Privacy Policy

Last updated: 11 May 2026

This policy explains how Check My Legals ("we", "us") collects, uses, and protects your personal data when you use checkmylegals.co.uk. We are a UK-based controller of personal data under the UK GDPR and the Data Protection Act 2018.

1. Who is the controller

Contact for all data protection requests: contact@checkmylegals.co.uk. If you believe we've mishandled your data you have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

2. What data we collect

• Account data: email address (used as your sign-in identifier) and a one-way hashed password.
• Session data: a strictly-necessary session cookie used to keep you signed in. No analytics or marketing cookies.
• Uploaded auction packs: the ZIP files you upload and the PDFs we extract from them. These typically contain third-party personal data (vendor names, registered proprietors, executor names, property addresses).
• Analysis reports: the structured output our system produces from each pack, stored against your account.
• Payment history: an audit log of credit purchases (amount, Stripe payment-intent id, date). Card details are processed by Stripe and never touch our servers.
• Technical logs: server logs may contain your IP address and rough request times for security and debugging.

3. Why we process it and the legal basis

• To deliver the service: processing necessary for performance of the contract you accept by signing up. Includes running analyses, storing reports, sending you verification + password-reset emails, charging via Stripe.
• Security and anti-fraud: legitimate interest in detecting abuse and keeping the platform secure. Includes the payment audit log we retain after account deletion.
• Compliance: we may retain certain records to meet statutory obligations (e.g. accounting records).

4. AI processing

To produce the report we send the contents of your uploaded documents to Google's Gemini API, which performs the analysis. The Gemini API is operated by Google LLC in the United States. Google's data processing terms are available at cloud.google.com/terms/data-processing-addendum. The output is informational only — it is not legal advice and is not a sole automated decision under Art 22 UK GDPR.

5. Who we share data with

• Google (Gemini API) — for AI analysis of uploaded documents. US-based.
• Stripe — for payment processing. Stripe is the controller for card data. stripe.com/privacy.
• Our hosting provider — Plesk VPS within the EU.

International transfers to Google in the US are made under the EU/UK Standard Contractual Clauses.

6. How long we keep it

• Uploaded ZIPs and extracted PDFs: deleted automatically 90 days after analysis completes (or fails). You can delete them sooner by deleting your account.
• Analysis reports: kept while your account is active.
• Payment audit: retained 7 years for accounting purposes. After account deletion the user-identifying fields are anonymised; only transaction metadata remains.
• Server logs: rotated and deleted after 30 days.

7. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you (Art 15)
• Rectify inaccurate data (Art 16)
• Erasure / right to be forgotten (Art 17)
• Restrict or object to processing (Art 18 / 21)
• Data portability (Art 20)
• Withdraw any consent you've given
• Lodge a complaint with the ICO

You can exercise the access, portability, and erasure rights yourself via the Account & data page once signed in. For anything else, email contact@checkmylegals.co.uk and we'll respond within one month.

8. Cookies

We use one strictly-necessary cookie: lens_sid, an opaque session token that keeps you signed in. It is HttpOnly, Secure, SameSite=Lax, and expires after 30 days. Strictly necessary cookies do not require consent under the Privacy and Electronic Communications Regulations (PECR). We do not use analytics or marketing cookies.

9. Security

Passwords are stored as argon2id hashes; we never see your plaintext password. All traffic is HTTPS-only. Uploaded files are not directly web-served — they are accessible only via short-lived signed URLs scoped to your account. We periodically review access logs and apply security patches.

10. Changes to this policy

We may update this policy. Material changes will be notified to active accounts by email. The "Last updated" date at the top reflects the most recent revision.

Check My Legals is an informational triage tool and does not provide legal advice. Always commission a full review by a qualified conveyancer before bidding on a property.