Privacy Policy

1. Information We Collect

Personal information you provide

We may collect personal information that you voluntarily provide when using our Service, including:

• Name and email address
• Company name and business contact details
• Account credentials and profile information
• Content you submit through the Service (prompts, case details, correspondence text, and generated letters you choose to save)

Before user inputs are transmitted to external AI providers, they are processed by an automated PII masking gateway that detects and replaces common personal identifiers. This gateway acts as the primary safeguard for data hygiene. As additional good practice, we encourage you to avoid entering unnecessary personal data about third parties where practical, but manual redaction is not required as a precondition for using the Service.

Usage data

We automatically collect certain information when you access the Service, including:

• IP address and browser type
• Pages visited and features used
• Date and time of access
• Device and technical information
• Log data relating to security and performance of the Service

Documents and PDFs

Where you upload or open a typed, text-based PDF within the Service, the document is processed in your browser using a local PDF library. The original file does not leave your device; only extracted text is sent securely to our backend for analysis and generation of responses. We do not store the original file. Scanned PDFs and photographs contain no text to extract, so the page itself is read by the AI (OCR) under zero-retention, no-training terms, and the personal identifiers we can detect are masked in the returned text before any analysis call.

Loss-of-Use Chronology documents

The Loss-of-Use Chronology tool ingests the following case document categories: the engineer's report, the payment pack (including the hire agreement and hire invoice), the GTA Hire Period Validation Form, and repair and hire monitoring notes. The tool has no medical or injury document slot and is not intended to receive medical or injury records. Documents submitted to this tool are held in memory for the length of a single request only. Nothing is written to any table or storage bucket.

The narrow exception is a scanned (image-only) PDF, which the browser cannot read. In that case the file is uploaded to a private temporary storage bucket so it can be OCR'd, then deleted immediately after processing. A scheduled daily job removes any object older than 24 hours as a safety net.

An automated PII masking gateway processes all text before it reaches external AI providers, detecting and replacing common personal identifiers as a built‑in safeguard. The same masking is also applied at the database level, so saved records (correspondence, replies, advice and letters) contain placeholders rather than raw identifiers. While we encourage good data hygiene practices, manual redaction is not a prerequisite for using the Service.

2. How We Use Your Information

We use the information we collect for the following purposes and lawful bases under UK GDPR:

• To provide, operate, and maintain the Service, including AI‑assisted drafting and document generation (performance of a contract).
• To manage your account, billing, and customer support (performance of a contract / legitimate interests).
• To improve and personalise your experience, including troubleshooting, analytics, and feature development (legitimate interests).
• To communicate with you about updates, security alerts, and administrative matters (performance of a contract / legitimate interests).
• To ensure security, prevent fraud and misuse, and protect our rights and those of other users (legitimate interests / legal obligations).
• To comply with legal and regulatory obligations, including responding to lawful requests from authorities (legal obligation).

We do not use your data to train AI models. Our AI provider processes text we send to it to generate responses and does not use that text to train or improve its models.

Before user inputs are transmitted to external AI providers, they are processed by an internal redaction layer that detects and replaces common personal identifiers (person names, both with and without titles, in field labels and salutations, plus email addresses, phone numbers, National Insurance numbers, vehicle registration marks, UK postcodes, dates of birth, bank account details, policy or claim references, and street addresses) using pattern-based rules with safeguards to preserve case-citation party names.

3. Data Sharing and Disclosure

We do not sell your personal information. We may share your information with:

• Service providers and sub‑processors: Third parties that help us operate the Service (hosting, database, AI model providers, monitoring, analytics, and email providers). These parties are only allowed to process personal data on our instructions and under appropriate data protection terms.
• Legal and regulatory requirements: Where required to do so by law or in response to valid legal processes, or to protect our rights, property, or safety or that of others.
• Business transfers: In connection with a merger, acquisition, or sale of all or part of our business, subject to appropriate safeguards.

A current list of named sub-processors with regions and purposes is published in our Compliance Checklist (section 8). A Data Processing Agreement (DPA) is available to enterprise customers on request.

If any service providers are located outside the UK or EEA, we will ensure that appropriate safeguards are in place for international data transfers (such as standard contractual clauses or equivalent measures).

4. Data Security

We implement appropriate technical and organisational measures to protect your personal information, including:

• Encryption of data in transit and at rest
• Database-level PII masking applied automatically on insert and update, so saved records contain placeholders instead of raw personal identifiers
• Automatic 24-hour purge of any temporary files used during scanned-PDF OCR
• Logical separation and row‑level security to isolate each customer's data
• Access controls, authentication measures, and least‑privilege access
• Regular security assessments and monitoring

No method of transmission or storage is completely secure, but we work to maintain security in line with industry standards and legal requirements.

5. Data Retention

CreditHire Assist is designed not to retain personal case data. Uploaded text and the outputs the tool generates are deleted immediately when the user is finished, on session close. A continuous scheduled purge runs as a backstop, so nothing is ever retained beyond 24 hours. If you need to keep an output, save it to your own system using the in-app copy button and re-run the task later if required. The only data we keep is the minimal account record needed to run the subscription.

Special category data: The Service is not intended for special-category data and users are asked not to submit it. We recognise that in credit hire work, health, injury or vulnerability information can incidentally appear in free-text correspondence. Where it does, the same safeguards apply (masking, data minimisation, encryption and immediate deletion), and as data controller the customer remains responsible for the Article 9 lawful basis.

You may request deletion of your account at any time, subject to any legal obligations that require us to retain certain information.

6. Your Rights (UK GDPR)

Under the UK General Data Protection Regulation (UK GDPR), you have the following rights in relation to your personal data:

• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object

To exercise any of these rights, please contact us at info@caseflowautomation.co.uk. You also have the right to lodge a complaint with the ICO at www.ico.org.uk.

7. Cookies

We use essential cookies to ensure the proper functioning of the Service, for example to keep you signed in and secure your session. These cookies are necessary for authentication and security purposes and cannot be switched off in our systems.

We do not currently use cookies for advertising purposes. If we introduce analytics or other non‑essential cookies in future, we will update this policy and, where required, request your consent.

8. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will post the updated version on this page and update the "Last updated" date above. If we make material changes, we may also notify you by email or through the Service.

9. Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us: