Privacy Notice
Last updated: 13 August 2026
We hold very little about you: the email you sign in with, the firm details you give us, snapshots of your firm's public web pages, and a Stripe subscription record. We never see your clients' matter data. Evidence history is kept for 12 months. You have the usual UK GDPR rights, including complaining to the ICO.
Who is responsible
FirmProof is the controller of the personal data described here. Contact for anything in this notice: support@firmproof.co.uk.
What we process, why, and the lawful basis
| Data | Purpose | Lawful basis |
|---|---|---|
| Account data — your email address (received from Google or Apple when you sign in) and your name if provided | Creating and securing your account, service emails | Contract (UK GDPR art. 6(1)(b)) |
| Firm details — firm name, website address, SRA number, services offered | Configuring which checks apply to your site | Contract |
| Public website snapshots — pages, excerpts and findings from the site you nominate | Running the monitoring checks and keeping your evidence history; free-scan results are cached for up to 24 hours | Contract; legitimate interests for the free scan |
| Billing data — handled by Stripe; we hold subscription status, not card numbers | Charging for the subscription | Contract; legal obligation (accounting records) |
| Usage and security logs — IP address, request metadata, salted one-way identifiers used for free-scan rate limiting | Keeping the service secure and rate-limited | Legitimate interests |
| Contact and support messages — your name, email address, message text and (for signed-in users) which organisation you belong to | Answering your query; delivered to our support inbox by email | Legitimate interests (responding to you); contract for customer support |
| AI support chat (paid plans) — the questions you type into the in-dashboard assistant | Generating an answer: your chat messages are sent to Anthropic (our AI processor) to produce the reply. Don't paste client-matter data into the chat. We don't store chat transcripts; Anthropic retains API data for up to 30 days for abuse monitoring | Contract (providing the support feature) |
| AI accuracy review of scan findings — excerpts of your firm's public web pages | After each scan, page text already collected from your public website may be sent to Anthropic to double-check the detectors' results (it can only soften findings, never create them). This is the same public content any visitor sees — no account or client data is included | Contract (providing accurate monitoring) |
What we deliberately do not process: client-matter data. The scanner reads only publicly accessible pages of the website you nominate — the same content any visitor sees. Website snapshots may incidentally contain personal data your firm chose to publish (for example solicitors' names on a team page); we hold that only as part of the page snapshot.
How long we keep it
Scan evidence and findings are kept for 12 months on a rolling basis — that period is the product feature (“12-month evidence history”). Account data is kept while your account exists and deleted within 30 days of account deletion, except records we must keep for legal or accounting purposes (held by Stripe or in our accounts). Free-scan results are cached for up to 24 hours, then deleted. Support-chat messages aren't stored by us; contact-form messages live in our support mailbox for as long as the conversation needs.
Who processes data for us
- Supabase (EU region) — database, authentication and storage.
- Stripe — subscription billing and payments.
- Resend (EU) — transactional email (alerts, statements, contact-form delivery).
- Cloudflare — network security, DNS and content delivery.
- Anthropic — AI processing for the in-dashboard support assistant (paid plans) and the post-scan accuracy review of findings (public page excerpts only); retained by Anthropic for up to 30 days.
Details of roles and regions are on the data processing summary. Where a processor operates outside the UK, transfers rest on UK adequacy decisions or the applicable standard contractual clauses / UK addendum.
Your rights
Under UK GDPR you can ask for access to your data, correction, deletion, restriction of or objection to processing, and portability, and you can withdraw consent where consent is the basis. Email support@firmproof.co.uk and we'll respond within one month. You also have the right to complain to the Information Commissioner's Office: ico.org.uk.
See also: Terms of Service · Data processing summary