Privacy Policy

Account information: Email address, full name, phone number, postal address (used as letter sender address).

Case data: Details of your complaint(s), organisation names, case titles, descriptions, desired outcomes, reference numbers.

Interaction logs: Records of your contacts with organisations — dates, times, channels, summaries, promises, outcomes.

Evidence files: Documents, photographs, audio recordings, and other files you upload to support your case.

Generated letters: Letters created using our AI tools, which incorporate your case data.

Payment information: Handled entirely by Stripe. We do not store card details.

Usage data: Pages visited, features used, session duration, browser and device type. Collected via Vercel Analytics and PostHog (analytics opt-in).

Supabase — Database and file storage. Data hosted in the EU (Ireland region). Privacy policy

Stripe — Payment processing. Your card data is processed by Stripe and never stored on our servers. Privacy policy

Anthropic (Claude API) — Letter drafting and case insights. Your case data is sent to Anthropic to generate content. Anthropic does not use API inputs to train their models. Privacy policy

Hugging Face — Text summarisation and classification for interaction summaries. Privacy policy

Resend — Transactional email delivery. Used to send reminders and notifications. Privacy policy

Vercel — Hosting and deployment. Privacy policy

PostHog — Product analytics. Anonymised usage data with opt-in analytics. Self-hosted or EU-region option. Privacy policy

You have the right to:

• Access — request a copy of all personal data we hold about you
• Rectification — correct any inaccurate data
• Erasure — request deletion of your account and all associated data
• Data portability — export your data in machine-readable format (available from Account Settings)
• Restriction — restrict processing of your data in certain circumstances
• Object — object to processing based on legitimate interests
• Withdraw consent — for any processing based on consent (e.g. marketing emails)

To exercise any of these rights, email privacy@theypromised.app. We will respond within 30 days.

We retain your data for as long as your account is active. When you delete your account:

• All case data, interactions, letters, and evidence are deleted immediately
• Payment records are retained for 7 years for tax purposes (as required by HMRC)
• Anonymised, aggregated analytics data may be retained indefinitely

We use essential cookies only by default:

• Authentication session cookies (Supabase)
• CSRF protection

Analytics cookies (PostHog) are opt-in only. We do not use advertising or third-party tracking cookies.