Privacy Policy

Last updated: 6 April 2026

1. Who We Are

Auxilis ("we", "us", "our") is a trading name of [Your Company Name Ltd], registered in England and Wales (Company No. [TBC]). We are the data controller for personal data processed through our platform.

Contact: [email protected]
ICO Registration: [TBC — register at ico.org.uk, £40/year]

2. What Data We Collect

Data	Purpose	Lawful Basis
Name, email, firm name	Account creation and management	Contract (Art. 6(1)(b))
SRA number (optional)	Professional verification	Legitimate interest (Art. 6(1)(f))
Hashed password	Authentication	Contract (Art. 6(1)(b))
Chat queries (text only)	AI processing to provide the service	Contract (Art. 6(1)(b))
Usage metadata (timestamps, query count)	Rate limiting, billing, audit	Legitimate interest (Art. 6(1)(f))

Data We Do NOT Collect

Your documents — files are processed entirely within your browser. The original file never leaves your computer. Only extracted text is sent for AI analysis.
Browsing behaviour — we do not use analytics, tracking pixels, or advertising cookies.
Location data — we do not track your location.

3. How We Process Your Data

When you submit a query, the text is sent to our AI engine for processing. This processing occurs securely within the United Kingdom. Your data is:

Never used to train AI models. This is a contractual guarantee from our infrastructure provider.
Never shared with third parties for marketing or any purpose unrelated to providing the service.
Encrypted in transit using TLS 1.2 or higher.
Not retained beyond your session unless you choose to save chat history (stored locally on your device).

4. Sub-Processors

We use a limited number of sub-processors to provide the service. See our full Sub-Processor List.

5. Data Retention

Data	Retention Period
Account data	Until you delete your account
Chat history	Stored locally on your device. Auto-deleted after 30 days.
Uploaded documents	Never stored — processed in your browser only
Audit logs (metadata only)	12 months, then permanently deleted
AI processing logs	7 days (infrastructure provider), then auto-deleted

6. Your Rights (UK GDPR)

You have the right to:

Access — request a copy of your personal data
Rectification — correct inaccurate data
Erasure — delete all your data (available via the "Delete All Data" button in your dashboard)
Portability — receive your data in a machine-readable format
Object — object to processing based on legitimate interest
Restrict — restrict processing in certain circumstances
Complain — lodge a complaint with the ICO (ico.org.uk)

To exercise any right, email us at [email protected]. We will respond within 30 days.

7. Security Measures

All data processed securely within the UK
Encryption in transit (TLS 1.2+) and at rest (AES-256)
Bcrypt password hashing with salting
JWT token-based authentication with expiry
Rate limiting and prompt injection protection
Session timeout after 30 minutes of inactivity
Immutable audit logging

8. International Transfers

Your data is processed within the United Kingdom. We do not transfer personal data outside the UK unless required to provide the service, in which case appropriate safeguards (UK Addendum to EU SCCs) are in place.

9. Children

Our service is designed for qualified legal professionals. We do not knowingly collect data from anyone under 18.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be notified via email or in-app notification. The "Last updated" date at the top indicates the most recent revision.

11. Contact

Auxilis
[Your Company Name Ltd]
[Your Address]
Email: [email protected]
ICO Registration: [TBC]