1. Who is responsible and how to contact us
AGENTIC VISION LTD, trading as UseBorage, is responsible for personal information used to operate the platform. Registration details, where incorporated: company number 16720340. Registered or business address: 71-75 Shelton Street, London, England, WC2H 9JQ.
Send privacy questions or requests to support@useborage.com. Describe the information or project involved and the action you want. Do not include passwords, complete payment credentials or identity documents in your first message. We may need proportionate identity checks before disclosing information or acting on a request.
2. Information used by the service
Account information includes names, email addresses, professional profile details and access verification records. If you act for an organisation, your business contact information can still be personal information. Sources include what you provide, project participants, authorised administrators and the configured authentication provider.
Project information includes briefs, uploaded materials, proposals, questions, replies, input requests, delivery files, correction requests, acceptance decisions and agreement records. Information created by the workflow includes AI-assisted drafts, assessments and review notes, and records linking a decision to its source material.
Operational information includes role-specific sessions, access-link and verification records, workflow events, notification delivery status and limited payment references and status. Agreement receipts include the identified actor, time, exact proposal and terms version and document content connected to an explicit browser confirmation.
Stripe receives payment, identity and payout information directly through its own forms when payment services are enabled and you use them. Borage receives relevant account references and status to manage funding and transfers. Stripe verification is not required to register or complete profile review. Do not put complete card numbers, bank credentials, passwords or unrelated sensitive information into project text or files.
3. Why information is used
Information needed to open your requested workspace, coordinate the project, share approved materials, support delivery review and manage payment status is used to provide the requested services and perform the relevant agreements. For business representatives, some coordination may instead rely on appropriate legitimate interests in operating the requested business service.
Relevant records are also used for account security, misuse prevention, support, dispute review and service reliability on the basis of legitimate interests where appropriate. Information required for accounting, legal obligations or an authorised regulatory request is processed on the applicable legal basis.
Acknowledging this notice does not provide blanket consent for unrelated advertising, optional analytics or every future use of personal information. An optional consent-based purpose must be explained separately, with a meaningful choice where required. A new purpose must be assessed before it is introduced.
Email verification is needed to access a private professional workspace. Portfolio evidence and your stated contribution are needed to assess profile readiness for matching. If you do not provide the required information, we cannot complete that step. Optional details can be left blank unless a particular service explains why they are needed.
4. Who can receive project information
At brief approval, buyers review the sharing boundary for project materials. Invited professionals receive the information needed to assess their opportunity within that approved boundary. Buyers and professionals see records needed for their own work. Authorised administrators can access relevant records to operate the service and handle support or exceptions.
The production application, database and uploaded files are hosted with Amazon Web Services in the London region. Clerk supports account authentication, Resend supports email delivery, and OpenAI supports AI-assisted processing. Stripe processes payments and recipient setup when those services are enabled. These providers receive information needed for their respective tasks; Borage does not treat profile registration as permission to send payment-verification information to Stripe.
Project text and files needed for an AI task may be processed by the configured AI provider. Email providers process the information needed to deliver a notification, and authentication and payment providers process information relevant to their respective services. Do not assume that a project file is reviewed only locally or only by a person.
We may disclose relevant information where required by law or a properly authorised request. The current service does not use profile or project information for targeted advertising or sell it as a marketing list. A materially different use requires its own assessment, disclosures and any choices required by applicable law before it starts.
5. AI assistance and human control
AI helps structure briefs, compare profile evidence, prepare proposals, interpret replies and review delivery evidence. Outputs and inferences can be personal information when they relate to an identifiable person. AI can make mistakes, and its score or explanation is not a guaranteed statement about someone’s ability or conduct.
Portfolio analysis uses the work, links and contribution information you provide to infer relevant skills and assess whether the evidence supports profile readiness. A ready profile with verified email and clear contribution evidence may be approved automatically. Insufficient or conflicting evidence can hold readiness and prevent the profile being considered for new matching. These outcomes are not guarantees about identity or ability. You can correct your evidence and ask the project desk for a person to review an inaccurate output or unclear decision.
Some ranking, routing and selection steps can run automatically within configured rules. The buyer approves the brief, final agreement and delivered work; the professional confirms their own proposal. Administrators handle exceptions and can pause affected steps. This is the practical meaning of human in the loop, rather than a promise that an administrator reads every automated output.
If an AI-assisted output appears inaccurate or a decision is unclear, identify the relevant project and evidence through the issue or project-desk route. A person can review the concern using the available records. Where applicable law provides additional rights concerning profiling or automated decisions, those rights are preserved.
6. Access protection and incident concerns
The current workspace restricts access by role, project ownership and the authorised scope of a task link. Email verification links expire and work once. Sessions can be revoked, including by signing out. Session cookies are configured to limit access by page scripts and unrelated sites, with secure transport protection when the service is deployed over HTTPS.
