What personal data Deeperer handles, why, for how long, and what you can ask us to do about it. Written under UK data protection law.
Last updated
Deeperer is operated by Lumman Ltd, registered in England and Wales (No. 15425759), 86-90 Paul Street, London, EC2A 4NE, United Kingdom. For the personal data described in clause 3 as ours, Lumman Ltd is the controller.
Lumman Ltd is registered with the Information Commissioner's Office under registration number ZC073658.
Questions, requests and complaints about privacy: in@deeperer.com, or write to the address above.
This policy covers deeperer.com, the Deeperer dashboard, the reports we publish, and the API and MCP endpoints. It applies to four groups of people: visitors to the site, account holders and the people they invite into a workspace, individuals who appear in research, and people who email us.
It does not cover our own staff and job applicants, other Lumman products, which have their own policies, or a third-party site a report links to.
UK data protection law separates the controller, who decides why and how personal data is used, from the processor, who acts on the controller's instructions.
For that second set the customer is the controller and decides what to research and what to publish. Our handling of it is governed by the Data Processing Agreement. If your personal data appears in a customer's report, that customer is the organisation to approach first; clause 14 explains what we can do directly.
| Purpose | Legal basis |
|---|---|
| Providing the service: authenticating you, running research, storing and publishing reports | Performance of our contract with you |
| Billing, tax records and refunds | Contract, and legal obligation for the records we must keep |
| Support and correspondence | Contract, and legitimate interest in answering you |
| Security, abuse and bot prevention, rate limiting, audit logging | Legitimate interest in keeping the platform safe, and legal obligation where security law applies |
| Aggregate measurement of how the site performs | Legitimate interest in a service that works, using data that does not identify you |
| Improving the service, including reviewing failures | Legitimate interest, on the least data that answers the question |
| Complying with law, and responding to a lawful request | Legal obligation |
| Sanctions and designation screening where a research request calls for it | Legitimate interest of the customer requesting the research, on data published by the designating authority |
Where we rely on legitimate interest we have weighed it against your interests and rights, and we will explain the assessment if you ask. We do not sell personal data, we run no advertising, and we do not profile you for marketing.
A run sends material to third parties, and you should know which and why:
No decision with a legal or similarly significant effect on a person is made about them by the platform alone. A report is written by software, but what anyone does with it is a human decision.
A research report can name people: a company's directors and persons of significant control from a public register, an author of a cited paper, a person quoted in a news article, a person designated on a sanctions list. Where a customer commissions that report, the customer is the controller and we process it on their instructions.
Three limits apply:
If a report about you is published on deeperer.com and you want it corrected or taken down, write to in@deeperer.com with the URL. Clause 14 explains what happens next.
A report that is public is published at a canonical URL, open to search engines, and readable over our API and MCP endpoint. What it contains is what its workspace put in and what its sources said. A report's owner chooses its visibility before the run and can change it afterwards; making it private takes down the URL and withdraws it from indexing, but we cannot clear a third party's cache or archive.
Reports published under Deeperer's own brand are ours as controller, and the same route applies for correction or removal.
We use a small number of service providers, each under contract, each acting only on our instructions, and each listed with what it does and where it processes on the Sub-processors page. That page is the list, so it stays current when a vendor changes.
Beyond them: Polar takes your payment as Merchant of Record and is a controller in its own right for the payment; and we disclose personal data where the law requires it, to establish or defend a legal claim, or to a buyer of the business, in which case we will tell you.
Some of our providers process personal data outside the United Kingdom, or reach it from outside, as the Sub-processors page records. Where they do, we rely on a transfer mechanism recognised under UK data protection law - an adequacy determination where one covers the country, or the International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, with a transfer risk assessment behind it. Ask us at in@deeperer.com for the detail on a particular provider.
| What | How long |
|---|---|
| Account and workspace data | While the account is open. Deleting your account removes it immediately. |
| Reports, versions and their citations | While the workspace keeps them. Deleted with the workspace. |
| Anonymous preview accounts never converted | 30 days, then deleted with the workspace and the draft |
| Dictated audio | Not retained by us after transcription; the transcript lives in the conversation. The transcription provider may hold the clip briefly for abuse monitoring under its own terms. |
| Archived page snapshots behind citations | While the report version that cites them exists. A snapshot no version references is collected daily. |
| Live run activity feed | Cleared when the run starts and again when it finishes |
| Billing, balance ledger and tax records | Six years from the end of the accounting period, as UK law requires |
| Audit log of compliance-relevant events | Retained as our record of who did what, beyond account closure where the law or a legal claim requires |
| Rate-limit counters and idempotency keys | Minutes to 24 hours, then they expire on their own |
| Server and security logs | Our provider's retention window, then deleted |
Where we must keep a record after you leave, we keep only that record and nothing around it.
Every tenant table is protected at the database level, so a workspace's data is reachable only by its members. There is no password to steal, because sign-in is Google or a one-time email link. API keys are stored as an irreversible hash and shown once. Traffic is encrypted in transit and data is encrypted at rest by our providers. Browser-facing writes pass a bot-detection gate, requests are rate-limited, and a firewall sits in front of the application. Staff access is least-privilege and the internal console is role-gated. Annex 2 of the Data Processing Agreement is the fuller list.
No system is beyond compromise. If a breach affects your personal data and the law requires it, we will tell you and the Information Commissioner's Office within the statutory deadlines.
Under UK data protection law you may ask for access to your personal data, correction of it, erasure, restriction of processing, portability, and you may object to processing based on legitimate interest. There is nothing to withdraw consent for, because we do not rely on consent to run the service.
For anything else, write to in@deeperer.com. We answer within one month and will tell you if a request needs longer or if an exemption applies. We may ask you to confirm who you are.
If your personal data appears in a report a customer published, the customer decides what the report says. Approach them where you can; write to us where you cannot, and we will pass the request on, act ourselves where we are the controller, and restrict or take down content while a serious complaint is examined.
Tell us first, at in@deeperer.com. We will look at it and reply. If you are not satisfied, you can complain to the Information Commissioner's Office at ico.org.uk, by telephone on 0303 123 1113, or at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. You can also seek a remedy through the courts.
Deeperer is not for children. An account holder must be at least 18. We do not knowingly collect personal data from a child, and will delete it if we learn we have.
This policy changes as the service changes. The current version always lives at this address and carries the date it was last updated. Where a change materially affects how we handle your personal data, we will tell account holders.