Terms of use

These terms govern samples uploaded to Petrarch, Inc. through a Lindo workspace. Accepting them is a condition of uploading, and the version you accepted is recorded against your address and your workspace.

1. Your workspace is yours

Documents you upload are held in your own workspace. They are not visible to Petrarch staff by default, and no Petrarch employee can read one without a live, time-limited, reasoned grant into your workspace. Taking that grant writes a line in your own audit log, as does every document read performed under it.

That is a property of the software rather than a promise about our conduct. A document read that cannot be written to your audit log is refused rather than served.

2. Nothing reaches Petrarch until you send it

Where your workspace is configured to de-identify, you run the engine, review the output and certify it, and only then release it to Petrarch. Uploading is not sending. The release is a separate act by a named person and is recorded on both sides.

Where your workspace is configured not to de-identify, releasing sends the documents to Petrarch as you uploaded them, unaltered. Nothing in the platform removes, masks or replaces anything on that path.

3. If you de-identify before uploading

A workspace configured not to de-identify is often one where you do that work yourself, before the documents reach us. Where that is the case, the upload page asks you to confirm it, and ticking that box is a statement by you that:

• you have reviewed the documents in this upload;
• you have removed or replaced the personal data in them to your own standard, which you have defined and which you consider adequate for the purpose in section 4; and
• to the best of your knowledge the documents contain no information that identifies a living person.

We rely on that confirmation. Petrarch does not verify it, does not inspect the documents to check it, and does not warrant it to a buyer as our own finding - a buyer is told the material was de-identified by the provider. The standard is yours, and so is the assessment that it was met.

The confirmation is recorded against your address, your workspace and the upload it was given for, in the same way as your acceptance of these terms. If you are not in a position to make it, do not tick the box - ask us to run de-identification for your workspace instead, which is a change we can make the same day.

4. What we use a sample for

A sample is used to prepare, evaluate and broker a data transaction on your behalf, and for nothing else. Specifically:

• We do not train models on it, and we do not permit a recipient to.
• We do not sell or transfer it except as part of a transaction you agree to.
• Where it is shown to a prospective buyer, it is shown for evaluation and review only, under written use restrictions - by default a non-disclosure agreement.
• Processing happens inside our own cloud account. No document is sent to a third-party model provider.

5. How long we keep it

We delete the text extracted from your documents 7 days after the corpus that holds them is certified. That text is the copy a de-identification run reads. Certification is the point at which a named person in your workspace records that a run has produced output fit to be shared. Until that record exists the text is retained, because deleting it would destroy the material the run is performed on.

A sweep inside the database carries out the deletion and runs whether or not anybody has the application open. Once certification has been recorded, neither you nor we can extend the period from the interface. Your documents stay in the corpus with their names, their sizes and their page counts, and the audit trail survives. The extracted text does not.

The files you uploaded are not deleted on that clock. They stay in your workspace, listed and available to download, until you remove them. Deleting a document, a corpus or your workspace deletes the file at the time you do so, and nothing else deletes it.

Your de-identified output stays in your workspace while your account is active, so you can come back and retrieve what you ran. It is what you reviewed and certified. Closing your workspace deletes it.

A copy released to Petrarch is held in Petrarch's own workspace on the same terms. Closing your workspace deletes your copy and does not delete ours.

6. What you are telling us when you upload

• You have the right to provide the material, and providing it does not breach an agreement you are under.
• You are not knowingly uploading special category data, material subject to legal privilege, or anything a court has ordered you to keep.
• You have removed live credentials - API keys, private keys, passwords. These are somebody's security incident rather than personal data, and the sampling kit finds them for you.
• You have not pre-anonymised the sample. Doing so destroys the cross-system linkage that is most of what it is worth, and no downstream process can undo it or detect what got merged.

7. What we do not promise

De-identification is performed with care and reviewed by you before anything leaves your workspace. It is not a guarantee that re-identification is impossible. The certification step exists precisely because the last judgement about a sample belongs to the person who knows what is in it.

8. Ending it

You can close your workspace at any time from the workspace page. Closing deletes your documents, your configuration, your members and your keys after a grace period, and retains the audit log, which is the record of what happened including every time somebody from Petrarch reached in.

9. Law

These terms are governed by the laws of the State of California, without regard to conflict of law rules.