Privacy policy

Draft for legal review. This text has not yet been approved by m11 Solutions' counsel and is not in force. Highlighted passages are still to be confirmed. The page is excluded from search engines until it is final.

Who we are and what this policy covers

Tradecraft is a product of m11 Solutions To confirm: (legal name, form of entity and registered address) (“m11 Solutions”, “we”, “us”). This policy explains how we handle personal data:

• when you visit this website, tradecrafthub.ai, including the documentation;
• when you enter information on this site: when you sign up, request access, sign in or contact us;
• when you and your colleagues use Tradecraft; and
• when we manage our relationship with customers and prospective customers.

Where we act for our customers. When an organization uses Tradecraft, the assessments, questionnaires, documents, knowledge articles, answers and other content it puts into the service (“Customer Data”) belong to that organization. For Customer Data we act as a processor (or service provider) on the organization’s instructions, under our Terms of Service and Data processing terms. The organization is the controller and decides how that data is used. If your personal data is in a Tradecraft workspace run by your employer or another organization, please contact that organization first; we will help them answer your request.

For everything else in this policy, m11 Solutions is the controller.

Information you enter on this site

Everything you type into a form on tradecrafthub.ai is sent to us encrypted (HTTPS) and used only for the purpose shown below.

How we protect it. Passwords are stored only as a one-way Argon2id hash and are never visible to us. Authentication-code secrets and connection credentials are encrypted. Customer Data is kept separate for each organization; see How we protect personal data.

What we never do with it. We do not sell it, use it for advertising, or share it with data brokers. Analytics runs only on website pages, never on the sign-up, request-access, sign-in or Tradecraft pages, and never records what you type into any form. If you start a form and leave without submitting it, nothing is sent.

Personal data we collect

Information you give us

• Account details: your name, work email address, and the name and web address of your organization when you sign up. Passwords are stored only as a one-way hash. Multi-factor authentication secrets are encrypted.
• Access requests and enquiries: your name, email address, company and message when you request access or write to us.
• Workspace membership: your role, invitation status and, if your organization uses single sign-on or automatic provisioning, the identifiers and group memberships your identity provider sends us.
• Support and feedback: what you tell us when you ask for help or give feedback.
• Connected sources: if you connect Confluence, Microsoft SharePoint, Microsoft OneDrive or Google Drive™, the account name and email address of the connection, and the names, links and content of the items you choose to sync.
• Customer Data: the content you and your colleagues enter into Tradecraft, which we process for your organization (see above).

Information collected automatically

• Service and security logs: your IP address, browser, device and the pages or features you use, with timestamps. We use them to run the service, investigate problems and protect accounts, for example by limiting repeated sign-in attempts. Sign-in events and changes in a workspace are recorded in that organization’s audit log.
• Website analytics, with your consent: see Cookies.

Information from other sources

• Your organization’s administrator, who may invite you, assign your role or connect an identity provider.
• Identity providers you or your organization use to sign in, such as Microsoft Entra ID, Google Workspace or Okta, which tell us your name, email address and directory identifiers.

We do not ask for sensitive personal data, such as health information, and we ask you not to put it into Tradecraft.

Cookies

Cookies are small files that a website stores in your browser. We use two categories, and you decide about the second.

Your choice. On your first visit, a banner asks whether you accept analytics cookies. Accept all and Reject all carry equal weight, and Cookie settings opens the privacy preference center, where you can review each category and the cookies in it. Analytics cookies stay off until you allow them; if you close the page without choosing, they stay off. We remember your choice for six months in the tc_consent cookie and then ask again. To change your mind, open Cookie settings here, from the foot of any page, or from the cookie button at the bottom left of the screen. If you withdraw consent, we delete the analytics cookies. Your choice applies to the browser and device you make it on.

Strictly necessary cookies

Always active. These cookies are needed for the website and the Tradecraft app to work, and cannot be switched off. They remember your cookie choices, keep you signed in, and protect the sign-up, sign-in and single sign-on steps against forgery. They do not track you for analytics or advertising.

Analytics cookies

Off unless you allow it. With your consent, Google Analytics 4 counts visits to the website and shows us which pages help, where visitors come from, and roughly which country they are in. It runs only on website pages, never in the Tradecraft app, and never records what you type into forms. We send it the page address without any query string, keep advertising features and Google signals off, and never use it to advertise to you.

About Google Analytics. If you allow analytics cookies, your browser loads Google Analytics 4 from Google, which records the website pages you view, where you came from, your browser and device type, and your approximate location derived from your IP address. We send Google the page address without any query string. Google does not log or store your IP address for Google Analytics 4. We have turned off Google signals and advertising personalization, and we do not use the data to advertise to you. Google acts as our service provider for this data; see how Google uses information from sites that use its services. If you reject analytics, or never answer, nothing is sent to Google.

How we use personal data

Where we rely on legitimate interests, we have weighed them against your rights; you can object at any time (see Your rights). We may also create aggregated or de-identified information that no longer identifies you.

AI processing

Tradecraft uses large language models to draft answers from your organization’s own approved content. We send the relevant questions and excerpts of Customer Data to the AI model provider that runs the model, only to produce the result you asked for.

