Privacy Policy

This Privacy Policy explains how O Law Ventures Ltd (Company No. 12857620, England & Wales), trading as Legalpak, collects and uses personal data when you use the Legalpak website and service at legalpak.co.uk.

We are the data controller for personal data collected through the Service. If you have any questions or want to exercise your rights, contact us at privacy@legalpak.co.uk.

1. What we collect

• Account data — name, email address, hashed password, signup IP address, and account timestamps.
• Legal pack content — the text extracted from any PDFs you upload, and any highlights, notes or metadata you add.
• Usage data — timestamps of analyses, entitlement usage, and basic session logs for security & abuse prevention.
• Payment data — Stripe session ID, package purchased, amount, and payment status. We do not store your card details.

2. How we use it (lawful bases)

• To provide the Service — analysing your uploaded pack, storing your highlights, generating your downloadable report (contract, UK GDPR Art. 6(1)(b)).
• To take payment — sharing minimum required data with Stripe (contract, Art. 6(1)(b)).
• To prevent abuse and fraud — throttling signups, detecting duplicate accounts (legitimate interests, Art. 6(1)(f)).
• To comply with law — e.g. accounting records for HMRC (legal obligation, Art. 6(1)(c)).

3. Who we share it with

We use a small number of trusted sub-processors. Each is bound by contract to keep your data confidential and use it only to provide their service to us:

• Anthropic — AI analysis of pack text. Anthropic states it does not use API inputs to train its models by default.
• Stripe — payment processing. Stripe holds your card details, not us.
• MongoDB Atlas / our hosting provider — database and application hosting inside the UK/EU region.

Some of these providers are based outside the UK. Where transfers occur we rely on the UK International Data Transfer Agreement, Standard Contractual Clauses, or adequacy decisions to protect your data.

4. AI training

We do not use your uploaded legal packs or your account data to train AI models, and we do not sell your data to any advertiser, data broker or third party.

5. How long we keep it

• Account data — for as long as your account is open, then up to 12 months after closure for fraud & accounting purposes.
• Uploaded pack content — until you delete the pack, or up to 12 months after account closure.
• Payment records — 6 years from the transaction, as required by UK tax law.

You can delete any pack (including its extracted text and highlights) at any time from your dashboard.

6. Your rights

Under UK GDPR you have the right to:

• Access the data we hold about you;
• Correct data that is inaccurate;
• Delete your account and associated data (“right to be forgotten”);
• Ask us to restrict or object to certain processing;
• Receive a portable copy of your data;
• Complain to the UK Information Commissioner’s Office (ico.org.uk) if you are unhappy with how we handle your data.

To exercise any right, email privacy@legalpak.co.uk. We will respond within one month.

7. Cookies

Legalpak uses only strictly necessary cookies and localStorage entries required to keep you logged in and remember your session (legalpak_token, legalpak_user). We do not use third-party advertising or tracking cookies at this time. If we ever add analytics we will update this policy and ask for your consent first.

8. Security

Passwords are hashed with bcrypt. All traffic to legalpak.co.uk is served over HTTPS. Access to production systems is limited to authorised staff. No system is 100% secure — if we ever become aware of a personal data breach that puts your rights at risk, we will notify you and the ICO in line with our legal duty.

9. Contact

O Law Ventures Ltd (trading as Legalpak)
Company No. 12857620 — registered in England & Wales
Email: privacy@legalpak.co.uk

This policy is a good-faith template for an early-stage UK B2C SaaS. Before go-live, please have it reviewed by a UK-qualified solicitor or data protection officer.