Privacy Policy
Last updated 25 September 2026
The short version
- Your documents are private by default. Only you, and people you choose to share a contract with, can see it.
- We send contract text to our AI provider only to produce your analysis and response letters. It is not used to train AI models.
- We don't sell your data, show you ads, or use tracking cookies.
- You can download or delete all your data at any time from your account page.
1. Who we are
Verdikt is operated by [Company legal name] Ltd (company number [Company number]), registered at [Registered office address] ("we", "us"). We are the data controller for the personal data described in this policy. You can contact us about privacy at [privacy@yourdomain.com].
This policy is written to meet the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and, for users in the European Economic Area, the EU GDPR.
2. What we collect and why
| Data | Why we use it | Legal basis |
|---|---|---|
| Account details: email address, password (stored only as a secure hash), and a record of when you accepted our Terms and this policy. | To create and secure your account and prove what you agreed to. | Performance of a contract; legitimate interests (keeping records). |
| Documents you upload: the PDF file, the text extracted from it, and the analysis we generate. | To analyse the contract and show you the results. | Performance of a contract. |
| Your inputs: notes, responses to findings, and response letters you generate or edit. | To save your work and draft response letters when you ask. | Performance of a contract. |
| Agreements you create: the details you enter into the agreement generator and the drafts it produces. | To draft the agreement you ask for and save it to your library. | Performance of a contract. |
| Sharing details: the email address of anyone you share a contract with. | To give that person access to the contract you shared. | Performance of a contract; legitimate interests. |
| E-signatures: the name and email of each person you ask to sign, and for each signer their signature (typed or drawn), when they opened and signed the document, their IP address and device details, plus a fingerprint of the document. | To send the document for signing, record who signed what and when, and produce a signature certificate as evidence. | Performance of a contract (for you); legitimate interests (for other signers, in having a reliable record of the signing). |
| Expert review requests: your name, email, optional phone number and message. | To pass your request to a legal expert so they can contact you. Only when you ask. | Steps taken at your request before entering a contract. |
| Billing details (subscribers): your Stripe customer reference, plan, subscription status and renewal dates. Stripe collects your card and billing address directly; we never see your full card number. | To take payment, manage your subscription and keep financial records. | Performance of a contract; legal obligation (tax and accounting records). |
| Technical data: IP address, browser type, error reports, and a record of when you use AI features (for fair-use limits). | To keep the service secure, prevent abuse and fix problems. | Legitimate interests. |
Sensitive information in your documents
Contracts can include information about you or other people, occasionally including special category data (for example health information in an employment contract). We don't ask for this and we process it only to deliver the analysis you request. Where possible, remove details that aren't needed before uploading.
Other people's information
Contracts usually name other parties. If you upload a document containing someone else's personal data for personal reasons, that is generally covered by the "domestic purposes" exemption. If you use Verdikt for a business, you are responsible for having a lawful basis to share that data with us. Contact us if you need a Data Processing Agreement.
3. How the AI analysis works
When you upload a contract, the text is extracted in your browser and sent securely to our servers, which forward it to our AI provider, Anthropic, to generate the analysis. Response letters, new agreements, answers to your questions and comparisons are generated the same way. Questions you ask aren't stored, and a file you upload only for a comparison is read for that comparison and not kept. Anthropic processes this data on our behalf under its commercial terms, which do not permit it to use the data to train its models. The AI's output is information, not legal advice. See our Disclaimer.
Speaking and listening. If you use the microphone to speak instead of typing, your browser's built-in speech service turns your voice into text (for example Google in Chrome, or Apple in Safari), under that provider's own privacy terms. We never receive your voice, only the text, and only when you send it. "Listen" reads text aloud using voices built into your device.
We do not use automated decision-making that has legal or similarly significant effects on you. The analysis only helps you understand a document; you make every decision.
4. Who we share data with
We never sell your data. We use a small number of trusted service providers (processors) who handle data only on our instructions:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, login and private file storage | [data hosting region] |
| Anthropic | AI analysis of documents and drafting of response letters and agreements | United States |
| Lovable | Hosting the web app and error monitoring | [hosting region] |
| Resend | Sending emails you ask for: reminders, signing invitations and signed copies, and confirmations of expert review requests | United States |
| Stripe | Taking payments and managing subscriptions and free trials | United States and Ireland |
| jsDelivr | Delivers open-source software for reading PDFs and creating PDF downloads. It sees your IP address, never your documents. | Global network |
Legal experts. If you request an expert review, we share your contact details, your message and the relevant contract with an independent, qualified legal expert (such as a solicitor) so they can follow up. We only do this when you ask.
People you share with. When you share a contract, the recipient can see it according to the permission you choose.
People you ask to sign. When you send a document for signature, each signer can see the document, your email address, and the names of the other signers. Once everyone has signed, every signer can download the signed copy, including its signature certificate.
We may also disclose data if required by law, to enforce our Terms, or to protect the rights and safety of our users or others.
5. International transfers
Some providers, such as Anthropic, are based in the United States. Where data leaves the UK or EEA, we rely on appropriate safeguards such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an adequacy decision (including the UK-US Data Bridge and EU-US Data Privacy Framework where the provider is certified).
6. How long we keep data
- Contracts, analyses, notes, responses, letters and agreements you create: until you delete them or your account.
- Your account: until you delete it. Deleting your account permanently removes your contracts, files and everything linked to them.
- Backups: deleted data may remain in encrypted backups for up to 30 days before being overwritten.
- Expert review requests: while your request is active, and deleted with your account.
- Billing records: invoices and payment records are kept by Stripe and us for six years after the end of the tax year they relate to, as UK tax law requires, even if you delete your account.
- Signature requests: until the sender deletes them or their account. If you signed someone else's document, your signature stays in their record, because it is evidence of what was agreed; each signer can keep their own downloaded copy.
7. How we protect your data
- All data is encrypted in transit (HTTPS) and at rest.
- Database access rules ensure only you, and people you've shared a contract with, can read it. Uploaded files sit in private storage, not on public links.
- Passwords are stored only as secure hashes; we can never see them.
- Our team does not look at your documents unless you ask us to for support or we are legally required to.
No system is completely secure. If a breach affecting your data occurs, we will notify you and the regulator where the law requires.
8. Your rights
You have the right to:
- Access your data and take it with you: use "Download my data" on your account page.
- Delete your data: delete individual contracts, or your whole account from the account page.
- Correct inaccurate data, restrict or object to certain processing.
- Withdraw consent at any time, where we rely on consent.
For anything you can't do in the app, email [privacy@yourdomain.com]. We'll respond within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk or your local data protection authority.
9. Cookies and local storage
We don't use advertising or analytics cookies. We store a login token in your browser's local storage so you stay signed in; this is strictly necessary for the service, so it doesn't need consent. Our fonts are hosted on our own servers, so loading a page doesn't send your data to font providers.
10. Children
Verdikt is not intended for anyone under 18. We don't knowingly collect data from children.
11. Changes to this policy
If we make material changes, we'll tell you by email or in the app before they take effect. The date at the top shows when this policy was last updated.
12. Contact
[Company legal name] Ltd, [Registered office address]. [privacy@yourdomain.com]