• Our models run on Microsoft Azure AI Foundry, and we use no other AI model provider. Microsoft’s global deployments may process a request in any Azure region where the model is available. We will add another AI provider only after giving customers notice, as our Data processing terms describe.
• An organization can instead connect its own AI provider account. In that case the provider is the organization’s own choice and acts under the organization’s agreement with it.
• Search indexes (embeddings) are computed inside Tradecraft’s own infrastructure, not by an outside provider.
• Safety systems. Microsoft screens prompts and responses in real time for harmful content (content filtering), and monitors use of its models for abuse. If content is flagged, a sample may be reviewed by automated systems and, where needed, by authorized Microsoft employees; content kept for that review is stored in the Azure geography of our AI resource. Microsoft states that it does not use prompts or responses to train models. We use Microsoft’s standard abuse monitoring; we have not been approved for its modified abuse monitoring, which turns off this storage and human review.
• Our own monitoring. We apply rate limits and AI budgets, and keep an audit log of AI tool calls without the question or answer text. Our staff look at Customer Data only for support you ask for, to investigate suspected abuse or a security incident, or when the law requires it (Terms, section 7.4).
• To confirm: We do not use Customer Data to train AI models, and our AI model providers are not permitted to use it to train theirs.
• AI drafts never become approved answers on their own: a person in your organization reviews and approves them. We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

How we share personal data

We do not sell personal data, and we do not “share” it for cross-context behavioural advertising. We disclose it only:

• To service providers (sub-processors) that host and run Tradecraft for us under written contracts that limit their use of the data, such as Microsoft Azure (hosting, databases, storage, email delivery and AI models). The current list is in our Data processing terms.
• To Google, for website analytics, only if you consent.
• At your organization’s direction, for example to the identity provider, connected sources, AI provider or AI tools (MCP clients) that your organization chooses to connect.
• To your organization, which can see its members’ names, roles, activity in its audit log and the content they create.
• For legal reasons, when we believe in good faith that the law, a court order or a binding government request requires it. Where a request concerns Customer Data, we will try to redirect it to the customer and tell the customer unless the law forbids it.
• In a business transfer, such as a merger, financing or sale of assets, under confidentiality and subject to this policy.

International transfers

Tradecraft runs on Microsoft Azure in To confirm: (production region: Canada Central or East US 2). Our service providers, and AI models that use global deployments, may process data in other countries, including the United States. When personal data from the European Economic Area, the United Kingdom or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (with the UK Addendum and Swiss amendments as needed) and take additional measures where appropriate.

How long we keep personal data

We keep personal data only as long as we need it for the purposes above, then delete or anonymize it.

• Account data: for as long as your account or your organization’s subscription is active, and for a limited period afterwards to meet legal, accounting and security obligations. To confirm: (Confirm periods, e.g. deletion within 30 days of an organization’s closure.)
• Customer Data: as the customer directs, under the Data processing terms. Administrators can set how long AI usage records are kept.
• Service and security logs: To confirm: (Confirm, e.g. up to 30 days in Azure Log Analytics.)
• Website analytics: Google Analytics event data is kept for To confirm: (14 months; set in the Google Analytics property, whose default is 2 months); the cookies expire as shown above.
• Enquiries and access requests: up to To confirm: (two years) after our last contact.

How we protect personal data

Every connection is encrypted with TLS. Integration and identity-provider secrets are encrypted with AES-256-GCM, every password sign-in needs a second factor, and access within a workspace follows the roles your administrator assigns. Each organization’s data is kept separate from every other organization’s. Read more on our Security page. No system is perfectly secure, so please tell us at once if you think your account has been compromised.

Your rights

Depending on where you live, you may have the right to:

• access the personal data we hold about you and receive a copy, in a portable format where applicable;
• correct inaccurate data;
• delete your data;
• restrict or object to our processing, including processing based on legitimate interests and direct marketing;
• withdraw consent at any time, without affecting earlier processing (for analytics, use Cookie settings);
• opt out of the sale or sharing of personal data and of targeted advertising (we do neither); and
• not be discriminated against for exercising your rights.

How to ask. Email us at privacy@tradecrafthub.ai. We will confirm your identity before we act, and respond within the time the law allows (usually one month, or 30 days in Canada and 45 days in California). You may use an authorized agent; we may ask for proof of their authority. If we refuse a request, we will explain why, and where the law provides it you can appeal by replying to our decision.

If your data is in your organization’s workspace, we will pass your request to that organization, which decides on it as controller.

European Economic Area, United Kingdom and Switzerland

You can complain to the data protection authority where you live or work. We would appreciate the chance to resolve your concern first. To confirm: (Confirm whether an EU or UK representative under GDPR Article 27 is required, and add their details.)

Canada

We handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, including Quebec’s Law 25. Our privacy officer is accountable for our compliance (see Contact us). You may complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner.

United States

Residents of California and other states with comprehensive privacy laws have the rights listed above. In the last 12 months we collected identifiers (such as name, email and IP address), commercial information (subscription records), internet activity (website and service usage, with consent for analytics), approximate geolocation, and professional information (employer and role), from the sources and for the purposes described in this policy. We did not sell or share them, and we do not knowingly collect data from consumers under 16.

Children

Tradecraft and this website are for businesses and are not directed at anyone under 16. We do not knowingly collect their personal data; if you believe we have, contact us and we will delete it.

Changes to this policy

We will update this policy when our practices change and show the date of the latest change at the top. If a change is material, we will tell customers by email or in the app before it takes effect.

Contact us

Questions, requests or complaints about privacy: privacy@tradecrafthub.ai

Customers can reach their account contact or contact us for a copy of our Data processing terms.