Privacy Policy

Overview

This Privacy Policy explains what information UCMT Labs ("we", "our", or "us") collects when you use the UCMT Labs causal discovery platform, how we use it, where it is kept, for how long, and the choices you have.

If you do not agree with this policy, please do not use the platform.

Information We Collect

Account information you give us: your name, e-mail address, password (stored only as a hash) and organization name. If you subscribe to a paid plan, payment details are collected and processed by our payment processor, Stripe; we do not store card numbers.

Subscription and billing records: when you buy a plan or change it, you sign the terms we show you. We keep what you signed: the full text shown and its fingerprint, the name you typed and the name on your account, the plan and price, the date and time, your browser details and a keyed one-way hash of your network address (not the address itself). Your password is checked to confirm it is you, and is not stored with the record. When you ask to cancel with a refund, we keep the request, the reason you give (if any), the amount and our decision.

Checks against repeated refund claims: before a money-back guarantee refund is paid, we compare the request with the billing records of other organizations on the platform: the same payment card (as reported by Stripe, without the card number), the same Stripe customer, billing e-mail address, member e-mail address or e-mail domain, or the same verified name. When there is a match, the request is treated as a possible repeat guarantee claim: the refund offered is the one for the unused days instead of a full refund, and the request goes to a person on our team, who sees the match and decides. You can ask us to explain or reconsider the decision.

Referral programme: if you are a referrer, we keep your name, e-mail address, your referral codes, the commissions earned from the payments of customers you referred, and the payouts we made to you (amount, transfer reference and note). If you signed up with a referral code, we record the code and the commissions your organization's payments generated for the referrer; the referrer sees your organization's name, not your personal details.

Content you upload: the datasets you upload and the causal graphs, models and results the platform produces from them.

Sign-in and security records: when you sign in, fail to sign in, or reset or change your password, and when a sign-in looks unusual, we record the event with your IP address and browser details in a security audit log, which only your organization's administrators and our platform operators can read.

Usage information: our servers log requests, including IP address and browser type. With your consent, and only then, the application also records first-party usage events such as pages viewed and features used (product analytics) and, separately, clicks, scrolling and navigation (session replay). Session replay never records what you type: form values and text in areas we mark private are masked before they leave your browser, and masked again on our server.

Messages you send us through the contact form: your name, e-mail address, company (optional) and message. They are e-mailed to us and not stored by the platform.

Your Consent to Analytics and Session Replay

Product analytics and session replay are optional and off until you choose. You choose each one separately in the banner shown on your first visit, and you can change or withdraw either choice at any time under "Privacy choices" at the bottom of each page or in Settings > Privacy.

When you are signed in, every change to your choices is recorded on your account: which purpose you allowed or withdrew, the version of this notice you answered, when, and whether you answered in the banner or in Settings. Your current choice follows you to your other devices.

Withdrawing consent takes effect at once: your browser stops recording and discards anything not yet sent, and our servers refuse analytics and session-replay events sent while you are signed in until you consent again. Events sent without a sign-in are stored without any link to an account, and our servers refuse any that name a person. Records made before you withdrew are deleted on the schedule below.

How We Use Your Information

We use this information to provide and operate the platform, to process payments and refunds, to keep proof of the subscription terms you accepted, to prevent abuse of the money-back guarantee, to run the referral programme, to send transactional e-mails (such as e-mail verification and password reset), to answer messages you send us, to protect accounts against misuse, to understand how the product is used so we can improve it (only with your consent), and to meet legal obligations.

Datasets you upload are processed to provide the service to you. We do not sell personal information and we do not use it for advertising.

Where Your Information Is Kept

The platform - its servers, database, uploaded files and encrypted backups - is deployed in a Canadian region.

Some of the service providers listed below process the information they receive on their own infrastructure, which may be outside Canada; each entry says so.

Service Providers

We rely on a small number of providers to run the service. They process information only as needed to provide their service to us.

