Privacy Policy
Muniment Records, Inc.
1. Who we are and what this policy covers
Muniment Records, Inc. (“Muniment”, “we”, “us”) captures the definition of your conversational assistants from your bot platform on every publish, stores it as a dated, hash-chained record set in a bucket you own, and returns evidence packs showing exactly what was live at a timestamp you name. We do not run your assistant, we do not read your conversations, and we do not put anything back into your platform.
Registered at 10 Dorrance Street, Suite 700, Providence, RI 02903, United States.
We handle personal data in two different situations, and different rules apply to each:
| Whose data | Our role | What applies | |
|---|---|---|---|
| Part A | People who visit this website, ask about the service or write to us | Controller: we decide why and how the data is used | This policy |
| Part B | Assistant definitions exported from your bot platform, and the answer strings you paste into the resolver | Set out in B.1, because it depends on the data | This policy and the data processing agreement we sign with each customer |
If the data processing agreement (“DPA”) and this policy ever disagree about Part B, the DPA wins.
2. Part A: this website and our contact with you
This part covers the personal data we collect for our own purposes: running this website, answering requests, and staying in touch with people who are or might become customers.
A.1 What we collect
What you give us. When you send the form on this site, we collect what you type into it, such as your name, email address, phone number or company, and the fact that you agreed to be contacted. If you email or talk to us, we keep that correspondence and any contact details in it.
What is collected automatically. Our web server records the IP address a request came from, the browser used, the pages requested, the page you came from and the time. These logs exist to keep the site running and secure.
We don’t ask for sensitive data (the “special categories” in Article 9 GDPR) through this website, so please don’t send any through the form.
A.2 Why we use it, and what allows us to
| Why | What | Legal basis (GDPR Art. 6) |
|---|---|---|
| Answering your request and working out whether the service fits | What you sent in the form, our correspondence | Art. 6(1)(b): steps you asked for before a contract |
| Looking after customers, billing and support | Contact details, correspondence | Art. 6(1)(b): carrying out a contract |
| Keeping the site running, secure and free of abuse | Server logs | Art. 6(1)(f): our legitimate interest in running a secure service |
| Contacting you about the service | Email address, company | Art. 6(1)(f): our legitimate interest in business-to-business marketing. You can object at any time |
| Meeting tax, accounting and legal duties | Billing and contract records | Art. 6(1)(c): a legal obligation |
Where we rely on legitimate interest, we have weighed that interest against your rights, and you can ask to see the assessment.
A.3 How long we keep it
- Requests from people who don’t become customers: 12 months from our last contact, then deleted.
- Customer contact and contract records: for the length of the agreement plus 6 years, to cover legal claims and accounting rules.
- Server logs: 30 days.
- A record that you objected or opted out: kept indefinitely, so we can keep respecting it.
A.4 Your rights
If you are in the EEA or the UK, you can ask to see your data, correct it, have it deleted, limit or object to how we use it, get a copy you can take elsewhere, and withdraw consent where we rely on it. Write to [email protected] and we will answer within one month.
You can also complain to a data protection authority. If you are in the EEA, that can be the authority where you live or work.
3. Part B: data inside the service
Two kinds of material reach us and they carry very different risk. An assistant definition is your configuration: dialog tasks, nodes, prompt strings, entities, knowledge answers, channel settings and the identity of whoever published them. It is commercially sensitive and it is not, as a rule, about any member or customer. An answer string is different: you paste it in because you are trying to find out which node produced it, and it came out of a real conversation, so it can carry member or customer detail you did not intend to send. This part describes how we treat each.
B.1 What we handle, and in what role
Account data, meaning your work email, company, billing contact and the names of people you authorize to pull evidence packs, we hold as a controller. Assistant definitions, the derived record set, resolver queries, reviewer decisions and evidence packs we process as your processor, on your instruction, for as long as your archive exists.
- The assistant definition. Everything the platform's export API returns for an assistant: dialog tasks, nodes, prompt and response strings, entities, knowledge answers, channel and integration settings, version numbers, publish timestamps and the publisher's identity. If your team left a real member name in a test utterance, it is in the export and it is in the archive.
