How we handle your information.

1. Who is responsible?

Huey is provided by Shortboard Ltd. For questions about privacy, contact:

Before publication: add the company number and business correspondence address. Confirm whether data protection officer or representative details are applicable.

Our role and your organisation’s role

Proposed arrangement, subject to confirmation: Shortboard acts as controller for its own account administration, business enquiries and related operations. For customer-directed investigations, the commissioning organisation acts as controller and Shortboard processes investigation information on its documented instructions.

Confirm these roles against the service agreement and actual processing. Identify the commissioning organisation and provide its privacy contact and notice to participants. Complete the corresponding data processing agreement.

2. What information is involved?

The reviewed prototype stores information used to set up, run and follow up investigations. This includes:

• Requester, sponsor and stakeholder details, including names and email addresses where supplied.
• Investigation questions, background information, working hypotheses and material supplied for context.
• Invitations, participation links, delivery records and participation status.
• Submitted accounts, retained conversation replies, participant summaries and corrections.
• Generated briefs and related investigation records.

Information may come directly from you or from the person organising the investigation, for example when they provide your details to invite you.

Please avoid including unnecessary personal information about yourself or others in an investigation.

Before publication: verify the complete production data inventory, including account authentication, uploaded files, decision records, actions, participant updates, support correspondence, technical logs and any billing information.

3. Why information is used

Huey uses investigation information to frame questions, manage participation, conduct AI conversations and produce a brief for the commissioning organisation.

Before publication: complete the purpose and lawful-basis mapping for account administration, investigation delivery, invitations, reminders, AI processing, support, security, billing and any marketing or product improvement activity.

For each purpose, identify the responsible controller, information used and applicable lawful basis. Explain any legitimate interests relied upon. Do not assume agreement to participate supplies the lawful basis for every use of information.

Sensitive information: confirm how information about health, other special categories and criminal allegations is prevented, restricted or handled, including any additional legal conditions required.

4. Participation, identity and access

What the current prototype retains

The reviewed prototype retains names and email addresses in invitation records. Submitted contributions have identifiers that can be linked back to those invitations. These records should therefore be treated as personal information, rather than irreversibly anonymous data.

The current shared prototype does not guarantee anonymity or confidentiality from authorised workspace administrators. Administrators can access submitted accounts and retained replies.

A response may also identify someone through its content, even without a name. A distinctive incident, role or experience can make a person recognisable, particularly in a small group.

Reviewing your contribution

The prototype includes a participant review step. Original replies are retained separately from the concise review. Editing a summary does not by itself establish that the original conversation has been deleted.

Before publication: verify the production identity modes and permissions. Explain separately what sponsors, organisers, Shortboard administrators and providers can access. Confirm who sees invitation lists, completion status, individual responses, quotations and identity links.

Explain exactly what participants can edit or remove, what happens to underlying replies, and how withdrawal or deletion requests are handled after submission.

Describe who receives briefs, action records and updates, including how identifying details and small-group disclosures are reviewed before sharing.

5. Internal background information

The reviewed code separates internal investigation context from material selected for participant sharing. Participant briefing material is filtered to include explicitly shared context items.

Internal context may still be processed by the AI provider when framing the investigation or preparing and reviewing the leadership brief.

Before publication: test all participant routes, AI inputs and outputs, exports and access permissions. Describe the verified controls without presenting AI instructions alone as a guarantee against disclosure.

6. AI and human involvement

The reviewed Worker uses the OpenAI Responses API for tasks including framing investigations, organising source material, supporting conversations and producing or reviewing summaries and briefs.

These requests are configured with the API’s store: false option. This setting alone does not establish zero retention by the provider, UK-only processing or the account’s data-sharing settings.

Before publication: confirm the production API endpoints, models, project settings, provider retention and logging, model-training arrangements and any approved additional data controls. Explain which information is sent for each purpose.

Confirm the human review process and staff access. Explain whether any decisions with legal or similarly significant effects are made solely by automated processing. Distinguish generated findings from decisions taken by the commissioning organisation.

7. Providers and international processing

The website uses Squarespace. The reviewed application code uses Cloudflare Workers and a Cloudflare D1 database, together with the OpenAI API.

The Worker file does not establish where all information is stored or accessed. A UK-based business or preferred hosting location does not, by itself, confirm UK-only processing across providers, logs, backups and support.

Before publication: confirm the complete provider list, including authentication, invitation delivery, support and payment services where applicable. Record the purpose and information involved for each provider.

Confirm storage and processing locations, backup locations, remote support access and any international transfers. Explain the applicable transfer arrangements and safeguards, and how people can obtain information about them.

8. Retention and deletion

Retention periods and complete deletion procedures are still being finalised for production.

The reviewed Worker contains an investigation deletion route that removes the main investigation record and associated invitations, delivery records and campaign. It does not establish complete deletion across every related record or provider.

The reviewed file does not contain a scheduled process enforcing the proposed retention periods.

Before publication: agree, implement and test retention periods or clear retention criteria for accounts, drafts, invitations, identity mappings, raw conversations, approved summaries, uploaded files, briefs, actions, support records and logs.

Verify deletion of related request, approval, report-run and report-job records, together with provider-stored information and backups. Define investigation closure, deletion completion windows and any justified legal holds. Do not publish fixed periods until they can be enforced.

9. Cookies and similar technologies

Before publication: audit the Squarespace website and production application. Identify essential cookies and any analytics, advertising, embedded-service or other tracking technologies.

Explain their purposes, duration and controls, including how people can change or withdraw optional consent. Match this explanation to the actual consent banner and enabled services.

10. Your rights and choices

Depending on the circumstances and the basis for using your information, you may have rights to access it, correct it, request deletion, restrict its use or receive it in a portable format. Where processing relies on consent, you can withdraw that consent.

Your right to object: you may object to processing based on legitimate interests. You can also object to the use of your personal information for direct marketing.

To ask about your information or make a request, contact martin@shortboardbusiness.com .

Before publication: confirm the request-handling process, including how Shortboard assists the commissioning organisation where it acts as processor, and how identity is checked without exposing protected responses.

State which information is required to provide the service, which participation is optional, and the consequences of not providing required information.

11. Questions and complaints

If you have a concern about how information is handled, contact Shortboard Ltd at martin@shortboardbusiness.com .

You can also raise a concern with the UK Information Commissioner’s Office: ico.org.uk/make-a-complaint .

Before publication: add the business correspondence address and explain how complaints about customer-controlled investigation information are handled with that organisation.

12. Changes to this notice

We will update this notice when our handling of personal information changes. The effective date will appear at the top of the page.

Production release check: review this notice against the final deployed code, provider settings, contracts and tested behaviour. Update the homepage trust statements to match before publishing both.