Private task pages use browser protections intended to limit caching, referral of private URLs and embedding in another site. Relevant action routes check the origin of submissions. File uploads have permitted-type and size limits, while payment confirmations have signature and transaction checks. These are specific safeguards rather than a guarantee of complete security.
Do not forward private access or review links. Use a secure email account, sign out on shared devices and report unexpected access or suspicious files to the project desk. File-type restrictions do not establish that every upload has been malware-scanned. Borage does not promise independent security certification or universal malware protection.
Operational monitoring and backups support recovery and service reliability. Authorised operators handle access administration and incident reports. A suspected incident is assessed for affected information, appropriate containment and any notices required by applicable law. No system can promise that information will never be lost, misused or disclosed.
7. Processing across borders
Although the production application database and uploads are hosted in the UK, authentication, email, AI and future payment providers may process relevant information in other countries, including the United States. Project participants may also be outside your country. The locations may have different privacy rules.
Our hosting, authentication, email and AI providers use data-processing terms that include Standard Contractual Clauses and the UK Addendum for restricted transfers where applicable. These safeguards impose data-protection obligations on the recipient. The relevant terms are available from AWS, Clerk, Resend and OpenAI; you can ask us for a copy of the safeguards relevant to your information. Contact support@useborage.com for information about the safeguards relevant to your data. Accepting platform terms does not replace any safeguards required for a restricted international transfer.
US participants may have federal or state protections in addition to this notice. Being based in the UK does not automatically remove those obligations. The governing-law clause in the Terms of Use does not require anyone to waive privacy rights that applicable law makes mandatory.
Provider data-processing terms: AWS — https://aws.amazon.com/compliance/gdpr-center/; Clerk — https://clerk.com/legal/dpa; Resend — https://resend.com/legal/dpa; OpenAI — https://openai.com/policies/data-processing-addendum/. These describe provider safeguards; they do not mean all information stays in the UK.
8. Retention, deletion and cookies
Account and portfolio information is retained while your account is open and it is needed to provide the service. Project messages, agreements, consent receipts, decisions and relevant file versions are retained for ongoing projects and, afterward, where needed for legal obligations, resolving disputes or establishing, exercising or defending legal claims. We assess closure and erasure requests against those purposes, the record’s relevance and applicable retention obligations; there is no promise that closing an account immediately erases every agreement or audit record. Retention depends on the purpose of each record, whether your service or project remains active, applicable legal obligations and unresolved disputes. A deletion request does not justify keeping unrelated information indefinitely.
Operational journals are subject to a 14-day retention setting and size limits. Database/files backups and exported logs are archived privately in S3 with 30-day lifecycle expiration and noncurrent versions eligible for removal after a further 30 days; lifecycle removal is asynchronous. Local recovery snapshots retain the three most recent snapshots. Rotation and archive limits are recovery controls, not a promise that deleting a workspace record instantly removes every backup copy.
A deletion request may not remove information that must lawfully be retained or is needed for a permitted unresolved obligation. The operator should explain the relevant reason and limits when responding. Keeping an agreement history does not justify retaining every unrelated personal detail indefinitely.
The workspace uses essential access and session cookies for security and continuity. Optional analytics or marketing technologies need their own disclosures and, where required, choices before use. The operator must assess any applicable browser preference signals and opt-out requirements before introducing processing that requires them.
9. Your requests and local rights
Depending on applicable law, you may request access, correction, deletion, restriction, portability or an objection to relevant processing. Rights can have exceptions and conditions. Contact the privacy address with your request; the operator may need proportionate verification and should explain the applicable response or reason for a lawful limitation.
Right to object: where processing relies on legitimate interests, you may object on grounds relating to your particular situation. Contact support@useborage.com and identify the processing concerned. We assess the request and explain any applicable lawful reason to continue. Additional rights concerning profiling and automated decisions apply where the law provides them.
For US residents, applicable state law may also provide rights to know the categories and sources of information, correct or delete it, obtain a copy, opt out of particular sale, sharing, targeted advertising or profiling activities, limit certain sensitive-information uses, or appeal a denied request. These rights depend on the state, the business and the processing involved; the availability of a right depends on the applicable law and processing.
California rights, where the California Consumer Privacy Act applies, cannot be waived through a platform agreement. A legitimate exercise of an applicable privacy right must not be punished. Other mandatory local protections remain available regardless of the governing-law choice.
You may contact the UK Information Commissioner’s Office at ico.org.uk or the competent authority in your jurisdiction where appropriate. Asking the desk for help does not remove an available complaint route. Send a request or an appeal about its handling to support@useborage.com.