Privacy Notice
Last updated: 30 August 2026
1. Who we are
C8 Index Technologies (EU) Limited, trading as C8 Technologies (“C8”, “we”, “us”), is the data controller for the personal data described in this notice.
- Registered address: Penrose Wharf, Penrose Quay, Cork, T23 XN53, Ireland
- Irish company number: 660194
- Contact: support@c8-technologies.com
This notice covers the C8 FX Hedge service, including its AI-assistant connections (Claude, ChatGPT, Microsoft Copilot), its APIs, and the c8hedge.com and c8-technologies.com websites.
2. What we collect and why
Account and identity data — your email address, name as supplied at checkout, a C8 account identifier, role and account status. Used to create and administer your subscription and to authenticate you. Legal basis: performance of our contract with you.
Sign-in data — one-time sign-in codes generated when you sign in. Codes are stored only as a salted hash, expire after 10 minutes and are deleted on use. We record sign-in events and the time of your last sign-in. Legal basis: performance of contract, and our legitimate interest in securing accounts.
Subscription and billing data — your Stripe customer and subscription identifiers, plan, subscription status and renewal dates. Payment card details are collected and processed by Stripe and are never stored by C8. Legal basis: performance of contract, and compliance with accounting obligations.
Terms-acceptance records — the Terms version you accepted, a cryptographic hash of the exact document shown to you, the checkout session and the acceptance timestamp, kept as evidence that the agreement was formed. Legal basis: our legitimate interest in a reliable record of contract formation, and compliance with legal obligations.
Connection and authorisation data — records of the AI assistants or applications you connect, and the access and refresh tokens issued to them. Legal basis: performance of contract.
Usage data — for each request: your account and user identifier, the tool used, the channel, response status, duration and timestamp. Used for support, billing accuracy, security monitoring and detecting misuse such as credential sharing. Retained for 90 days. Legal basis: our legitimate interests in operating, securing and improving the service.
Support correspondence — the content of any support enquiry you send us and our replies. Legal basis: performance of contract.
Marketplace data — where you subscribe through the Microsoft commercial marketplace, we receive your tenant identifier, purchaser email and plan details from Microsoft. Legal basis: performance of contract.
Website data — c8hedge.com uses HubSpot for website analytics and for the forms you use to contact us, which collect usage and device information using cookies and similar technologies. No cookies are set until you accept them on the banner. c8-technologies.com sets no cookies and carries no analytics. Legal basis: consent.
FX Hedge does not accept or store customer documents or files, and we do not operate a document repository on your behalf.
We do not sell personal data, and we do not use customer content to train third-party artificial-intelligence models.
3. AI assistant connections
You may connect FX Hedge to third-party AI platforms such as Claude (Anthropic), ChatGPT (OpenAI) or Microsoft Copilot. When you do:
- You authenticate with C8 directly. The platform receives a limited, revocable access token, never your password or a C8 API key.
- Anything you type into that platform is processed by that provider under their privacy policy, not ours. Please do not enter confidential, personal or regulated information unless you are satisfied that is appropriate.
- We receive and process the requests those platforms make on your behalf, as described under “Usage data”.
You can disconnect at any time from within the AI platform, or ask us to revoke the connection.
4. Service providers
We share personal data only with providers acting on our instructions:
- Microsoft Azure — hosting, databases, email delivery and application monitoring.
- Stripe — subscription payments and billing. Stripe acts as an independent controller for payment processing under its own privacy policy.
- Microsoft commercial marketplace — where you subscribe through it.
- HubSpot — website analytics, contact forms and customer-relationship management for c8hedge.com (EU instance).
We may also disclose data where required by law, regulation or a competent authority, or to establish, exercise or defend legal claims.
5. Where we process your data, and international transfers
C8 is established in Ireland. As at the date of this notice, the data described above is processed in the following locations:
| Data | Processed in |
|---|---|
| Account, user, sign-in, terms-acceptance and usage records | United Kingdom (Azure UK South; backups replicated to UK West) |
| Financial and authorisation databases | United Kingdom (Azure UK South) |
| FX Hedge application servers | United Kingdom (Azure UK South) |
| Subscription and provisioning service | Ireland (Azure North Europe) |
| Sign-in code email delivery | European Union (Azure Communication Services, data location Europe) |
We do not host your account data in the United States.
Transfers from Ireland to the United Kingdom are made on the basis of the European Commission’s adequacy decision for the United Kingdom. Some of our providers are US-headquartered and may access data from outside the EEA for support and administration; where that happens we rely on the European Commission’s Standard Contractual Clauses together with the provider’s supplementary safeguards.
Stripe processes payment data under its own privacy policy and transfers data to the United States. HubSpot and the Microsoft commercial marketplace also involve processing outside the EEA.
6. How long we keep data
- Sign-in codes: 10 minutes.
- Usage events: 90 days.
- Account, subscription and terms-acceptance records: for the life of the subscription and six years afterwards, to meet contract, accounting and dispute-resolution obligations under Irish law.
- Support correspondence: 24 months from the close of the enquiry.
7. Your rights
Where the GDPR applies you have the right to access your personal data, to have it corrected or erased, to restrict or object to processing, to data portability, and to withdraw consent where processing relies on consent. To exercise these rights, contact support@c8-technologies.com; we will respond within the statutory period.
You may also complain to the Irish Data Protection Commission (www.dataprotection.ie) or to your local supervisory authority.
8. Security
We protect your data with encryption in transit, short-lived and revocable access tokens, hashed sign-in codes, access controls and monitoring. No system is perfectly secure, but we will notify you and the relevant authority of a personal-data breach where the law requires it.
9. Children
The service is not directed at children and we do not knowingly collect data from anyone under 16.
10. Changes
We may update this notice. The current version is always published at https://c8hedge.com/privacy with its “last updated” date. Material changes will be notified to subscribers by email or by in-service notice.