C8 Index Technologies (EU) Limited, trading as C8 Technologies (“C8”, “we”, “us”), is the data controller for the personal data described in this notice.
This notice covers C8 Allocator Agent, including the agent in Microsoft Teams and Microsoft 365 Copilot, its connections to other AI assistants (such as Claude and ChatGPT), its APIs, and the c8-technologies.com website.
Account and identity data — your email address, name as supplied when you subscribe, a C8 account identifier, role and account status. Used to create and administer your subscription and to authenticate you. Legal basis: performance of our contract with you.
Uploaded series and inputs — return or NAV series you upload through a one-time upload link or paste into a request, and the weights, holdings, constraints and instrument names you give. They are used only to produce the answers you ask for. Legal basis: performance of contract.
Sign-in data — where you connect through Claude, ChatGPT or another assistant that uses C8 sign-in, one-time sign-in codes are generated. Codes are stored only as a salted hash, expire after 10 minutes and are deleted on use. We record sign-in events and the time of your last sign-in. Legal basis: performance of contract, and our legitimate interest in securing accounts.
Subscription and billing data — your subscription identifiers, plan, subscription status and renewal dates. Where you subscribe through C8’s checkout, payments are handled by Stripe; where you subscribe through the Microsoft commercial marketplace, Microsoft bills you. Payment card details are never stored by C8. Legal basis: performance of contract, and compliance with accounting obligations.
Terms-acceptance records — the Terms version you accepted, a record of the exact document shown to you and the time of acceptance, kept as evidence that the agreement was formed. Legal basis: our legitimate interest in a reliable record of contract formation, and compliance with legal obligations.
Results and jobs — uploaded datasets, construction results (weights and the statistics computed from them) and backtest job records are kept for 24 hours so that follow-up questions work, and are then deleted automatically. Holdings quantities and portfolio values are never stored. This data should not identify your clients: please do not include client names or other personal details in a dataset or request. Legal basis: performance of contract.
Shared evaluation and connector access — where the agent is used through Microsoft Teams or Microsoft 365 Copilot, requests run under the C8 account that operates the connector for your organisation, and results are kept apart from other users’ only by random identifiers that are shown to the person who created them. Where you connect with your own C8 sign-in (for example from Claude or ChatGPT), your data is kept under your own account.
Conversation data in Microsoft Teams and Microsoft 365 Copilot — the agent runs on Microsoft Copilot Studio. Your messages to the agent and its replies are processed by Microsoft, and Copilot Studio keeps conversation transcripts, which C8 can access for support, quality and security purposes and keeps for up to 30 days. Legal basis: our legitimate interests in operating, supporting and securing the service.
Connection and authorisation data — records of the AI assistants or applications you connect, and the access and refresh tokens issued to them. Legal basis: performance of contract.
Usage data — for each request: your account and user identifier, the tool used, the channel, response status, duration and timestamp. Used for support, billing accuracy, security monitoring and detecting misuse such as credential sharing. Retained for 90 days. Legal basis: our legitimate interests in operating, securing and improving the service.
Support correspondence — the content of any support enquiry you send us and our replies. Legal basis: performance of contract.
Marketplace data — where you subscribe through the Microsoft commercial marketplace, we receive your tenant identifier, purchaser email and plan details from Microsoft. Legal basis: performance of contract.
Website data — c8-technologies.com sets no cookies and carries no analytics.
When you name instruments instead of providing your own series, we request their price histories from a third-party market-data provider. Those requests contain only instrument identifiers, such as ticker symbols or fund names, and no personal data.
We do not sell personal data, and we do not use customer content to train artificial-intelligence models.
You may use Allocator Agent in Microsoft Teams and Microsoft 365 Copilot, or connect it to other AI platforms such as Claude (Anthropic) or ChatGPT (OpenAI). When you do:
You can remove the agent or disconnect at any time from within the platform, or ask us to revoke the connection.
We share personal data only with providers acting on our instructions:
We may also disclose data where required by law, regulation or a competent authority, or to establish, exercise or defend legal claims.
C8 is established in Ireland. As at the date of this notice, the data described above is processed in the following locations:
| Data | Processed in |
|---|---|
| Account, user, sign-in, terms-acceptance and usage records | United Kingdom (Azure UK South; backups replicated to UK West) |
| Uploaded series, results and job records (deleted after 24 hours) | United Kingdom (Azure UK South) |
| Portfolio-construction engine | United Kingdom (Azure UK South) |
| Allocator Agent application servers and API gateway | United Kingdom (Azure UK South) |
| Agent conversations and transcripts in Microsoft Teams and Microsoft 365 Copilot | European Union (Microsoft Copilot Studio, Europe geography) |
| Subscription and provisioning service | Ireland (Azure North Europe) |
| Sign-in code email delivery | European Union (Azure Communication Services, data location Europe) |
| c8-technologies.com website | European Union (Azure West Europe) |
We do not host your account data in the United States.
Transfers from Ireland to the United Kingdom are made on the basis of the European Commission’s adequacy decision for the United Kingdom. Some of our providers are US-headquartered and may access data from outside the EEA for support and administration; where that happens we rely on the European Commission’s Standard Contractual Clauses together with the provider’s supplementary safeguards.
Stripe processes payment data under its own privacy policy and transfers data to the United States. The Microsoft commercial marketplace also involves processing outside the EEA.
Where the GDPR applies you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on consent. To exercise these rights, contact support@c8-technologies.com; we will respond within the statutory period.
You may also complain to the Irish Data Protection Commission (www.dataprotection.ie) or to your local supervisory authority.
We protect your data with encryption in transit, short-lived and revocable access tokens, hashed sign-in codes, access controls and monitoring. No system is perfectly secure, but we will notify you and the relevant authority of a personal-data breach where the law requires it.
The service is intended for financial professionals. It is not directed at children and we do not knowingly collect data from anyone under 16.
We may update this notice. The current version is always published at https://c8-technologies.com/allocator_privacy.html with its “last updated” date. Material changes will be notified to subscribers by email or by in-service notice.