Business Privacy & Data-Processing Notice

Last updated: 30 June 2026

This notice covers Almost Legal Business (almostlegal.ai/business and the /fleet workspace) and forms part of the Business Terms. It explains where we act as a data controller and where we act as your processor under the UK GDPR. For consumer services, the consumer Privacy Policy applies.

1. The two roles

We are the controller of the data about you and your business — your account, company-verification details, usage and billing data. We are your processor for the personal data about third parties that you put into the platform (for example debtors, drivers, employees and contract counterparties): you decide why and how it is used, and we process it on your instructions to run the tool you asked for.

2. Data we hold as controller

Account & users: names, work email addresses and logins of your seats (via Clerk).
Company verification: company number / business name and registered postcode, and the Companies House record we retrieve.
Billing: plan, seat count and payment status. Card payments are handled by Stripe; we never see or store card numbers.
Usage: which tools you run and when, for billing, support and abuse-prevention.

We use this to provide and bill the service, prevent trial abuse, give support, and meet legal obligations. Our lawful bases are performance of our contract with you and our legitimate interests in running and securing the service.

3. Data we process for you (processor terms / DPA)

The following terms govern our processing of personal data you input (“Customer Personal Data”) and apply where the UK GDPR requires a controller-processor contract (Article 28).

3.1 Subject-matter and detail of processing

Subject-matter	Generating fine appeals, debt-recovery and legal letters, contract reviews and templates from data you submit.
Duration	For the term of your subscription and the short retention period in clause 3.6.
Nature & purpose	Storage and AI-assisted generation of documents on your instructions.
Types of data	Names, contact details, vehicle registrations, amounts owed, contract and case details, and any other personal data you choose to enter. Please do not enter special-category data unless necessary.
Data subjects	Your debtors, drivers, employees, customers, suppliers and counterparties.

3.2 Our obligations

process Customer Personal Data only on your documented instructions (these terms and your use of the product being those instructions), unless required by law;
ensure people authorised to process it are under a duty of confidentiality;
apply appropriate technical and organisational security measures (clause 4);
engage sub-processors only as in clause 3.3 and flow down equivalent obligations;
assist you, so far as reasonably possible, with data-subject requests and with your security, breach-notification and DPIA obligations;
notify you without undue delay on becoming aware of a personal-data breach affecting your data;
on the end of the service, delete or return Customer Personal Data as in clause 3.6;
make available information reasonably needed to demonstrate compliance with Article 28.

3.3 Sub-processors

You authorise the following sub-processors; we will give notice before adding or replacing one so you can object:

Provider	Purpose
Anthropic	AI generation — processes your inputs to produce the document, under a no-training arrangement.
Vercel	Application hosting.
Upstash	Workspace data storage.
Clerk	Authentication / user accounts.
Stripe	Payment processing (billing data only).
Resend	Transactional email delivery.

3.4 No AI training on your data

Customer Personal Data is used only to produce your output. It is not used to train AI models; our AI provider processes it under a no-training arrangement.

3.5 International transfers

Where a sub-processor processes data outside the UK, that transfer is covered by an appropriate safeguard (UK adequacy or the International Data Transfer Agreement / addendum to the EU Standard Contractual Clauses).

3.6 Return and deletion

You can delete cases and documents from your workspace at any time. On termination, we delete Customer Personal Data within 30 days unless we are required by law to keep it, except for backups which expire on our normal cycle.

4. Security

Data is encrypted in transit (TLS) and at rest with our infrastructure providers; access is restricted and authenticated; payment-card data never touches our systems. No system is perfectly secure, but we take measures appropriate to the risk.

5. Your rights and data-subject requests

For data we hold as controller (your account and business data) you have the UK GDPR rights of access, rectification, erasure, restriction, portability and objection — email hello@almostlegal.ai. Where a third party exercises rights over Customer Personal Data, they should contact you as the controller; we will assist you in responding.

6. Retention

We keep account and billing records for as long as you are a customer and afterwards as required for legal, tax and accounting purposes. Customer Personal Data is retained per clause 3.6.

7. Changes and contact

We may update this notice; the date above shows when, and material changes are notified to the account owner. Questions or requests: hello@almostlegal.ai, Almost Legal Limited, 9 Tynwald Street, Douglas, Isle of Man, IM1 1BF. You may also complain to the UK Information Commissioner’s Office (ico.org.uk).