Privacy Policy
Last updated: April 2026
1. Data Controller
Elysia Legal is the data controller for personal data processed in connection with your use of this service. For privacy enquiries, please contact us at privacy@elysialegal.uk.
2. What data we collect
We collect the following personal data:
- Email address and name upon registration
- Legal questions and consultations you submit
- Documents you generate via the service
- Messages sent to solicitors through the platform
- Technical data such as IP address and browser information
3. Purpose of processing
Your data is used to:
- Deliver and improve our services
- Provide you with personalised legal guidance
- Enable communication with connected solicitors
- Comply with legal obligations
- Send relevant notifications and updates
4. Legal basis
Processing is based on contract (UK GDPR Art. 6(1)(b)) for service delivery, consent (Art. 6(1)(a)) for marketing, and legitimate interests (Art. 6(1)(f)) for improvement and security purposes.
5. Sharing of data
We do not share personal data with third parties unless required to deliver the service, required by law, or you have given consent. All sharing complies with UK GDPR and the Data Protection Act 2018. The following categories of third parties may receive data to a limited extent:
- AI providers – for generating legal analyses (content data only, not linked to identity)
- Solicitors on the platform – only data you explicitly choose to share
- Payment service provider (Stripe) – for secure payment processing
- Infrastructure and hosting – for platform operation and security
Google user data (see section 8) is never shared with third parties for advertising or commercial purposes.
6. Storage and security
Data is retained only for as long as necessary for the purpose, or as required by law. We use encryption (TLS in transit, AES-256 at rest) and access controls to protect your data. Our platform provider is certified to ISO 27001 and SOC 2 Type II.
7. Retention and deletion
We retain personal data only for as long as necessary:
- Account data: deleted 30 days after account closure
- Consultations and documents: deleted on request or upon account closure
- Financial records: retained for 6 years in accordance with UK tax law
You may request deletion of your data at any time by emailing privacy@elysialegal.uk. We will respond to such requests within 30 days.
8. Google user data – specific information
Elysia Legal offers sign-in via Google OAuth as an alternative to email/password. Use of Google OAuth is voluntary. The following applies to data we receive from Google when using this sign-in method:
Data we access from Google
When you choose to sign in with Google, we receive only basic profile data:
- Name – to personalise your experience
- Email address – to identify and create your account
- Google account ID – for secure authentication
We access no other Google services, files, calendar, email, or other data from your Google account.
Use of Google data
Data from Google is used solely to create and manage your user account on Elysia Legal and to identify you on subsequent sign-ins. We do not use Google data for profiling, advertising, or automated decision-making.
Sharing of Google data
Data received from Google is not shared with third parties and is not used for advertising or marketing. Data is not transferred outside the UK/EEA without an adequate level of protection.
Storage and protection
Name and email are stored encrypted in our database and protected by access controls. We do not store Google OAuth tokens permanently — tokens are handled only at the moment of authentication by our infrastructure provider.
Retention and deletion
Google data (name and email) is retained for as long as you have an active account on Elysia Legal. Upon account closure, all associated data is removed within 30 days. Submit a deletion request to privacy@elysialegal.uk.
Elysia Legal's use of Google API services complies with the Google API Services User Data Policy, including the Limited Use requirements.
9. Your rights
Under UK GDPR you have the right to:
- Access the personal data we hold about you
- Request rectification of inaccurate data
- Request erasure ("right to be forgotten")
- Object to processing
- Lodge a complaint with the Information Commissioner's Office (ico.org.uk)
Submit requests to privacy@elysialegal.uk.