Privacy Notice
Last updated: 18 August 2026
We hold very little about you: the email you sign in with, the firm details you give us, snapshots of your firm's public web pages, and a Stripe subscription record. We never see your clients' matter data. Evidence history is kept for as long as your plan provides — 12 months, 3 years or 6 years — then deleted automatically. You have the usual UK GDPR rights, including complaining to us and to the ICO.
Who is responsible
The controller of the personal data described here is Codable Labs Limited, trading as FirmProof — a company registered in Ireland (CRO no. 755309), registered office: Saint Senan's, Pier Road, Menlo, Galway, H91 E066, Ireland. We are registered with the UK Information Commissioner's Office as a data controller — ICO registration reference ZC223489. Contact for anything in this notice: support@firmproof.co.uk.
What we process, why, and the lawful basis
| Data | Purpose | Lawful basis |
|---|---|---|
| Account data — your email address (received from Google or Apple when you sign in) and your name if provided | Creating and securing your account, service emails | Contract (UK GDPR art. 6(1)(b)) |
| Firm details — firm name, website address, SRA number, services offered | Configuring which checks apply to your site | Contract |
| Public website snapshots — pages, excerpts and findings from the site you nominate | Running the monitoring checks and keeping your evidence history; free-scan results are cached for up to 24 hours | Contract; legitimate interests for the free scan |
| Billing data — handled by Stripe; we hold subscription status, not card numbers | Charging for the subscription | Contract; legal obligation (accounting records) |
| Usage and security logs — IP address, request metadata, salted one-way identifiers used for free-scan rate limiting | Keeping the service secure and rate-limited | Legitimate interests |
| Contact and support messages — your name, email address, message text and (for signed-in users) which organisation you belong to | Answering your query; delivered to our support inbox by email | Legitimate interests (responding to you); contract for customer support |
| AI assistant (Practice and Firm plans) — the questions you type into the in-dashboard assistant | Generating an answer: your chat messages are sent to Anthropic (our AI processor) to produce the reply. Don't paste client-matter data into the chat. We don't store chat transcripts; Anthropic retains API data for up to 30 days for abuse monitoring | Contract (providing the support feature) |
| AI accuracy review of scan findings — excerpts of your firm's public web pages | After each scan, page text already collected from your public website may be sent to Anthropic to double-check the detectors' results (it can soften a finding, or confirm one using evidence quoted verbatim from the page and mechanically verified — it never creates findings). This is the same public content any visitor sees — no account or client data is included | Contract (providing accurate monitoring) |
What we deliberately do not process: client-matter data. The scanner reads only publicly accessible pages of the website you nominate — the same content any visitor sees. Website snapshots may incidentally contain personal data your firm chose to publish (for example solicitors' names on a team page); we hold that only as part of the page snapshot.
Cookies
We set strictly necessary cookies only — sign-in sessions, the sign-in handshake, and the fair-use limiter on the free scan. No advertising or tracking cookies, and our analytics (Plausible) is cookieless. Every cookie, its purpose and its lifetime is listed in the Cookie policy.
How long we keep it
Scan evidence is kept on a rolling basis for the period your plan provides — that period is the product feature (“evidence history”):
- Solo (1–5 solicitors) — 12 months
- Practice (6–20 solicitors) — 3 years
- Firm (21–50 solicitors) — 6 years
- Group (51+ solicitors / multi-brand) — 6 years
Once evidence passes that window a scheduled job deletes it: the scan record, its page snapshots, the screenshots in storage, and any statement covering the period. Two deliberate exceptions, both so your account still works: the most recent completed scan for each website is always kept — it is what your dashboard shows — and a finding that is still open stays open however old it is, because it describes something currently on your website rather than history.
Account data is kept while your account exists and deleted within 30 days of account deletion, except records we must keep for legal or accounting purposes (held by Stripe or in our accounts). Free-scan results are cached for up to 24 hours, then deleted. AI-assistant messages aren't stored by us; contact-form messages live in our support mailbox for as long as the conversation needs.
Who processes data for us
- Supabase (UK region — London) — database, authentication and storage.
- Stripe — subscription billing and payments.
- Resend (EU) — transactional email (alerts, statements, contact-form delivery).
- Cloudflare — network security, DNS and content delivery.
- Anthropic — AI processing for the in-dashboard support assistant (paid plans) and the post-scan accuracy review of findings (public page excerpts only); retained by Anthropic for up to 30 days.
Details of roles and regions are on the data processing summary. Where a processor operates outside the UK, transfers rest on UK adequacy decisions or the applicable standard contractual clauses / UK addendum.
Your rights
Under UK GDPR — as amended by the Data (Use and Access) Act 2025 — and the Data Protection Act 2018, you can ask for access to your data, correction, deletion, restriction of or objection to processing, and portability, and you can withdraw consent where consent is the basis. Email support@firmproof.co.uk and we'll respond within one month.
If you're unhappy with anything we've done with your data, complain to us first at the same address — a person reads it and replies within one working day, and we treat data-protection complaints with priority. You also have the right to complain to the Information Commissioner's Office at any time: ico.org.uk.
See also: Terms of Service · Data processing summary