate the platform. Its full legal name, registered address and final privacy contact details must be added before live commercial use. This is a proof-of-concept notice and does not certify that every launch compliance requirement has been completed.
For this POC, send a privacy question or request to projects@support.useborage.com. Describe the information or project involved and the action you want. You do not need to include your password, full payment credentials or identity documents in that first message. We may need proportionate identity checks before disclosing information or acting on a request.
2. Information used by the service
Account information includes names, email addresses, professional profile details and access verification records. If you act for an organisation, your business contact information can still be personal information. Sources include what you provide, project participants, authorised administrators and the configured authentication provider.
Project information includes briefs, uploaded materials, proposals, questions, replies, input requests, delivery files, correction requests, acceptance decisions and agreement records. Information created by the workflow includes AI-assisted drafts, assessments and review notes, and records linking a decision to its source material.
Operational information includes role-specific sessions, access-link and verification records, workflow events, notification delivery status and limited payment references and status. Agreement receipts include the identified actor, time, exact proposal and terms version and document content connected to an explicit browser confirmation.
Stripe receives card, identity and payout information directly through its own forms. Borage uses relevant provider references and status to manage funding and transfers. Do not put complete card numbers, bank credentials, passwords or unrelated sensitive information into project text or files.
3. Why information is used
Information needed to open your requested workspace, coordinate the project, share approved materials, support delivery review and manage payment status is used to provide the requested services and perform the relevant agreements. For business representatives, some coordination may instead rely on appropriate legitimate interests in operating the requested business service.
Relevant records are also used for account security, misuse prevention, support, dispute review and service reliability on the basis of legitimate interests where appropriate. Information required for accounting, legal obligations or an authorised regulatory request is processed on the applicable legal basis.
Acknowledging this notice does not provide blanket consent for unrelated advertising, optional analytics or every future use of personal information. An optional consent-based purpose must be explained separately, with a meaningful choice where required. A new purpose must be assessed before it is introduced.
These are the draft purposes and bases for the POC. Before live use, the operator must confirm which bases apply to the actual participant model and each processing activity. The notice and operational practices must agree; a paragraph in a notice cannot make a different practice lawful.
4. Who can receive project information
At brief approval, buyers review the sharing boundary for project materials. Invited professionals receive the information needed to assess their opportunity within that approved boundary. Buyers and professionals see records needed for their own work. Authorised administrators can access relevant records to operate the service and handle support or exceptions.
Configured providers support hosting, email, authentication, AI-assisted processing and payments. Depending on configuration, these include Resend, OpenAI, Clerk and Stripe. Providers receive information needed for the task they perform; their own roles and applicable terms must be considered in the actual deployment.
Project text and files needed for an AI task may be processed by the configured AI provider. Email providers process the information needed to deliver a notification, and authentication and payment providers process information relevant to their respective services. Do not assume that a project file is reviewed only locally or only by a person.
Legal obligations or a properly authorised request may require disclosure. Unrelated marketing uses and any activity that qualifies as sale or sharing under applicable US privacy law need their own assessment and disclosures. This POC notice does not claim a completed sale-or-sharing assessment for a future commercial deployment.
5. AI assistance and human control
AI helps structure briefs, compare profile evidence, prepare proposals, interpret replies and review delivery evidence. Outputs and inferences can be personal information when they relate to an identifiable person. AI can make mistakes, and its score or explanation is not a guaranteed statement about someone’s ability or conduct.
Some ranking, routing and selection steps can run automatically within configured rules. The buyer approves the brief, final agreement and delivered work; the professional confirms their own proposal. Administrators handle exceptions and can pause affected steps. This is the practical meaning of human in the loop, rather than a promise that an administrator reads every automated output.
If an AI-assisted output appears inaccurate or a decision is unclear, identify the relevant project and evidence through the issue or project-desk route. A person can review the concern using the available records. Where applicable law provides additional rights concerning profiling or automated decisions, those rights are preserved.
6. Access protection and incident concerns
The current workspace restricts access by role, project ownership and the authorised scope of a task link. Email verification links expire and work once. Sessions can be revoked, including by signing out. Session cookies are configured to limit access by page scripts and unrelated sites, with secure transport protection when the service is deployed over HTTPS.
Private task pages use browser protections intended to limit caching, referral of private URLs and embedding in another site. Relevant action routes check the origin of submissions. File uploads have permitted-type and size limits, while payment confirmations have signature and transaction checks. These are specific safeguards rather than a guarantee of complete security.
Do not forward private access or review links. Use a secure email account, sign out on shared devices and report unexpected access or suspicious files to the project desk. File-type restrictions do not establish that every upload has been malware-scanned. The POC does not claim an independent security certification or universal malware protection.
The operator must complete deployment-specific access administration, monitoring, backup and incident-response arrangements before live use. A suspected incident requires assessment of affected information, appropriate containment and any notices required by applicable law. No system can promise that information will never be lost, misused or disclosed.
7. Processing across borders
A UK operator can use providers or work with participants in other countries. Information may therefore be processed outside your country, depending on provider locations, hosting and the project participants. Those locations may have different privacy rules.
Before live commercial use, the operator must confirm provider locations, contracts and any required safeguards for restricted international transfers. The appropriate mechanism depends on the actual data flow and applicable law. Accepting the platform terms is not itself a substitute for those safeguards.
US participants may have federal or state protections in addition to this notice. Being based in the UK does not automatically remove those obligations. The governing-law clause in the Terms of Use does not require anyone to waive privacy rights that applicable law makes mandatory.
8. Retention, deletion and cookies
Information is kept for the active service and for the periods needed for applicable accounting, security and dispute obligations. The operator must finalise a documented retention schedule before live launch, including the treatment of uploaded files, agreement receipts, messages, operational records and backups.
A deletion request may not remove information that must lawfully be retained or is needed for a permitted unresolved obligation. The operator should explain the relevant reason and limits when responding. Keeping an agreement history does not justify retaining every unrelated personal detail indefinitely.
The workspace uses essential access and session cookies for security and continuity. Optional analytics or marketing technologies need their own disclosures and, where required, choices before use. The operator must assess any applicable browser preference signals and opt-out requirements before introducing processing that requires them.
9. Your requests and local rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or an objection to relevant processing. Rights can have exceptions and conditions. Contact the privacy address with your request; the operator may need proportionate verification and should explain the applicable response or reason for a lawful limitation.
For US residents, applicable state law may also provide rights to know the categories and sources of information, correct or delete it, obtain a copy, opt out of particular sale, sharing, targeted advertising or profiling activities, limit certain sensitive-information uses, or appeal a denied request. These rights depend on the state, the business and the processing involved; this draft does not assert that every state statute applies to the POC.
California rights, where the California Consumer Privacy Act applies, cannot be waived through a platform agreement. A legitimate exercise of an applicable privacy right must not be punished. Other mandatory local protections remain available regardless of the governing-law choice.
You may contact the UK Information Commissioner’s Office at ico.org.uk or the competent authority in your jurisdiction where appropriate. Asking the project desk for help does not remove an available complaint route. The operator must establish the actual request, appeal and response processes needed for a commercial launch.