- Publish event metadata. Which assistant published, when, by whom, and the version identifier the platform assigned, polled from the platform's own event feed. This is what triggers a capture.
- Resolver queries. The timestamp you name and the answer string you paste. We store the query so the evidence pack can be reproduced and audited later, which means an answer string carrying member detail is retained with the matter it belongs to until you delete it.
- Reviewer decisions. Which unresolved query or low-margin lineage join a named person on your side confirmed or corrected, stored as a pair with the node version it points at, the person and the timestamp.
We do not connect to your CCaaS, your CRM or your recording estate, and we hold no transcripts, no call audio and no member records. The only conversation text we ever see is a string you paste into the resolver yourself.
Because we hold no PHI by design and take no feed from a system that produces it, we do not offer or sign a Business Associate Agreement. If your compliance office requires one from every vendor regardless of scope, say so before you connect, because we will not sign one for a scope we do not have.
Redact before you paste. The resolver works on the wording of the answer, not on the member, so removing names, member ids and amounts from a pasted string does not degrade the result.
An evidence pack is a document, and a document can be forwarded. Treat one containing a pasted answer string the way your matter-management rules treat any other exhibit.
B.2 What we do with it
Your archive lives in your bucket. Parquet and JSON record sets, raw exports and signed manifests are written to a storage bucket you own, in your account, under Object Lock in compliance mode for a retention period you set at connection and default to seven years. We hold the index, the embeddings and the manifest hash chain, in object storage in Ohio; the evidence itself sits where your cloud team controls it.
Nobody deletes a version quietly, including us. Object Lock in compliance mode means neither your administrators nor ours can remove a captured version inside its retention period. Removing one requires a signed instruction from two named people on your side, is executed only on the objects that instruction identifies, and leaves a tombstone row naming the instruction, the two people and the date.
Resolver queries and their packs. Stored against the matter reference you supply, so that the same question asked twice returns the same answer with the same hashes. Deleting a matter deletes its queries, its pasted strings and its packs together. The captured versions they pointed at are unaffected, because those are the record.
The reviewer corpus stays in your account. Confirmed and corrected pairs fine-tune lineage and resolution on Azure Machine Learning in East US 2, for the account that produced them only, and are not pooled with any other customer's. A pair carries the node version and the node text a reviewer matched, never the pasted answer string. What does carry across accounts is the platform grammar, meaning which export field is a node label and which is a prompt string, which is a claim about the platform's schema and contains no string of yours.
B.3 AI models: where they run and what they learn from
Where models run. Resolver inference, the cross-encoder that carries node lineage across versions, and every model touching a pasted answer string run on cloud GPU instances we operate in Ohio. No pasted answer string, transcript excerpt or evidence pack is ever sent to a hosted model API, Azure OpenAI included, because customers in regulated industries cannot pass member conversation text to one. For that text every cloud we use, Microsoft's included, is infrastructure, not a model vendor. Bulk embedding during onboarding backfill handles assistant configuration text only and runs on Azure OpenAI in East US 2 under zero data retention. The hosted third-party embedding endpoint it replaces, under contractual zero-retention and no-training terms and listed in our subprocessor register, is retired by March 2027. All of it runs in the United States.
Training. We do not train on your assistant definitions, your resolver queries or your pasted answer strings, and neither Azure OpenAI nor the endpoint it replaces retains or trains on the configuration text we embed. The exception is exact and narrow: reviewer confirmations and corrections create labeled pairs, being (matched node text, node version) and (node version N, node version N+1), which fine-tune lineage and resolution on Azure Machine Learning in East US 2 for the account that produced them and for no other account. The pairs are the labels, not the documents. No pair carries the pasted answer string, and no pair is pooled across customers. What is shared across customers is the platform grammar, meaning which export field on a given bot platform is a node label, a prompt string or an entity, which describes the platform's schema and contains no configuration, string or query of yours.
