Legal
Privacy Policy
How we handle personal data when you use Lawyers Deck, written to meet UK GDPR and the Data Protection Act 2018.
Effective date: [DATE — to be set at launch]
1. Controller
Byte Cognetics Ltd [registered office — to be confirmed] is the controller of personal data processed through Lawyers Deck. Privacy questions: privacy@lawyersdeck.co.uk. [ICO registration number — to be confirmed.]
2. What we collect
| Data | Source | Purpose and lawful basis |
|---|---|---|
| Name, email address, profile picture, sign-in provider ID | You, or Google / Apple / Microsoft when you sign in with them | Create and secure your account (contract) |
| Password hash (password sign-in only) | You | Authentication (contract). We never store the plain password. |
| Research questions, chat history, case files, bookmarks, saved searches, notes | You | Provide the Service (contract) |
| Usage counters and activity events (searches run, AI messages, briefs opened, plan-limit denials) | Generated by the Service | Enforce plan allowances, improve the product, detect abuse (contract, legitimate interests) |
| Subscription status, Stripe customer ID, invoice history | Stripe | Billing (contract, legal obligation to keep accounting records) |
| IP address, browser type, error reports and diagnostics | Your device, our error-monitoring provider | Security, rate limiting, fixing faults (legitimate interests) |
We do not collect card numbers; payment details are entered directly with Stripe. We do not use the Service to profile you or make automated decisions with legal effect.
3. Data sent to AI providers
To answer research questions and generate case briefs we send text to third-party AI models. What is sent:
- Judgment text (already public, from The National Archives) and the metadata we hold about it.
- Your questions and the conversation so far in a research chat, so the model can answer in context.
- Search queries, when converted into embeddings for semantic search.
Current providers and where they process data:
- Google (Gemini API) — case briefs, storylines, embeddings. Data may be processed outside the UK; transfers rely on the UK International Data Transfer Addendum to Google’s standard contractual clauses.
- OpenAI (API) — research chat. Processed in the United States under OpenAI’s Data Processing Addendum; API inputs are not used to train OpenAI models.
We instruct these providers not to retain inputs beyond what their abuse-monitoring terms require (typically up to 30 days) and not to use them for training. Do not enter client-identifying or privileged material into the Service unless your own confidentiality obligations allow it; the Service is designed for research on public judgments.
4. Other processors
- Amazon Web Services (Ireland / London regions) — hosting, database, file storage.
- Stripe Payments Europe Ltd — subscriptions and payments.
- Twilio SendGrid — transactional email (sign-in links, receipts, notices).
- Sentry (Functional Software Inc.) — error monitoring; receives the error, page URL, browser and a pseudonymous user ID, not your questions or case content.
- Upstash — rate limiting (IP addresses, short-lived).
We do not sell personal data and do not use advertising networks.
5. Retention
- Account and research content: for as long as your account exists. Deleting your account removes it within 30 days, except invoices and billing events, which we keep for 6 years for tax and accounting purposes.
- Usage counters: the current and previous billing period, then aggregated.
- Activity events and usage logs: 12 months, then deleted or anonymised.
- Error reports: 90 days.
- Server access logs: 30 days.
6. Your rights
Under UK GDPR you can ask for access to, correction of, deletion of, or a portable copy of your data, object to or restrict processing based on legitimate interests, and withdraw consent where that is the basis. You can delete your account yourself from Settings. For other requests email privacy@lawyersdeck.co.uk; we respond within one month. You can complain to the Information Commissioner’s Office (ico.org.uk).
7. Security
Data is encrypted in transit and at rest. Access is limited to staff who need it. Passwords are hashed with bcrypt. We will notify you and the ICO of a personal-data breach where the law requires.
8. International transfers
Our servers are in the EU/UK. Some processors listed above process data in the United States under the UK Extension to the EU–US Data Privacy Framework or the International Data Transfer Addendum, as noted.
9. Children
The Service is not intended for anyone under 18 and we do not knowingly collect their data.
10. Changes
We will post updates here and, for material changes, email account holders before they take effect. See also our Cookie notice.