Opening…
Skip to content
Data protection for universities
Answers for your data protection review.
Before a PI can use a new tool on a bid, someone has to check where the data goes, who is responsible for it and what AI does with it. This page answers those questions. For anything it doesn’t cover, ask us and we will answer in writing.
EU database storage
The database and files are in Frankfurt. The application and Cortyne AI run in Microsoft Azure, UK South.
You control your data
For proposal content, your institution is the controller and Cortyne acts as your processor.
No training on your data
Cortyne AI runs on Azure OpenAI. Your proposals never train AI models.
Minimal analytics
Product analytics exclude draft text, typed form values and message content.
Where data is stored and processed
Our service providers.
These providers help deliver Cortyne. We describe applicable processor roles, international transfers and material provider changes in our customer documentation.
| Provider | What it does | Where | When it is used |
|---|---|---|---|
| Supabase | Database, sign-in and private file storage | Frankfurt, Germany (EU) | Always |
| Microsoft Azure App Service | Runs the Cortyne application | UK South (London) | Always |
| Microsoft Azure OpenAI | Cortyne AI, as a regional deployment | UK South (London) | Only when someone uses an AI feature |
| Resend | Transactional invitations and service emails if enabled | Provider-controlled infrastructure, subject to its processing and transfer terms | When Cortyne transactional email sending is configured |
| Meta WhatsApp Business Platform | The WhatsApp assistant | Meta’s infrastructure | Only if a user links their own WhatsApp |
Roles
Who is responsible for what.
Cortyne is operated by Innovyance Ltd, a UK company.
- Your institution is the controller of proposal content. What your staff and partners put into a proposal is processed on your instructions, with Innovyance Ltd acting as processor under UK GDPR and, where it applies, EU GDPR.
- We are the controller for running the service. Account administration, security, fraud prevention, support and our own business records.
- ICO-registered data controller. Innovyance Ltd is registered with the UK Information Commissioner’s Office for its controller activities.
- A data processing agreement before you start. We will review your institution’s template, or provide ours, before your first proposal.
- Partners are invited by you. When a coordinator invites a partner, the partner’s contact details are added on the coordinator’s instructions. Partners can ask us to delete their own account at any time.
Data collection
What we collect, and what we don’t.
Only what a collaborative bid needs, plus the records that keep it secure.
What Cortyne holds
- Names, work email addresses, job titles and the organisation a person belongs to
- Organisation profiles: capabilities, past projects, publications and facilities
- Proposal content: needs, EOIs, work packages, person-months, budgets, Part A details and Part B text
- Messages, comments and suggestions written inside a proposal
- Sign-in, security and audit records, such as who changed what and when
- Minimal product analytics, described below
What product analytics exclude
- Keystrokes or draft form-field values in product analytics
- Proposal text, messages or emails in product analytics
- Clipboard contents, screenshots or audio/video recordings in product analytics
- Advertising cookies or third-party tracking
Product analytics. To find out which parts of Cortyne are hard to use, we record events such as which area was opened, how long a step took, where a form was rejected and when help was used. These events are kept for up to 90 days and then deleted or combined into totals. They set no analytics cookie. You can object to them by contacting us.
Cortyne AI
What AI does with your data.
AI runs only when someone uses an AI feature, and only on what that person is already allowed to see.
- A regional deployment in the UK. Cortyne AI uses a Microsoft Azure OpenAI deployment in UK South, set up as Standard regional, so requests are processed in that region rather than routed globally.
- No model training. Your data is not used to train foundation models. Cortyne requests that supported AI responses are not stored for model features, while Microsoft’s separate abuse-monitoring arrangements may apply as explained below.
- Review before applying AI extraction. When you bring an existing bid document, Cortyne AI proposes information from the source. You can check and correct it before creating a proposal.
- No automated decisions about people. AI summarises, compares and drafts. Choosing partners and anything sent to a partner stays a human decision.
- The smallest context that works. Each AI task gets only the data it needs. For example, an EOI summary leaves out contact details, internal notes and other partners’ responses.
One thing to know. Like all Azure OpenAI customers, Cortyne is subject to Microsoft’s abuse monitoring, under which Microsoft may keep prompts and completions for a limited time for review by authorised Microsoft staff. That data is not used for training. Details are in Microsoft’s data privacy documentation.
Retention and deletion
How long we keep data.
- Proposals stay while you need them. A proposal is kept for as long as your institution uses Cortyne, so you can return to it for a resubmission or an audit.
- Deletion when you ask. When your institution asks, we delete its proposals and organisation data, apart from records we must keep for legal, security or audit reasons, and we tell you what those are.
- People can delete their own account. Anyone can start a request from the account deletion page.
- Product analytics for up to 90 days. Then deleted or combined into totals.
For your review
What we can send your team.
- A data processing agreement, or comments on yours.
- This provider list, with notice before any change.
- A description of how data flows between Cortyne, its providers and your partners.
- Answers to your security questionnaire. How access is controlled is described on our security page.
- Our Privacy Notice and Cookie Notice.
Straight answers
Questions universities ask.
Is our proposal data used to train AI?
No. Cortyne does not train models on customer data, and Microsoft states that Azure OpenAI prompts and completions are not used to train foundation models, are not available to other customers and are not available to OpenAI.
Can Cortyne staff read our proposals?
Cortyne Team product roles do not automatically grant access to proposal workspaces. Authorised infrastructure or support access for legitimate service operations is subject to separate controls and applicable contractual duties.
Do partners at other institutions see our data?
Only what you share with them. Each partner sees its own tasks, its own budget and what the coordinator chooses to share, never another partner’s private submissions.
Does data leave the UK and EU?
Cortyne’s primary application and database regions are reported as UK South and Frankfurt. Email, support access, optional WhatsApp and other subprocessors may involve additional processing or international access. We will confirm the current provider locations and applicable transfer safeguards in the customer’s DPA and subprocessor register rather than promise UK/EU-only processing.
Can we review a data processing agreement?
Yes. We can provide our DPA and review an institution’s own terms before personal data is processed on its behalf.
Need something in writing?
Email info@cortyne.com and we will send what your team needs.