Privacy Notice
Last updated: March 2026
Chancery AI Limited
Company No. 16939256 | Registered in England and Wales
Registered Office: West End Garage, Cross Cliff Road, Leeds, United Kingdom, LS6 2DR
Effective Date: March 2026
1. Introduction
Chancery AI Limited (“we”, “us”, or “our”) is committed to protecting and respecting your privacy. This Privacy Notice explains how we collect, use, store, and share your personal data when you:
- Visit our website at chancery.ai (the “Website”)
- Access and use the Chancery AI platform (the “Platform”)
- Communicate with us by email, chat, or other channels
We are the data controller responsible for your personal data as described in this notice. This notice is provided in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
This Privacy Notice applies to personal data we collect and control as a data controller (such as Authorised User account information, website visitor data, and communications with us). Where we process personal data on behalf of our customers as a data processor (for example, documents and other content uploaded to the Platform by or on behalf of a law firm), the customer is the data controller for that data and is responsible for providing privacy information to their own clients and data subjects. Our obligations as a data processor are set out in the Data Processing Addendum (Schedule 1 of the Terms of Service).
2. Data Controller
| Organisation | Chancery AI Limited |
|---|---|
| Company Number | 16939256 |
| Registered Address | West End Garage, Cross Cliff Road, Leeds, United Kingdom, LS6 2DR |
| [email protected] |
Chancery AI does not currently have a designated Data Protection Officer. For all data protection enquiries, please contact us using the details above.
3. Personal Data We Collect
We may collect and process the following categories of personal data:
3.1 Contact and Identity Data
- Name, contact details (such as email address, telephone number, and postal address), and professional details (such as job title and company or firm name)
- Account and authentication data (managed via third-party identity providers; we do not store passwords directly)
3.2 Usage and Technical Data
- Technical information such as IP address, browser type and version, operating system, device identifiers, screen resolution, and language settings
- Usage information such as pages visited, features used, time spent on our services, and clickstream data
- Log files, error reports, and performance data
- Website and Platform analytics data collected via third-party analytics tools (see Section 11)
3.3 Communications Data
- Correspondence with us via email, chat, or other channels
- Feedback, survey responses, and support enquiries
3.4 AI Interaction Data
- Queries submitted to AI-powered features within the Platform
- AI-generated outputs and analysis results
- Feature usage patterns for AI tools
3.5 Payment Data (Production Subscriptions Only)
Where applicable for paid subscriptions, payment data (billing contact details, billing address, and transaction metadata) is processed by our third-party payment processor. We do not directly store payment card numbers.
4. Lawful Bases for Processing
We process your personal data on one or more of the following legal bases under Article 6 of the UK GDPR:
| Lawful Basis | When We Rely on It |
|---|---|
| Contract | Where processing is necessary for the performance of a contract with you or your firm, or to take steps at your request prior to entering into a contract (e.g., providing access to the Platform under the Terms of Service, managing your account, fulfilling a paid subscription). |
| Legitimate Interests | Where processing is necessary for our legitimate interests and these are not overridden by your rights (e.g., improving our services, ensuring Platform security, fraud prevention, website and product analytics, responding to enquiries). |
| Legal Obligation | Where processing is necessary for us to comply with a legal or regulatory obligation. |
| Consent | Where you have given clear consent for a specific purpose (e.g., marketing communications). You may withdraw consent at any time. |
5. How We Use Your Personal Data
We use your personal data for the following purposes:
| Purpose | Lawful Basis |
|---|---|
| To provide and manage the Platform and your account | Contract |
| To authenticate you and manage access to the Platform | Contract |
| To operate and improve the Website | Legitimate Interests |
| To communicate with you, including responding to enquiries and sending service updates | Contract / Legitimate Interests |
| To improve and develop our services through usage analytics | Legitimate Interests |
| To ensure the security of our systems and detect fraud or misuse | Legitimate Interests |
| To comply with applicable laws and regulatory obligations | Legal Obligation |
| To send marketing communications | Consent |
6. Data Sharing and Recipients
We may share your personal data with the following categories of recipients:
- Service providers and processors who act on our instructions under a data processing agreement (e.g., cloud hosting, analytics providers). A list of our current sub-processors is available on request by contacting [email protected].
- Website analytics providers (Google Analytics) who process anonymised usage data to help us understand how visitors use our Website.
- AI infrastructure providers who process data as part of Platform AI features, subject to the terms described in the Data Processing Addendum (Schedule 1 of the Terms of Service).
- Professional advisors, including lawyers, auditors, and accountants, where necessary.
- Regulatory authorities, law enforcement, or government bodies where required by law.
- Business partners or potential acquirers in the event of a merger, acquisition, or restructuring (with appropriate confidentiality safeguards).
We do not sell your personal data to third parties.
7. AI Processing
The Platform includes AI-powered features. When you use these features:
- Your inputs (queries, document content) are processed by third-party AI infrastructure providers to generate outputs.
- Our AI infrastructure providers do not use your data to train their AI models.
- In the test environment, AI processing uses Microsoft Azure AI services deployed in the European Economic Area, which are subject to abuse monitoring. This means your inputs and AI outputs may be temporarily retained by Microsoft for the purpose of detecting abuse, and may be reviewed by Microsoft personnel located in the European Economic Area. The EEA is an adequate jurisdiction under UK data protection law. See the Data Processing Addendum (Schedule 1 of the Terms of Service) for full details.
