Terms of use

These terms govern samples uploaded to Petrarch, Inc. through a Lindo workspace. Accepting them is a condition of uploading, and the version you accepted is recorded against your address and your workspace.

1. Your workspace is yours

Documents you upload are held in your own workspace. They are not visible to Petrarch staff by default, and no Petrarch employee can read one without a live, time-limited, reasoned grant into your workspace. Taking that grant writes a line in your own audit log, as does every document read performed under it.

That is a property of the software rather than a promise about our conduct. A document read that cannot be written to your audit log is refused rather than served.

2. Nothing reaches Petrarch until you send it

Where your workspace is configured to de-identify, you run the engine, review the output and certify it, and only then release it to Petrarch. Uploading is not sending. The release is a separate act by a named person and is recorded on both sides.

Where your workspace is configured not to de-identify, releasing sends the documents to Petrarch as you uploaded them, unaltered. Nothing in the platform removes, masks or replaces anything on that path.

3. If you de-identify before uploading

A workspace configured not to de-identify is often one where you do that work yourself, before the documents reach us. Where that is the case, the upload page asks you to confirm it, and ticking that box is a statement by you that:

• you have reviewed the documents in this upload;
• you have removed or replaced the personal data in them to your own standard, which you have defined and which you consider adequate for the purpose in section 4; and
• to the best of your knowledge the documents contain no information that identifies a living person.

We rely on that confirmation. Petrarch does not verify it, does not inspect the documents to check it, and does not warrant it to a buyer as our own finding - a buyer is told the material was de-identified by the provider. The standard is yours, and so is the assessment that it was met.

The confirmation is recorded against your address, your workspace and the upload it was given for, in the same way as your acceptance of these terms. If you are not in a position to make it, do not tick the box - ask us to run de-identification for your workspace instead, which is a change we can make the same day.

4. What we use a sample for

A sample is used to prepare, evaluate and broker a data transaction on your behalf, and for nothing else. Specifically:

• We do not train models on it, and we do not permit a recipient to.
• We do not sell or transfer it except as part of a transaction you agree to.
• Where it is shown to a prospective buyer, it is shown for evaluation and review only, under written use restrictions - by default a non-disclosure agreement.
• Processing happens inside our own cloud account. No document is sent to a third-party model provider.

5. How long we keep it

The 7-day clock covers the raw document you upload: it is deleted. The clock is set when the row is written, it is not ours or yours to extend from the interface, and a sweep inside the database enforces it whether or not anybody has the application open. Counts, page totals and the audit trail survive; the raw document does not.

Your de-identified output stays in your workspace while your account is active, so you can come back and retrieve what you ran. It is what you reviewed and certified. Closing your workspace deletes it.

A copy released to Petrarch is held in Petrarch's own workspace under the same 7-day clock. Closing your workspace deletes your copy and does not delete ours.

6. What you are telling us when you upload

• You have the right to provide the material, and providing it does not breach an agreement you are under.
• You are not knowingly uploading special category data, material subject to legal privilege, or anything a court has ordered you to keep.
• You have removed live credentials - API keys, private keys, passwords. These are somebody's security incident rather than personal data, and the sampling kit finds them for you.
• You have not pre-anonymised the sample. Doing so destroys the cross-system linkage that is most of what it is worth, and no downstream process can undo it or detect what got merged.

7. What we do not promise

De-identification is performed with care and reviewed by you before anything leaves your workspace. It is not a guarantee that re-identification is impossible. The certification step exists precisely because the last judgement about a sample belongs to the person who knows what is in it.

8. Ending it

You can close your workspace at any time from the workspace page. Closing deletes your documents, your configuration, your members and your keys after a grace period, and retains the audit log, which is the record of what happened including every time somebody from Petrarch reached in.

9. Law

These terms are governed by the laws of the State of California, without regard to conflict of law rules.