Legal

Privacy

Last updated · 18 September 2026

Terms · Privacy · DPA · Subprocessors

The short version

Mighty Andy handles commercially sensitive material, and we treat it accordingly.

We collect the information needed to provide, support, secure and improve the Service. During beta periods, Mighty Andy is deliberately more instrumented than we expect the mature product to be. This means we may retain more detailed records about Runs, product behaviour and usage, and members of the Mighty Andy team may inspect those records where useful for understanding what happened.

We do not sell Customer Content.

We do not publish identifiable Customer cases without permission.

We do not provide Customer Content to third-party general-purpose AI providers for the purpose of training their models unless this has been expressly agreed.

We do use infrastructure, AI and technology providers where they are necessary to operate Mighty Andy. Those providers may therefore process Customer Content as part of delivering the Service.

Mighty Andy also learns from feedback, technical failures, evaluations, product telemetry, properly derived patterns and generalised know-how. That does not give us unrestricted rights to repurpose confidential Customer Content.

The current Service is operating in Closed Beta. The retention and instrumentation described below reflect that.

1. Who is responsible for your information

Mighty Andy’s current commercial and financial structure is hosted by:

GUILHEM KUCZYNSKI

Entrepreneur individuel

SIREN: 880 003 629

France

For the purposes of the current Service, GUILHEM KUCZYNSKI is the legal provider of Mighty Andy and is responsible for the personal information Mighty Andy processes for its own business purposes.

You can contact us about privacy at:
[email protected]

Mighty Andy’s legal and corporate structure may change as its United Kingdom operations are established. This Privacy Notice will be updated where responsibility for the processing changes.

2. The two ways we may handle personal data

There is an important distinction between information Mighty Andy processes for itself and information contained in material supplied by a Customer.

Information Mighty Andy controls

For information such as account details, Customer contacts, purchases, support conversations, security information and Mighty Andy’s own product telemetry, Mighty Andy normally determines why and how that information is processed.

For this information, Mighty Andy acts as a data controller.

Personal data inside Customer Content

Tender packs and company material may contain personal information about employees, directors, subcontractors, referees, contracting-authority staff or other people.

Where a business Customer provides that information to Mighty Andy for analysis and determines why it is being processed, the Customer will generally remain the controller and Mighty Andy will process that information on the Customer’s behalf.

For that processing, Mighty Andy generally acts as a data processor.

Our Data Processing Agreement governs that relationship in greater detail.

3. Information we handle

Depending on how you use Mighty Andy, we may handle the following categories of information.

Account and contact information

This may include:

Customer Content

This is the material supplied or authorised for analysis.

It may include:

Customer Content may contain personal data belonging to people other than the person using Mighty Andy.

Run and diagnostic information

Providing a diagnostic creates information about the analysis itself.

This may include:

Product telemetry

During beta in particular, we may record how the Service behaves and how it is used.

This may include:

This instrumentation is intended to help us understand Mighty Andy and improve it. It is not advertising surveillance.

Feedback and support

We may retain:

Transaction and administrative information

Where you purchase Mighty Andy, we may process information associated with:

Payment providers may process payment-card or banking information directly. Mighty Andy does not necessarily receive the underlying payment credentials.

Website and security information

We may collect technical information needed to operate and protect the website and Service, including IP addresses, request logs, security events and basic usage information.

4. Why we use information

We use information for purposes including:

Providing Mighty Andy

To receive material, perform Runs, generate diagnostics, deliver outputs, maintain accounts and provide the functionality the Customer requested.

Supporting Customers

To answer questions, investigate concerns, correct problems, provide additional assistance and understand the history of a Customer relationship.

Securing the Service

To detect abuse, investigate security issues, maintain system integrity, prevent fraud and protect Customer information.

Operating the Closed Beta

Closed Beta exists partly so we can observe how Mighty Andy behaves in real use.

We therefore use more detailed product and Run information during Closed Beta to:

Improving Mighty Andy

We may learn from:

Customer relationships may reveal problems that influence existing features or lead to entirely new services.

This does not mean that Customer Content becomes unrestricted training material.

Running the business

We process information where needed for purchases, accounting, taxation, contracts, legal obligations and the administration of Mighty Andy.

Communicating with Customers and prospective Customers

We may use professional contact information to communicate about the Service, a beta programme, an existing relationship, or relevant Mighty Andy developments.

