Privacy notice
Last updated 10 August 2026
This notice explains what personal data Liffey collects, why, where it is processed, how long it is kept, and the rights you have over it.
It covers this website and the Liffey product. Our role differs between the two, and section 1 sets out which applies when.
1. Who we are
Liffey is a registered business name of Fractional Edge Limited, registered in Ireland, company number 782670, 71 Baggot Street, Dublin 2, Ireland. In this notice, “Liffey”, “we” and “us” mean that company.
For personal data about visitors to this website and people who contact us, Liffey is the data controller.
For personal data contained in the content a customer connects to or uploads into their workspace, the customer is the controller and Liffey is a processor, acting on their instructions under a written agreement that meets Article 28 of the GDPR. Our data processing agreement sets out those terms.
2. What we collect
Website visitors
Pages requested, approximate location derived from IP address, browser and device type, and referring site. This comes from server logs and is used to keep the site available and secure.
People who contact us or start an account
Name, work email address, telephone number where given, company name and domain, and the content of your enquiry.
People who complete the diagnostic
Your email address and the confidence scores you gave to each of the twelve statements. We keep the domain part of your address separately, so that we can study how the market scores itself over time without working from the address itself.
We publish only aggregated, anonymised findings.
Users of the product
Account identity (name, work email, role), authentication records, and a log of actions taken in the workspace.
Customer content
Text extracted from the systems a customer connects and from documents they upload. This may contain personal data about the customer’s own staff, customers and contacts. Uploaded source files themselves are not retained: text is extracted on receipt and the file is discarded.
Every workspace can enable PII redaction at ingestion, so identifiers are removed before storage, indexing or AI processing.
3. Why we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Providing and securing the service | Performance of a contract |
| Responding to enquiries | Legitimate interests, and steps taken at your request before a contract |
| Sending you your diagnostic result, and following up on it | Steps taken at your request before a contract, and legitimate interests |
| Studying how the market scores itself, in aggregate | Legitimate interests |
| Keeping the website available and free from abuse | Legitimate interests |
| Sending service messages about your account | Performance of a contract |
| Sending marketing email | Consent, or legitimate interests where you are an existing customer. You can withdraw at any time |
| Meeting our legal and accounting obligations | Legal obligation |
Where we rely on legitimate interests, we have considered your rights and freedoms and concluded that the processing is necessary and proportionate. You can ask us for that assessment.
4. Where your data is processed
All core processing runs in the European Union: the database, application compute, AI inference, embedding generation and transactional email.
Where a customer connects an optional source that is operated outside the EU, Liffey reads the content they have authorised and stores the derived text within the EU. Those connectors, and their locations, are listed at liffey.ai/sub-processors.
Content submitted for AI processing is handled in memory and is excluded from model training by the terms we hold with our AI providers.
6. How long we keep it
| Data | Retention |
|---|---|
| Website server logs | Up to 30 days |
| Enquiries and prospect records | 24 months from the last contact |
| Diagnostic responses, with your email address | 24 months from completion |
| Diagnostic scores, aggregated and no longer identifying | Kept indefinitely for research |
| Account and workspace records | For the life of the agreement |
| Customer content | A retention window each customer sets, and deleted on request |
| Audit logs | 12 months |
| Invoices and accounting records | 6 years, as Irish tax law requires |
On termination, customer content is deleted or returned within 30 days, at the customer’s choice.
7. Your rights
Under the GDPR you have the right to access your personal data, to have it corrected, to have it erased, to restrict or object to how we use it, to receive it in a portable format, and to withdraw consent where consent is the basis we rely on.
Write to privacy@liffey.ai. We acknowledge requests within 72 hours and answer within one calendar month.
If the data sits inside a customer’s workspace, we are the processor. We will pass your request to that customer and support them in answering it.
You may also complain to the Irish Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, at dataprotection.ie.
8. How we protect it
Encryption in transit and at rest, role-based access control, and operator access that is time-boxed, reason-stated and self-expiring, with every use written to an audit log. Connections into customer systems are read-only. Our architecture adheres to ISO 27001:2022 and is set out control by control at our trust centre.
10. Changes to this notice
We will update this page when our processing changes and revise the date at the top. Where a change materially affects you, we will tell you directly.
11. Contact
Privacy questions: privacy@liffey.ai. Anything else: liffey.ai/contact.
Liffey is a registered business name of Fractional Edge Limited, registered in Ireland, company number 782670, 71 Baggot Street, Dublin 2, Ireland.