- In the production environment, AI processing uses infrastructure that does not retain data for abuse monitoring, training, or any secondary purpose.
8. International Transfers
Your personal data is primarily stored and processed within the United Kingdom using Microsoft Azure infrastructure.
Where we transfer your personal data outside the United Kingdom (for example, to Sub-processors located in the EEA or United States), we ensure that appropriate safeguards are in place in accordance with the UK GDPR, including:
- Transfers to countries with an adequacy decision from the UK Secretary of State
- The UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses
- Certification under the EU-US Data Privacy Framework (and UK Extension)
You may request further details of the safeguards in place by contacting us.
9. Data Retention
We retain your personal data for as long as necessary for the purposes for which it was collected, or where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested, to ensure that transactions can be processed, or to identify fraud), or to comply with applicable legal, tax, or regulatory requirements. Even if you close your account, we may retain certain information in order to meet our legal, tax, or regulatory obligations.
When we have no ongoing legitimate business need to process your personal data, we will either securely destroy, erase, delete, or anonymise it. If this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible.
10. Your Rights
Under the UK GDPR, you have the following rights:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you. |
| Rectification | Request correction of inaccurate or incomplete personal data. |
| Erasure | Request deletion of your personal data in certain circumstances. |
| Restriction | Request that we restrict the processing of your personal data. |
| Portability | Request transfer of your personal data in a structured, commonly used, machine-readable format. |
| Objection | Object to processing based on legitimate interests or for direct marketing. |
| Withdraw Consent | Withdraw consent at any time where processing is based on consent, without affecting prior lawful processing. |
To exercise any of these rights, please contact us at [email protected]. We will respond within one month of receiving your request.
11. Cookies, Analytics, and Tracking Technologies
Our Website and Platform use cookies and similar technologies to support authentication, enhance your experience, and analyse usage.
Google Analytics
We use Google Analytics on our Website to understand how visitors interact with our pages. Google Analytics uses cookies to collect usage data (pages visited, time on site, referral source). This data is processed by Google LLC in the United States. Google acts as a data processor for some of this data and as an independent data controller for others (such as improving Google’s own services), as set out in Google’s terms. For international transfers, Google relies on Standard Contractual Clauses that explicitly cover UK GDPR. You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
Umami Analytics
We use Umami Analytics on the Platform to understand how users interact with our services. Umami is a privacy-focused analytics tool that does not use cookies and does not collect personally identifiable information. It collects anonymised usage data including pages visited, referral sources, browser and device type, and country of origin. IP addresses are not stored. Umami Analytics is hosted by Umami Software Inc in the United States.
Cookie Management
You can manage your cookie preferences through your browser settings or our cookie consent tool. For detailed information about the cookies we use, please refer to our Cookie Policy available on our Website.
12. Automated Decision-Making
The Platform includes AI-powered features that assist with document analysis, risk assessment, and other legal technology tasks. These features process your data using automated means but are designed as decision-support tools — they do not make decisions that produce legal or similarly significant effects on you without human involvement. All AI-generated outputs require review and validation by qualified legal professionals before being acted upon.
13. Sources of Personal Information
We may receive your personal data from the following sources:
- Directly from you (when you create an account, use the Platform, contact us, or visit the Website)
- From your employer or firm (when they provision your access to the Platform)
- From third-party identity and authentication providers
- From publicly available sources
14. Requirement to Provide Personal Data
Where we need your personal data to perform our contract with you (e.g., to provide access to the Platform and manage your account), providing this data is a contractual requirement. If you do not provide this data, we will be unable to provide the Platform to you.
Where we process your data based on consent (e.g., marketing communications), providing this data is voluntary. You may withdraw consent at any time without affecting your access to the Platform.
Where we process your data to comply with a legal obligation, providing this data is a statutory requirement.
15. Data Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption in transit and at rest, role-based access controls, regular security assessments, and staff training. Details are set out in Annex B of the Data Processing Addendum (Schedule 1 of the Terms of Service).
While we take all reasonable steps to safeguard your data, no method of transmission over the internet is entirely secure.
16. Children’s Data
The Platform is not directed at individuals under the age of 18 as users, and we do not knowingly collect account or registration data from children.
However, documents uploaded to and processed by the Platform by Authorised Users may contain personal data relating to children (for example, in the context of legal cases involving minors). Where such data is processed, the Customer is the data controller and is responsible for ensuring that appropriate safeguards and lawful bases are in place under UK Data Protection Legislation, including any additional protections required for children’s data. Chancery AI processes such data solely as a data processor in accordance with the Data Processing Addendum (Schedule 1 of the Terms of Service).
17. Changes to This Privacy Notice
We may update this Privacy Notice from time to time to reflect changes in our practices, legal requirements, or business operations. Any material changes will be communicated to you via email or through a prominent notice on the Platform. We encourage you to review this notice periodically.
18. Complaints
If you have concerns about how we handle your personal data, we encourage you to contact us first at [email protected] so that we can address your concerns.
You also have the right to lodge a complaint with the Information Commissioner’s Office (ICO):
| Address | Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF |
|---|---|
| Website | ico.org.uk |
| Telephone | 0303 123 1113 |
This Privacy Notice was last updated in March 2026.