You may ask us to stop optional commercial communications at any time.

5. Our legal bases

Where Mighty Andy acts as controller, the legal basis depends on why the information is being processed.

We may process information where it is necessary:

Where Mighty Andy acts as processor for personal data contained in Customer Content, we process that information on the Customer’s documented instructions and under the applicable Data Processing Agreement.

6. Closed Beta instrumentation

The current version of Mighty Andy is a Closed Beta.

Closed Beta is intentionally more observable than we expect the mature Service to be.

Usage may be connected to a particular user, account and organisation rather than being analysed only as anonymous aggregate traffic.

Detailed Run records may be retained so we can reconstruct what Mighty Andy inspected, how the diagnostic was produced, where something failed and how later versions behave against the same or similar problems.

Members of the Mighty Andy team may inspect relevant Customer cases, Run traces, outputs and feedback where useful for:

We expect the level of instrumentation, retention and routine human inspection to decrease as Mighty Andy moves through Open Beta and into general availability.

This Privacy Notice will be updated as those practices change.

7. AI and technology providers

Mighty Andy relies on third-party technology to operate.

Depending on the part of the Service being used, providers may include services for:

These providers may process information where necessary to perform their function.

We aim to give providers only the information reasonably required for the service they perform and to use appropriate contractual and data-protection arrangements.

Mighty Andy does not provide Customer Content to third-party general-purpose AI providers for the purpose of training their general-purpose models unless this has been expressly agreed with the Customer.

This does not prevent an AI provider from processing Customer Content transiently where that processing is necessary to perform a Mighty Andy Run under the relevant service arrangement.

Model inference is not tied to a single vendor. It is routed across a set of approved providers and models operated by Mighty Andy on its own infrastructure. Every provider in that set is named in the subprocessor list and subject to the same restriction on training.

The providers currently engaged are published in our subprocessor list, which is updated before a new subprocessor begins processing Customer Content.

8. How Mighty Andy learns without claiming your material

Mighty Andy is intended to become better from experience.

That does not mean that everything passing through the Service becomes Mighty Andy property or unrestricted training data.

Mighty Andy may retain and develop:

Pseudonymised information is not treated as anonymous merely because obvious identifiers have been removed.

Where information remains Customer Content, confidential information or personal data, its use remains subject to the applicable contractual and data-protection restrictions.

9. Retention during Closed Beta

We do not intend to retain every category of information indefinitely.

Different information is useful for different periods.

The following is our current Closed Beta retention approach.

Uploaded Customer Content

Up to 90 days

Raw files supplied for a Run may normally be retained for up to 90 days after completion of the Run or the last related support activity, whichever is later. We may delete them earlier where they are no longer useful, or retain particular material for longer where this has been agreed with the Customer or is reasonably necessary to resolve an active security, contractual or legal issue.

Diagnostic and Run records

Up to 12 months

Working records associated with a Run, including relevant extraction, provenance, diagnostic and technical records, may be retained for up to 12 months after completion of the Run during Closed Beta. This longer period exists so that we can investigate failures, understand product behaviour and compare improvements. Where possible, we may reduce, de-identify or delete information earlier when the same purpose can be achieved without retaining the underlying material.

Product telemetry

Up to 12 months

Closed Beta product telemetry may normally be retained for up to 12 months from collection.

Account and company context

Active, plus 12 months

Account information and contextual information associated with an active Customer or beta relationship may be retained while the relationship remains active and for up to 12 months after the last substantive activity, unless a longer period is required for another stated purpose.

Support and feedback

Up to 24 months

Support conversations, Customer feedback and records of product issues may normally be retained for up to 24 months after the last relevant interaction. Where those records contain copies of Customer Content that are no longer necessary, we may remove the underlying Content while retaining the useful support or product record.

Security information

Up to 6 months

Routine security and technical logs may normally be retained for up to 6 months, unless an identified incident, abuse investigation or legal issue makes longer retention reasonably necessary.

Prospective Customer and waitlist information

Up to 3 years

Professional contact information used for prospective Customer or beta communications may normally be retained for up to 3 years from the last meaningful contact, unless you ask us to stop using it sooner or another lawful reason applies.

Purchases, invoices and legal records

As required by law

Certain financial, accounting, tax, contractual and legal records must be retained for longer periods under applicable law. Those records may therefore survive deletion of the operational Mighty Andy account or Customer Content.

