Privacy & your data

We ask for the details of your situation only to prepare your report. Because those details can be sensitive, we ask for your clear permission before you share them (UK GDPR Article 9(2)(a)).

What we do with it: we use what you write to research and write your report, we email the report to you, and then we delete those details from our systems. We don’t sell your details, and we don’t use them to train anything of our own. If you’re a member, we keep your cases for as long as your membership lasts — how long, and when they’re deleted.

What we delete

What you write, and your answers to our questions, live in one place — and it is destroyed on every way out:

• If we point you elsewhere at the start, the record is never created at all — we check before we save anything.
• If we point you elsewhere after the questions, it is deleted at that same moment.
• If you withdraw your permission, it is deleted.
• If you don’t finish, it is deleted automatically — usually within about 24 hours.
• If you pay, it is handed to the job that writes your report and deleted from here, so it exists in exactly one place.
• Documents you upload (letters, agreements, photos) are read once, when you add them: we keep only the words we read from them and your description of what they are — never the file itself, and never the picture. Those words travel with what you wrote and are deleted on every way out listed above. A document may mention other people; we use it only to prepare your report. If your browser shows you a small preview of a document you added, that preview is made and kept only in your browser — it is never sent to us — and it is cleared when you sign out.

What we keep, and why

• Your permission record — including after you withdraw. Withdrawing marks it as withdrawn; it does not erase it. That is deliberate: a permission we deleted is a permission we could not evidence, and this record is how we show we were allowed to help you. It holds none of the details of your situation — only which wording you agreed to, what it covered, and when.
• A count of page visits. We count the pages people open without cookies, using a one-way code that changes every day, so it cannot identify you or follow you between days. With it we note the website that sent you (its name, not the page), the approximate area — country, region and town — worked out from your connection, and the type of device and browser, without storing the IP address or anything that identifies you. We keep the count for 90 days.
• A count of the times we pointed someone elsewhere — the reason and the stage, nothing else. We count that we did it, never what you wrote, and the count cannot be linked back to you.
• If you have an account: your name (if you give it at sign-up), the label you chose, the area of law, and the dates and status of your reports. The label is yours to write — we never take it from what you told us, and your name is only ever what you typed.
• If you have an account and add documents to a case: the words we read from each document and your description of it stay with that case — so a new report can use them — until you delete the document or the case. Never the file itself.
• A copy of your report, for 48 hours if you bought it on its own, so you can view or download it from your order page. Then we delete it. (A member’s reports are kept with their cases — see below.)
• The email address you gave for a report you bought on its own, and the area of law it was about, until 48 hours after delivery. Then we delete them. If your report was never delivered, we delete them 15 days after the last activity on your order. If you withdraw your permission, or delete your account, we delete them straight away. We keep our record of the order itself — its reference, what you paid and when, and whether it was delivered or refunded — which holds none of the details of your situation.
• Messages you send us through the website, and the email address you give with them, for 12 months from when you send them. Then we delete them. If you delete your account, we delete the messages about your orders, and those sent from your account’s email address, at the same time. If you withdraw your permission for a report you bought on its own, we delete the messages about that order.
• A record of what our staff do — for example, looking up an order or issuing a refund. It can include what they searched for, which may be your email address. We keep it for 12 months, then delete it.
• Emails that reach our own mailbox about an order — for example, a copy of a message you sent us, or our internal note when a refund is issued. We keep them for 12 months, then delete them.

If you’re a member

While you’re a member we keep your cases, the updates you add, the words we read from your documents, the reports we’ve saved for you and your report history, so you can pick up where you left off.

• If you cancel, your membership carries on until the end of the period you’ve paid for. On that date we permanently delete your cases, the reports we’ve saved for you and your report history. We email you to confirm you’ve cancelled, and again 3 days before the deletion.
• If your membership ends early — because we refund it, or it’s cancelled with immediate effect — we keep your cases for 7 more days, so you can download a copy or rejoin, and then delete them. We email you when it ends, and again 3 days before the deletion.
• If your membership ends because a payment couldn’t be taken, the same 7 days apply, with the same two emails.
• If you close a case, we delete it 30 days later unless you reopen it.
• “Delete my cases now” and withdrawing your permission delete your cases straight away, with no waiting period.
• If you don’t sign in for 12 months and have no current membership, we delete your account.

Reports we’ve emailed you stay in your inbox until you delete them.

Backups

To protect against loss, we take an encrypted backup of our database every night and keep only the 10 most recent. So something deleted from our systems can remain in a backup until the backups that still contain it are replaced — normally no more than about 10 days.

What is outside our systems

Two things genuinely leave us, and we would rather say so than let “we delete it” do work it cannot do:

• To understand your situation, an AI service reads what you write — and it does that before we know whether we can help, because reading it is what decides. So if we end up pointing you elsewhere, your words have already been read by that service.
• Your report is emailed to you. It stays in your inbox until you delete it — the email is yours to keep or remove — and a copy passes through the provider that sends it. If you share an inbox with someone, it’s worth knowing it will be sitting there.

If you choose to speak instead of typing, your browser turns your voice into text using its own speech service (Google in Chrome, Microsoft in Edge, Apple in Safari), so what you say also passes through that service. Typing avoids this.

It is also why we always say “deleted from our systems” and never anything broader. The broader version would be easier to read, and it would not be true.

Withdrawing permission is as easy as giving it, and you can do it at any time. If you bought a report on its own, use “Withdraw permission and delete my order” on your order page — the page you came back to after paying — or contact us through the support form quoting your order reference, and we will do it for you. No account or password is needed: to make sure it’s really you, we email a one-time confirmation link to the address on your order, and nothing is cancelled until you open that link and confirm. Then it’s done: if your report hasn’t been delivered yet, we stop it and refund you in full; if it has, we delete our copy of your report and your details, and there’s nothing to refund. If you have an account, withdraw from My account. Withdrawing deletes the details of your situation. It does not delete the permission record itself, for the reason set out above — we keep the record that you gave permission, never what you told us.

Who is responsible for your data

Where Do I Stand is run by Cognitive Edge AI Ltd, which is responsible for your personal data. Contact: support@wheredoistand.co.uk.

Why we can use it: to prepare and deliver what you buy (our contract with you, UK GDPR Article 6(1)(b)), with your clear permission for the details of your situation (Article 9(2)(a)); to keep the payment and accounting records the law requires (Article 6(1)(c)); and to keep the service secure and count visits without identifying you (our legitimate interests, Article 6(1)(f)). Without the details of your situation we can’t prepare a report.

Who else handles it: companies acting for us — the AI services described above, our email provider, our payment provider and our hosting provider. Some of them are based outside the UK, including in the United States; where your data leaves the UK, it is protected by safeguards recognised under UK data protection law, and you can ask us for a copy of them.

Your rights: you can ask us for a copy of your data, or to correct it, delete it, restrict or object to how we use it, or give it to you in a portable form — get in touch. If you’re unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ico.org.uk).