1. Who we are
LawFuze AI Systems Limited ("LawFuze", "we", "us"). ICO controller registration confirmed May 2026 — registration number published on the Trust Center. Our DPO can be reached at dpo@lawfuze.com.
2. What we collect
- Account data: name, email, firm name, SRA number, role, login metadata.
- Sign-in with Google or LinkedIn (only if you choose it): from the provider, your name, email address and whether the provider has verified it, your profile picture and an account identifier. We don't receive your password or contacts, and we never post on your behalf. Google and LinkedIn act as independent controllers of your account with them.
- Matter data: documents and notes you upload, prompts you submit, AI outputs we generate for you, audit log entries.
- Usage telemetry: pages viewed, features used, performance metrics. PII is scrubbed from product analytics before it leaves our infrastructure.
- Billing data (Phase 2): Stripe processes card payments; we receive masked card metadata only. Direct debit via GoCardless follows the same model.
3. Lawful bases (UK GDPR Article 6)
- Contract: providing the LawFuze service you have asked us to provide.
- Legitimate interests: security, fraud prevention, product analytics. We are completing a Legitimate Interests Assessment for each use before public launch; ask us for it at dpo@lawfuze.com.
- Legal obligation: audit log retention under SRA guidance, anti-money-laundering checks, tax records.
- Consent: marketing emails and any special-category processing.
4. Where your data lives
Primary hosting: Microsoft Azure UK South (London). We do not use AWS. Encryption at rest is AES-256 (platform-managed keys); TLS 1.2 or higher in transit. Automated, encrypted PostgreSQL backups with point-in-time restore for 14 days, copied to a second UK region. Security measures meet UK GDPR Article 32.
AI inference uses sub-processors that may be located in the EEA or US. The full live list is at /privacy/sub-processors. Where data leaves the UK or EEA we rely on the ICO International Data Transfer Agreement (IDTA) supported by a published Transfer Risk Assessment.
5. AI processing
- We do not train any AI on customer data, prompts, or outputs.
- Anthropic (AI drafting and chat) and Microsoft (search indexing) process data under commercial terms that do not allow training on customer data.
- Every AI output is logged for audit purposes in your firm's immutable audit log.
6. Retention
- Account data: while your account is active, plus 6 years for tax records.
- Audit log entries: 6 years (the limitation period for most claims).
- Matter content: as configured by your firm, default 7 years.
- Marketing list: until you unsubscribe.
- After deletion: files stay recoverable for 30 days and database backups for 14 days, then they are gone for good.
- Data exports you download: deleted after 30 days.
7. Your rights (UK GDPR Articles 12–21 + DUAA 2025 Articles 22A–D)
- Access (Art 15) — request a copy of your personal data.
- Rectification (Art 16) — correct inaccurate data.
- Erasure (Art 17) — delete data we no longer need to keep.
- Restriction (Art 18) — limit processing while a dispute is open.
- Portability (Art 20) — export your data in JSON+ZIP.
- Objection (Art 21) — object to legitimate-interests processing.
- Meaningful human involvement in significant decisions (DUAA 2025 s.80, inserting UK GDPR Articles 22A–D) — request a review by a qualified solicitor of any AI-assisted output you intend to rely on. The Data (Use and Access) Act 2025 replaced the previous Article 22 framework on 5 February 2026; LawFuze's supervisor-review queue is the implementation pathway.
Email legal@lawfuze.com. We respond within 30 days. Inside the product, the /settings/privacy page exposes one-click export and erasure flows.
8. Cookies
See our Cookies Policy. Strictly necessary cookies only by default; analytics and marketing cookies require consent.
9. Complaints
Data-protection complaints go to dpo@lawfuze.com first; we acknowledge within 3 working days and give a substantive response within 30 days (UK GDPR Art 12). The full route map, including product, billing, security and accessibility complaints, is at /complaints. If we don't resolve a data-protection complaint to your satisfaction you may complain to the ICO at ico.org.uk.
10. Changes
We will email all account holders at least 30 days before any material change to this policy. The current version is always at /privacy with a last-updated date at the top.