When a retention period ends, information is deleted, anonymised, or moved into appropriately restricted legal or administrative archives where continued retention is required.

10. Deletion requests

You may ask us to delete information by contacting:
[email protected]

Please provide enough information for us to identify the relevant account, Run or material.

Where you are the Customer responsible for Customer Content, we will normally honour requests to remove operational Customer Content earlier than the standard retention period where we can do so without compromising an active service, security investigation or legal obligation.

Deletion is not always absolute.

We may need to retain limited information where required for matters such as:

Where information has been retained for one of these limited purposes, we will not treat that as permission to continue using it for unrelated purposes.

If your personal information appears in Customer Content supplied by an organisation, that organisation may be the controller responsible for your request. You may contact either the organisation or Mighty Andy, and we will assist with the request as required.

11. Security and confidentiality

Mighty Andy treats Customer Content as confidential by default.

We use technical and organisational measures intended to protect information against unauthorised access, loss, alteration or disclosure.

These may include:

Access to Customer Content by Mighty Andy personnel is limited to situations where it is reasonably useful or necessary to provide the Service, support the Customer, investigate a problem, protect the Service or perform legitimate beta evaluation.

Mighty Andy does not claim security certifications or assurances that it does not hold.

If your organisation requires a particular certification, contractual security commitment or vendor-assurance process, contact us before providing material and we will tell you clearly what Mighty Andy can and cannot currently support.

12. International processing

Mighty Andy is currently legally provided from France and is designed primarily for business Customers in the United Kingdom.

Some technology providers used to operate the Service may process information in other countries.

Where data-protection law requires safeguards for an international transfer, Mighty Andy will use an appropriate legal mechanism or provider arrangement for that transfer.

As Mighty Andy’s United Kingdom structure and provider stack develop, this section may be updated to reflect those arrangements more precisely.

13. Cookies and product measurement

Mighty Andy may use cookies or similar technologies that are necessary for the website and Service to function, including security, authentication, sessions and continuity of an active interaction.

During beta, we may also use first-party or similar product-measurement technologies to understand how Mighty Andy is being used and where it fails.

Where a cookie or tracking technology legally requires consent, we will seek that consent before using it.

Mighty Andy does not use Customer Content to build advertising profiles and does not use advertising networks to track Customers across unrelated websites.

14. Automated analysis

Mighty Andy uses automated and AI-assisted analysis as part of the Service.

That analysis may materially inform a business Customer’s understanding of a tender, but Mighty Andy does not make the Customer’s final bid/no-bid decision.

Mighty Andy does not use personal data for the purpose of making solely automated decisions about individuals that produce legal or similarly significant effects on those individuals.

15. Your privacy rights

Depending on the circumstances and applicable law, individuals may have rights concerning their personal information, including rights to:

Not every right applies to every type of processing, and some rights are subject to legal exceptions.

To exercise a privacy right, contact:
[email protected]

We may need to verify your identity before disclosing or changing personal information.

If the relevant information was supplied to Mighty Andy by one of our business Customers, we may need to involve that Customer in handling the request.

You may also raise a concern with the data-protection authority that applies to you.

16. What we do not do

For clarity:

Closed Beta involves greater observation of the Service. It does not eliminate the confidentiality or data-protection commitments described here.

17. Changes to this Privacy Notice

Mighty Andy will change as the product and business mature.

We may update this Privacy Notice to reflect changes in:

Material changes will apply prospectively and will be communicated through the Service, by email, or by another reasonable method where appropriate.

We will not silently use an updated Privacy Notice to create materially broader rights over Customer Content that was supplied under an earlier arrangement.

18. Data Processing Terms

Where a business Customer provides personal data for Mighty Andy to process on its behalf, additional Data Processing Terms apply.

Those terms address matters including:

For matters concerning personal-data processing on behalf of a Customer, the Data Processing Terms prevail over the general Terms of Service to the extent of any inconsistency relating to that processing.

Read the Data Processing Agreement.

19. Contact

Privacy questions, rights requests, deletion requests and data-protection concerns can be sent to:

Mighty Andy

GUILHEM KUCZYNSKI

Entrepreneur individuel

SIREN: 880 003 629

[email protected]

Registered address: 6 allée des Amandiers, 33140 Villenave-d’Ornon, France

Back home