Privacy policy
Plain-English, UK GDPR-aligned. The standard chat overview is local and rule-based. Chat is sent to an AI provider for a Deep Fact-Finding Review only after provider, data-flow and cost disclosure and your explicit opt-in.
Last updated 31 July 2026
1. Who we are (the data controller)
LegallyHeard is a trading name of Legally Heard Limited, registered in England and Wales under company number 17370128, which operates legallyheard.co.uk and is the data controller for the personal data described in this policy. You can reach us at info@legallyheard.co.uk for anything in this policy, including exercising your rights.
2. What we collect
Account data: your name, email address and a hashed password (we never store passwords in readable form).
Case content you upload: message exports (including WhatsApp, email, SMS/MMS, iMessage, Messenger, Instagram, Telegram, Snapchat, LinkedIn, Slack, Microsoft Teams, Skype, Google Chat, Discord, Viva Engage, CSV and JSON), evidence files (photos, video, audio, documents), key moments you catalogue, preserved source originals, and the analyses and reports generated from them. This may include special-category data and data about other people appearing in your messages; we process it solely on your instructions, to provide the service to you.
Payment data: payments are processed by Stripe: Card details go directly to Stripe and we never see or store your card number: We keep the order record (what you bought, when, for how much) and the Stripe transaction reference.
Technical data: server logs (IP address, time, requested page) kept for security and debugging, and the contact-form details you choose to send us.
Demo contact details: the free demo runs entirely in your browser and your messages never leave your device. Before loading your own export we ask for your name, email address, phone number, address and a description of your situation, and we email you a code to confirm the address is yours. We collect those details so we can follow up about LegallyHeard; we store them on our own server, we do not sell or share them, and we never receive the message content you load into the demo. Legal basis: legitimate interests in responding to enquiries, and consent where you ask us to keep you updated. Ask us at info@legallyheard.co.uk and we will delete them.
3. Why we process it (purposes and legal bases)
To provide the service (analysing your uploads, generating reports, managing your account and payments), legal basis: performance of a contract (UK GDPR Art. 6(1)(b)). The Deep Fact-Finding Review is optional: explicit opt-in controls whether chat content is sent to the disclosed AI provider.
To keep the platform secure and prevent abuse (logs, rate-limiting). Legal basis: legitimate interests (Art. 6(1)(f)).
To respond when you contact us: legal basis: legitimate interests, or consent where you ask us to keep you updated.
Where your uploaded content includes special-category data, we rely on Art. 9(2)(f) (establishment, exercise or defence of legal claims), the entire purpose of the service, alongside your explicit instruction to process the material you upload.
4. Where your data lives, and who can see it
Case data is stored on our own dedicated server hosted by Hetzner in Germany: not on a shared analytics platform. Transport is encrypted (TLS). Uploads and reports are stored outside the web root with restrictive file permissions and are reachable through authenticated, owner-checked routes. Authorised staff may access scoped case content where necessary to provide or quality-check a white-glove service, or to operate and secure the platform.
Local overview. The standard chat, email and SMS overview is performed on our server by our own rule-based software. It does not send chat content to an AI provider.
Optional Deep Fact-Finding Review. This premium Court Bundle / white-glove service uses an external AI provider to produce structured findings across overlapping context windows. Before processing, we identify the proposed provider, explain what content will be sent and why, provide the estimated provider cost and relevant safeguards, and ask you to opt in explicitly. No chat is sent to an AI provider unless you opt in after that disclosure. Deterministic tools then deduplicate and synthesise findings, classify direction/directedness and verify quoted wording against the source. The service is not fully automated or currently self-serve.
Optional transcription. Audio needed for an AI draft transcript is sent only after the relevant provider and processing have been disclosed and agreed. Drafts are labelled as such and are not certified transcripts. We do not use customer evidence to train models, sell it or share it for advertising. Current processors include Hetzner (hosting) and Stripe (payments); the applicable AI provider is disclosed before each opted-in deep review or transcription engagement.
5. How long we keep it
Your case content is kept until you delete it. You can delete individual uploads, evidence files, key moments and reports from your case pages at any time, and you can delete your entire account and every file with it, self-serve, from Account settings → “Delete my account & all data”. Deletion removes your data from our database and from disk. Order records may be retained where we are legally required to keep accounting records. Server logs rotate automatically.
6. Your rights
Under UK GDPR you can ask us for access to your data, rectification, erasure (also available self-serve, above), portability (your uploads are your own files; your reports are downloadable PDFs), restriction and to object to processing based on legitimate interests. Email info@legallyheard.co.uk, we respond within one month. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
7. Cookies
We use essential cookies only: a session cookie so you can stay logged in (which also carries the security token that protects forms), and a first-party browser entry that remembers you've dismissed the cookie banner. No tracking, no analytics, no advertising cookies. Details in the cookie policy.
8. Children
The service is for adults (18+) involved in legal matters. We do not knowingly offer accounts to children. Messages you upload may of course mention children; that content is handled with the same protections as everything else, on your instruction.
9. Changes
If we change this policy we will update this page and the date at the top. Material changes affecting how your content is processed will be flagged to logged-in users.