Of record
Privacy notice
Last updated 11 June 2026· England & Wales
I.
Who we are
The Counsel (“we”, “us”) provides AI-assisted legal document tooling for England & Wales, at the-counsel.co.uk. We are the data controller for the personal data described here. For any privacy request, contact privacy@the-counsel.co.uk.
II.
What we collect
- Account data — your email, name and profile image, via our authentication provider.
- Documents you submit — the contracts and legal text you upload or paste for review, and any files you generate.
- Reviews & matters — the analyses, scores, actions and notes produced from your documents.
- Audio briefings — generated narration of your reviews.
- Technical data — request logs (IP address, user agent) and usage counters used to operate the service and enforce fair-use limits.
- Usage analytics — aggregated, cookieless page-view and funnel measurements (via Vercel Web Analytics) that help us improve the service. These set no cookies, do no cross-site tracking, and contain no data that identifies you.
III.
How we use it & lawful basis
We process your data to provide the service you ask for (performance of a contract), to keep the service secure and within fair-use limits (legitimate interests), and to send you essential service emails. We do not sell your data, and we do not use your documents to train AI models.
IV.
Who we share it with
To analyse documents and run the service we use the sub-processors below. Document content is sent to the analysis and OCR providers only at the moment you request a review, and is not retained by us for training.
ProcessorRoleData sharedData terms
CloudflareDocument & audio storage (R2); scanned-document OCR (Workers AI)Uploaded files, generated audio and scanned page imagesCustomer DPA
OpenAI retains API inputs for up to 30 days solely for abuse monitoring, then deletes them, and does not use API business data to train its models. Anthropic likewise does not train on commercial API inputs.
Some providers process data outside the UK; where they do, transfers are covered by the providers’ standard contractual clauses and equivalent safeguards.
V.
Retention
We keep your documents, reviews and audio for as long as your account is active so you can return to them. We delete them when you delete the review, the matter, or your account — there is no fixed expiry while your account is open. Deleting your account erases your documents and audio from storage and your records from our database.
Operational records have fixed retention windows: usage records and review-run telemetry are deleted after 365 days, and document-extraction telemetry — which contains no document text — is rotated within 90 days.
VI.
Your rights
Under UK GDPR you can access, correct, export, restrict or erase your personal data, and object to processing. You can delete your account and all associated data at any time from your account settings; this removes your files from storage and your records from our database. You can also download a copy of your data at any time from Settings → Export my data. For any other request, email privacy@the-counsel.co.uk. You also have the right to complain to the Information Commissioner’s Office (ico.org.uk).
VII.
Security
Data is encrypted in transit. Files are stored in access-controlled object storage and every record is scoped to your account. We restrict internal access to what is needed to operate the service.