C8 Index Technologies (EU) Limited, trading as C8 Technologies (“C8”, “we”, “us”), is the data controller for the personal data described in this notice.
This notice covers the C8 Model Assurance library (“Model Assurance”), C8’s library of rules-based indices rebuilt from their public rulebooks, including its connections to AI assistants such as Claude and ChatGPT, its APIs, and the c8-technologies.com website.
Account and identity data — your email address, name as supplied when you subscribe, a C8 account identifier, role and account status. Used to create and administer your access and to authenticate you. Legal basis: performance of our contract with you.
What you ask the library — the index you ask about, a date window, a weight or a report section. These are used only to produce the answer and are not stored. Model Assurance never receives a portfolio, holdings or client data, and no tool stores or changes anything. Legal basis: performance of contract.
Sign-in data — where you connect through Claude, ChatGPT or another assistant that uses C8 sign-in, one-time sign-in codes are generated. Codes are stored only as a salted hash, expire after 10 minutes and are deleted on use. We record sign-in events and the time of your last sign-in. Legal basis: performance of contract, and our legitimate interest in securing accounts.
Subscription and billing data — during the pilot (October 2026 to January 2027), access to Model Assurance comes with a C8 Allocator Agent subscription, so the subscription and billing data are those described in the Allocator Agent privacy notice. Payment card details are never stored by C8. Legal basis: performance of contract, and compliance with accounting obligations.
Terms-acceptance records — the Terms version you accepted, a record of the exact document shown to you and the time of acceptance, kept as evidence that the agreement was formed. Legal basis: our legitimate interest in a reliable record of contract formation, and compliance with legal obligations.
Connection and authorisation data — records of the AI assistants or applications you connect, and the access and refresh tokens issued to them. Legal basis: performance of contract.
Usage data — for each request: your account and user identifier, the tool used, the channel, response status, duration and timestamp, never the question itself or the answer. Used for support, billing accuracy, security monitoring and detecting misuse such as credential sharing. Retained for 90 days. Legal basis: our legitimate interests in operating, securing and improving the service.
Support correspondence — the content of any support enquiry you send us and our replies. Legal basis: performance of contract.
Website data — c8-technologies.com sets no cookies and carries no analytics.
The library itself contains public index rulebooks, the levels the index sponsors publish, public ETF prices and C8’s own computations. It contains no personal data, and answering a question sends nothing to a third party: the library is part of the service.
We do not sell personal data, and we do not use customer content to train artificial-intelligence models.
You may connect Model Assurance to AI platforms such as Claude (Anthropic) or ChatGPT (OpenAI). When you do:
You can disconnect at any time from within the platform, or ask us to revoke the connection.
We share personal data only with providers acting on our instructions:
We may also disclose data where required by law, regulation or a competent authority, or to establish, exercise or defend legal claims.
C8 is established in Ireland. As at the date of this notice, the data described above is processed in the following locations:
| Data | Processed in |
|---|---|
| Account, user, sign-in, terms-acceptance and usage records | United Kingdom (Azure UK South; backups replicated to UK West) |
| Model Assurance application servers and the library | United Kingdom (Azure UK South) |
| Subscription and provisioning service | Ireland (Azure North Europe) |
| Sign-in code email delivery | European Union (Azure Communication Services, data location Europe) |
| c8-technologies.com website | European Union (Azure West Europe) |
We do not host your account data in the United States.
Transfers from Ireland to the United Kingdom are made on the basis of the European Commission’s adequacy decision for the United Kingdom. Some of our providers are US-headquartered and may access data from outside the EEA for support and administration; where that happens we rely on the European Commission’s Standard Contractual Clauses together with the provider’s supplementary safeguards.
Where the GDPR applies you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on consent. To exercise these rights, contact support@c8-technologies.com; we will respond within the statutory period.
You may also complain to the Irish Data Protection Commission (www.dataprotection.ie) or to your local supervisory authority.
We protect your data with encryption in transit, short-lived and revocable access tokens, hashed sign-in codes, access controls and monitoring. No system is perfectly secure, but we will notify you and the relevant authority of a personal-data breach where the law requires it.
The service is intended for financial professionals. It is not directed at children and we do not knowingly collect data from anyone under 16.
We may update this notice. The current version is always published at https://c8-technologies.com/assurance_privacy.html with its “last updated” date. Material changes will be notified to subscribers by email or by in-service notice.