Privacy Policy
Last updated: October 2026. Draft, pending legal review.
This privacy policy (previously our data policy) describes how Cairn River Ltd ("Cairn River", "we") handles personal data when you visit this website or use the Cairn product. We are the data controller for personal data we collect directly. Where you use Cairn to record information about your own customers or counterparties, you are the data controller and we act as a processor on your behalf.
What we collect
- Account details you provide when signing up: name, work email, organisation name.
- Billing details processed by our payment provider. We do not store full card numbers ourselves.
- Product telemetry: pages and features used, error reports, and aggregate performance metrics. No content of your records is included in telemetry.
- Support correspondence: anything you send us by email or in-app messages.
- Website visits: as with any website, each request to this site carries your IP address, browser details and approximate location. If you accept analytics in the cookie banner, aggregate page views and performance figures are also recorded.
Why we use it
- To provide and operate the Cairn service.
- To bill for the service and meet our own tax and accounting obligations.
- To respond to support requests and to investigate issues you report.
- To understand, in aggregate, how the product is used so we can improve it.
- To serve this website, keep it secure, and understand in aggregate how it is used.
Where it's stored
Customer data is stored in the United Kingdom. We use a small number of sub-processors for hosting, error monitoring, email delivery, and payments. The current list is available on request.
This website is hosted by Cloudflare, Inc., which also provides our DNS and, if you accept analytics, our website analytics. Cloudflare processes your IP address and request details to serve and protect the site, and keeps logs of requests for the site's video files for up to 3 days. Cloudflare runs a global network, so this data may be processed outside the United Kingdom.
How long we keep it
We keep account and record data for as long as your subscription is active. On termination, we retain it for a defined wind-down period to allow for export and then delete or anonymise it. Backups are rotated on a published schedule.
Your rights
Under UK GDPR you have the right to access, correct, export, or request deletion of your personal data, and to complain to the Information Commissioner's Office.
Contact
For any data-protection question, write to hello@cairnriver.io.