Privacy Policy

Last updated: 14 August 2026 · Service: "Counsel AI"

Controller: Jadthena Limited, a company registered in England and Wales (company no. 16232930), registered office: 62 Border Brook Lane, Worsley, Manchester, England, M28 1XJ ("we", "us"). We process personal data under the UK GDPR and the Data Protection Act 2018.

1. Scope

This Privacy Policy explains how Jadthena Limited processes personal data when you visit our site, create an account, and use "Counsel AI". Where we process documents you upload on your behalf, we generally act as your processor and the separate Data Processing Agreement (DPA) governs that processing; this Policy covers the personal data for which we are the controller (e.g. account, billing, and usage data).

2. The personal data we process

• Account data: your email address, organisation name, and role. (Sign-in is passwordless via magic link, so we do not store passwords.)
• Billing data: subscription tier and status, and billing identifiers. Card details are handled by our payment processor (Stripe) — we do not store full card numbers.
• Usage data: which skills you run, counts and timestamps, token/usage metrics, and approximate cost, used for quota enforcement and service operation.
• Customer Content: the documents and prompts you submit to run a skill, and the generated outputs. We process these to provide the Service and retain them only as described in section 6 / the DPA.
• Technical data: logs, IP address, and device/browser information for security and reliability.

3. Why we process it, and our lawful bases

We do not use Customer Content to train third-party AI models; see section 5.

4. AI processing

To generate outputs, the text you submit is sent to the configured AI model provider. By default this is Anthropic (the Claude API) where an API key is configured; otherwise the Service uses a locally-hosted open model (Ollama) running on our own infrastructure. The locally-hosted path keeps inputs on our infrastructure.

Where Anthropic processes your content:

• Your inputs and outputs are not used to train Anthropic's models.
• Anthropic retains API inputs and outputs for up to 30 days for trust-and-safety purposes, after which they are deleted. Zero-data-retention is not available for the Claude 5-series models this Service uses, so we cannot offer it.
• Inference is performed by Anthropic PBC in the United States. The Service itself — the application, its database and its stored documents — is hosted in Germany.

Anthropic's retention window is separate from, and shorter than, our own retention period described in section 6. Neither is affected by the other: deleting your data from the Service does not shorten Anthropic's 30-day window, and Anthropic's deletion does not remove anything from ours.

5. Sub-processors

We use the following categories of sub-processor:

The current list, with the controller-required detail, is maintained in the DPA. We impose data-protection obligations on each sub-processor and give notice of changes.

6. Retention and deletion

We keep account and billing data for the life of your account and as required for legal/tax purposes after closure.

Uploaded documents (your Customer Content, including any original file we stored to read it) are deleted automatically once they are older than the configured retention period — 90 days by default, and configurable per organisation. This deletion runs as a scheduled job on our infrastructure.

Analysis outputs are retained for the life of your account: they are the work product you paid for, and deleting them would remove your own history. You can ask us to delete them, and your account, at any time (section 8).

We also keep an audit log of actions taken in the Service — sign-ins, uploads, analyses run, and plan changes. It records metadata about those actions, never the contents of your documents, and it is retained beyond the document-retention period so it remains a reliable record. Organisation admins can export it at any time.

7. International transfers

Where personal data is transferred outside the UK/EEA (for example to Anthropic in the USA), we rely on an appropriate transfer mechanism — the UK International Data Transfer Agreement/Addendum, or the EU Standard Contractual Clauses where EU GDPR applies, with supplementary measures where needed.

8. Your rights

Under the UK GDPR, you have the rights to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. Where we rely on consent you may withdraw it. To exercise a right, contact support@counsel-ai.org; we respond within the statutory period (one month under GDPR, extendable for complex requests). For document data we process on your behalf, data-subject requests are routed via the controller (our customer) under the DPA.

9. Complaints

You can complain to the UK's data-protection supervisory authority, the Information Commissioner's Office (ico.org.uk), or to your local supervisory authority if you are outside the UK. We would appreciate the chance to address your concern first at support@counsel-ai.org.

10. Security

We use appropriate technical and organisational measures including encryption in transit, access controls, passwordless authentication, and tenant isolation between organisations. No system is perfectly secure; we will notify you and the relevant authority of a personal-data breach where required.

11. Cookies

We use only essential cookies needed to sign you in and keep the Service working (e.g. a session cookie). If we add analytics or non-essential cookies, we will present a consent mechanism first.

12. Changes and contact

We may update this Policy; material changes are notified in-app or by email. Contact the controller, Jadthena Limited, at support@counsel-ai.org for any privacy matter, including data-protection requests.

*"Counsel AI" produces AI-generated drafts for review by a qualified legal professional. It does not provide legal advice.*