• Stripe - payments for paid plans (Stripe Checkout and the billing portal). Receives: your organization's name and the e-mail address you subscribe with, which we send when you start a subscription, and the payment details you enter on Stripe's own pages; we keep only Stripe's customer and subscription identifiers and the subscription status, never card numbers. Location: Stripe's own infrastructure, which may be outside Canada.
• Our e-mail delivery provider (an SMTP relay, or SendGrid, as the deployment is configured) - transactional e-mail: address verification, password reset, account notices and replies to the contact form. Receives: the recipient's e-mail address and name, and the message. Location: the provider's infrastructure, which may be outside Canada.
• Our hosting provider - runs the platform's servers, database and file storage. Receives: everything the platform stores. Location: a Canadian region.
• Our backup storage provider (S3-compatible object storage) - encrypted, off-site backups. Receives: everything the platform stores, encrypted before it leaves our servers. Location: a Canadian region.

Fonts and scripts are served from our own servers. Besides our own servers, your browser contacts only:

• Have I Been Pwned (Pwned Passwords) (https://api.pwnedpasswords.com): when you choose a new password, the first five characters of its SHA-1 hash - never the password itself - so we can warn you if it appears in a known breach; like any web request it also sees your IP address.

Data Retention

We keep your account information and the datasets and graphs you upload for as long as your account is active. You can delete your datasets and saved models yourself at any time; what remains of a deleted dataset is scrubbed after 30 days, and a deleted model's file and record are erased after 30 days.

Other information is deleted automatically:

• usage events (product analytics) after 90 days; the full IP address on them is kept for 7 days, after which only a one-way hash of the network it came from remains;
• session replay after 30 days;
• expired, revoked or used sign-in, verification and password-reset tokens 30 days after they end;
• per-request API usage records after 90 days;
• security audit records, including the history of your consent choices, after 365 days;
• records of sent e-mail after 30 days.

Billing records received from Stripe are kept for 730 days for accounting.

Some billing records are kept after your account or organization is deleted, because they are the proof of what was agreed and paid: the subscription terms you signed, refund requests and their decisions, refunds sent, and referral commissions and payouts. They are kept for as long as they are needed for accounting and tax obligations and to handle disputes and chargebacks, and are then deleted. Only our billing operators can read them.

Deleting Your Account

You can delete your account yourself in Settings > Privacy. The account is closed immediately: you are signed out everywhere at once, your name and e-mail address are removed from the account record, and the address is released for new registrations at once (a new account created with it starts empty and is not connected to the deleted one). Your remaining personal information and datasets, including the record of your consent choices, are erased 30 days later, and the encrypted backups that still hold them expire 30 days after that. Security audit records about your account are kept for their normal period with your IP address, browser details and e-mail address removed. Billing records, including the subscription terms you signed, are kept as described under Data Retention.

If your organization is subject to a legal hold (for example an open dispute or a regulator's request), deletion of its data is suspended for as long as the hold lasts.

Data Security

Connections to the platform are encrypted in transit with TLS. Passwords are stored as bcrypt hashes; API keys and session refresh tokens are stored only as hashes. Dataset files you upload are encrypted at rest (AES-256-GCM) by the platform API. Each organization's records are visible only to its own members and to platform operators. Sign-in events are recorded in a security audit log, which also flags unusual sign-in activity. Our Security page describes these controls in more detail.

If a breach of our security safeguards involving your personal information creates a real risk of significant harm to you, we will notify you and report it as the law requires.

Your Rights

You can view and correct your name in your account settings, and download a copy of your data or delete your account in Settings > Privacy, where you can also change your choices about analytics and session replay at any time. You may also ask us for access to, correction of, or deletion of your personal information by contacting us using the details below; we will respond within 30 days.

Cookies and Local Storage

We use one strictly necessary cookie to keep you signed in: an HTTP-only, Secure, SameSite=Strict cookie that holds your session refresh token. We do not use advertising or third-party tracking cookies.

The application also keeps a few preferences in your browser's local storage, such as your colour theme and your privacy choices (which, when you are signed in, are also saved to your account).

Changes to This Policy

When we change this policy we will publish the new version on this page and update the "last reviewed" date above. When a change affects what analytics or session replay collect, we ask for your consent again before either runs.