Where a person decides. The model proposes and a person decides. A resolver match below 0.90 confidence returns unresolved and the evidence pack states in those words that no node in the version live at that timestamp matches the supplied text above threshold; it never returns a best guess dressed as an answer. Unresolved queries and low-margin lineage joins go to a review queue where a named person on your side confirms or corrects the link, and that decision is written back as an audited row carrying the person and the timestamp. No automated decision made here produces a legal or similarly significant effect on any individual: the subject of every classification is a node in a configuration file you published, and the human who uses the output is your own lawyer or compliance officer.
B.4 Where the data is kept
All processing stays in the United States, on cloud infrastructure in Ohio and on Microsoft Azure, and we run no global edge cache. Neither provider acts as a model vendor for anything you paste.
Our cloud infrastructure provider in Ohio, named in our subprocessor register: capture, parsing, indexing and evidence-pack generation; the index, embeddings and hash chain in object storage; and the resolver, the cross-encoder and every model touching a pasted answer string on cloud GPU instances we operate.
Microsoft Azure, East US 2: Azure OpenAI embeddings for bulk onboarding backfill, on assistant configuration text only and under zero data retention, and Azure Machine Learning for per-account fine-tuning of lineage and resolution on reviewer pairs. No pasted answer string reaches Azure.
The hosted third-party embedding endpoint that Azure OpenAI replaces stays named in our subprocessor register, under zero-retention and no-training terms and on configuration text only, until it is retired by March 2027.
Your archive bucket is yours: you choose its region, and if you place it outside Ohio the objects live there while our index and processing stay in Ohio.
Model evaluation uses assistant definitions we author ourselves against test platform tenants, never a customer's.
The suppliers that handle data in the service are named on our subprocessor list, which comes with the data processing agreement and which we send to anyone who asks: write to [email protected].
B.5 How long we keep it, and what deleting can’t remove
Captured assistant versions, raw exports and manifests: for the Object Lock retention period you set on your own bucket, seven years by default. We cannot shorten it and neither can you, which is the point of it.
Resolver queries, pasted answer strings and generated evidence packs: until you delete the matter they belong to, or the account closes.
The reviewer corpus: for the life of the account, deleted with it.
Our index, embeddings and hash chain: removed within 30 days of account closure. Your bucket is untouched by closure and stays readable without us.
Account and billing records: seven years after closure, as US corporate and tax record rules require.
API and console access logs, without payloads: 90 days.
B.6 Requests from people whose data is in the service
A pasted answer string may carry detail about one of your members or customers, and evidence packs may name the employees who published a version. If one of them asks you what is held, it is in your archive and your account, and exportable by you. If they ask us, we route them to you as the controller of the decision to send that string. For data we hold about you as a customer, write to [email protected] and we will answer within 30 days.
For everyone
4. Moving data between countries
Muniment Records, Inc. is a company in the United States. When personal data from the EEA or the UK reaches us, for example because someone there writes to us or a customer there uses the service, it is protected by the European Commission’s Standard Contractual Clauses, a transfer impact assessment and the extra technical measures described in our security documentation. You can ask us for a copy of the clauses.
EU representative (Article 27 GDPR). Write to [email protected] with “EU representative” in the subject line and we will send you our representative’s details.
5. Security
We protect data in line with the risk. That includes encryption in transit and at rest, access limited to the people and systems that need it, each customer’s data kept separate from every other’s, and a log of every access to production systems.
If a personal data breach affects you, we tell you without undue delay, and at the latest within 36 hours of finding out, with the information you need to meet your own reporting duties.
6. Children
The service is sold to businesses and is not meant for children. We don’t knowingly collect personal data from anyone under 16.
7. Changes to this policy
We may update this policy. If a change matters, we email customers at least 30 days before it takes effect. The version number and date at the top of this page change every time.
8. Contact
Privacy questions and anything else: [email protected]
By post: Muniment Records, Inc., 10 Dorrance Street, Suite 700, Providence, RI 02903, United States