Who we are
The controller of your personal data is CONSILENA LIMITED, a company registered in England and Wales under company number 17297594, registered office 518 Maurer Court, John Harrison Way, London SE10 0SX, United Kingdom (“Consilena”, “we”, “us”).
Contact for anything in this policy, including your rights: [email protected]. We have not appointed a data protection officer; this address reaches the people responsible for data protection.
Consilena is a software provider, not a law firm. Where a law firm you choose through the lawyer handover acts for you, that firm is a separate controller of the data it receives.
What we collect
- Account data: your name, email address, password (stored only as a hash), sign-in codes and, if you turn it on, two-factor authentication settings.
- Your content: the questions you ask, the documents you upload, your matters, and the answers, drafts and files the service produces for you.
- Billing data: the credit packs you buy, invoices and refunds. Card and account details are entered with our payment provider and are not stored by us.
- Technical data: IP address, browser and device information, sign-in and security events, and service logs.
- Communications: emails we send you (for example sign-in codes and receipts) and messages you send us.
- Lawyer handover: if you ask for a lawyer, the matter summary you approve, after automatic redaction of names, email addresses, phone numbers, IBANs and addresses, and your consent records.
Your content may contain personal data about other people, including special category data. You decide what you upload; please share only what the task needs.
Purposes and lawful bases
| Purpose | Lawful basis (UK GDPR / EU GDPR) |
|---|---|
| Creating your account, signing you in, running the service you asked for (answering questions, processing documents, producing files) | Contract (Art. 6(1)(b)) |
| Selling credits, invoicing, refunds and keeping accounting records | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) for tax and accounting records |
| Keeping the service secure: preventing abuse, fraud and attacks; logging security events | Legitimate interests (Art. 6(1)(f)) in a secure service |
| Service emails (sign-in codes, receipts, important changes) | Contract (Art. 6(1)(b)) |
| Handing a matter to a lawyer you choose | Your consent (Art. 6(1)(a)), given for each handover; explicit consent (Art. 9(2)(a)) where the matter contains special category data |
| Improving the product from aggregated, non-content usage information | Legitimate interests (Art. 6(1)(f)). We do not use your documents or questions to train AI models. |
| Answering requests from authorities and enforcing our terms | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Where your content contains special category data, we process it only to provide the service you asked for and on your instructions.
AI processing
To answer a question, the relevant text of your question and documents is sent to the AI model providers that run the models you selected. Requests are routed with data collection denied, so endpoints that store or train on prompts are not used. We do not sell personal data and we do not train models on your documents.
The service does not make decisions about you that have legal or similarly significant effects (Art. 22). Its output is information for you to check; see the AI disclaimer.
Who processes data for us
We use these service providers (processors), under contracts that limit them to processing on our instructions:
| Provider | What they do | Location |
|---|---|---|
| Amazon Web Services | Hosting, databases and file storage | [confirm region] |
| Cloudflare | Network delivery, DNS and protection against attacks | Global network; US company |
| OpenRouter | Routes AI requests to model providers (including the Claude, GPT and Gemini model families) | US |
| OP Inference | Runs AI models | [confirm] |
| Hugging Face | Runs AI models | US |
| Resend | Sends service emails | US |
| Stripe and PayPal | Take payments for credit packs (whichever you use at checkout) | US / EU |
Law firms you choose through the lawyer handover receive only the redacted summary you approve, and only after you consent and the firm accepts.
International transfers
Some providers above are in the United States or process data there. When personal data leaves the UK or the EEA, we rely on an adequacy decision or adequacy regulations where one applies (for example the UK Extension to the EU-US Data Privacy Framework for certified companies), or on the European Commission’s Standard Contractual Clauses with the UK International Data Transfer Addendum, together with the additional safeguards the provider offers. You can ask us for a copy of the relevant safeguards.
How long we keep data
- Account and content: while your account is open. You can delete matters, documents and conversations at any time; when you close your account we delete your content, except copies in backups, which are overwritten on their normal cycle.
- Billing records: six years after the end of the financial year they relate to, as UK tax law requires.
- Security and service logs: for a limited period needed to investigate incidents, then deleted.
- Sign-in sessions: a session lasts up to 30 days unless you sign out.
- Lawyer handover records: your consent records for as long as the handover could be questioned.
Security
Connections to Consilena are encrypted in transit. Access to production systems is restricted to the people who need it, sign-ins can be protected with two-factor authentication, and security events are logged. No system is perfectly secure; if a breach affects your data, we will tell you and the regulator where the law requires.
Your rights
Under the UK GDPR and the EU GDPR you can ask us to:
- give you a copy of your personal data (access);
- correct data that is wrong (rectification);
- delete your data (erasure);
- restrict how we use it;
- give you your data in a portable format, or send it to someone else (portability);
- stop using it where we rely on legitimate interests (objection);
- withdraw a consent you gave, without affecting what was done before.
Write to [email protected]. We answer within one month, and may ask you to confirm your identity first.
Complaints
Please tell us first, so we can put it right. You can also complain to the UK Information Commissioner’s Office: ico.org.uk/make-a-complaint, telephone 0303 123 1113. If you live in the EU, you can complain to the data protection authority of the country where you live or work.
Children
Consilena is for adults. You must be 18 or over to create an account.
Changes and contact
We will update this policy when our processing changes and show the date at the top. For significant changes we will also tell you by email or in the product.
Cookies are described in the cookie policy. Company details are in the legal notice.