C8 Index Technologies (EU) Limited, trading as C8 Technologies (“C8”, “we”, “us”), is the data controller for the personal data described in this notice.
This notice covers C8 Adviser Agent, including the agent in Microsoft Teams and Microsoft 365 Copilot, its connections to other AI assistants (such as Claude and ChatGPT), its APIs, and the c8-technologies.com website.
Account and identity data — your email address, name as supplied when you subscribe, a C8 account identifier, role and account status. Used to create and administer your subscription and to authenticate you. Legal basis: performance of our contract with you.
Research-engine user record — to give you access to C8 Research, we create a user record in C8’s research engine holding your email address and C8 account identifier. Legal basis: performance of contract.
Sign-in data — where you connect through Claude, ChatGPT or another assistant that uses C8 sign-in, one-time sign-in codes are generated. Codes are stored only as a salted hash, expire after 10 minutes and are deleted on use. We record sign-in events and the time of your last sign-in. Legal basis: performance of contract, and our legitimate interest in securing accounts.
Subscription and billing data — your subscription identifiers, plan, subscription status and renewal dates. Where you subscribe through C8’s checkout, payments are handled by Stripe; where you subscribe through the Microsoft commercial marketplace, Microsoft bills you. Payment card details are never stored by C8. Legal basis: performance of contract, and compliance with accounting obligations.
Terms-acceptance records — the Terms version you accepted, a record of the exact document shown to you and the time of acceptance, kept as evidence that the agreement was formed. Legal basis: our legitimate interest in a reliable record of contract formation, and compliance with legal obligations.
Portfolio data — holdings you type into a request to analyse or rebalance a portfolio (for example “100 SPY and 200 AGG”) are processed in memory to produce that answer and are not stored. The agent does not save portfolios: to analyse a portfolio again, type its holdings again. Portfolio data should not identify your clients: please do not include client names or other personal details in a portfolio. Legal basis: performance of contract.
Conversation data in Microsoft Teams and Microsoft 365 Copilot — the agent runs on Microsoft Copilot Studio. Your messages to the agent and its replies are processed by Microsoft, and Copilot Studio keeps conversation transcripts, which C8 can access for support, quality and security purposes and keeps for up to 30 days. Legal basis: our legitimate interests in operating, supporting and securing the service.
Connection and authorisation data — records of the AI assistants or applications you connect, and the access and refresh tokens issued to them. Legal basis: performance of contract.
Usage data — for each request: your account and user identifier, the tool used, the channel, response status, duration and timestamp. Used for support, billing accuracy, security monitoring and detecting misuse such as credential sharing. Retained for 90 days. Legal basis: our legitimate interests in operating, securing and improving the service.
Support correspondence — the content of any support enquiry you send us and our replies. Legal basis: performance of contract.
Marketplace data — where you subscribe through the Microsoft commercial marketplace, we receive your tenant identifier, purchaser email and plan details from Microsoft. Legal basis: performance of contract.
Website data — c8-technologies.com sets no cookies and carries no analytics.
To price instruments we request market data from a third-party market-data provider. Those requests contain only instrument identifiers, such as ticker symbols, and no personal data.
We do not sell personal data, and we do not use customer content to train artificial-intelligence models.
You may use Adviser Agent in Microsoft Teams and Microsoft 365 Copilot, or connect it to other AI platforms such as Claude (Anthropic) or ChatGPT (OpenAI). When you do:
You can remove the agent or disconnect at any time from within the platform, or ask us to revoke the connection.
We share personal data only with providers acting on our instructions:
We may also disclose data where required by law, regulation or a competent authority, or to establish, exercise or defend legal claims.
C8 is established in Ireland. As at the date of this notice, the data described above is processed in the following locations:
| Data | Processed in |
|---|---|
| Account, user, sign-in, terms-acceptance and usage records | United Kingdom (Azure UK South; backups replicated to UK West) |
| Research engine and its user records | United Kingdom (Azure UK South) |
| Adviser Agent application servers and API gateway | United Kingdom (Azure UK South) |
| Agent conversations and transcripts in Microsoft Teams and Microsoft 365 Copilot | European Union (Microsoft Copilot Studio, Europe geography) |
| Subscription and provisioning service | Ireland (Azure North Europe) |
| Sign-in code email delivery | European Union (Azure Communication Services, data location Europe) |
| c8-technologies.com website | European Union (Azure West Europe) |
We do not host your account data in the United States.
Transfers from Ireland to the United Kingdom are made on the basis of the European Commission’s adequacy decision for the United Kingdom. Some of our providers are US-headquartered and may access data from outside the EEA for support and administration; where that happens we rely on the European Commission’s Standard Contractual Clauses together with the provider’s supplementary safeguards.
Stripe processes payment data under its own privacy policy and transfers data to the United States. The Microsoft commercial marketplace also involves processing outside the EEA.
Where the GDPR applies you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on consent. To exercise these rights, contact support@c8-technologies.com; we will respond within the statutory period.
You may also complain to the Irish Data Protection Commission (www.dataprotection.ie) or to your local supervisory authority.
We protect your data with encryption in transit, short-lived and revocable access tokens, hashed sign-in codes, access controls and monitoring. No system is perfectly secure, but we will notify you and the relevant authority of a personal-data breach where the law requires it.
The service is intended for financial professionals. It is not directed at children and we do not knowingly collect data from anyone under 16.
We may update this notice. The current version is always published at https://c8-technologies.com/adviser_privacy.html with its “last updated” date. Material changes will be notified to subscribers by email or by in-service notice.