Privacy Policy

Legal Buddha

This policy explains how Legal Buddha uses personal information when you visit legalbuddha.com, create an account, submit a question, buy an answer, request document work, arrange a telephone consultation or contact us. Questions, answers, documents, messages and calls are handled as private service communications and are not published, indexed, used for advertising or used to train artificial intelligence models.

1 Who is responsible for your information

Legal Buddha is the controller of personal information used for the Legal Buddha service. In this policy, "we", "us" and "our" mean Legal Buddha.

For privacy questions, rights requests or data protection complaints, use the support function in your Legal Buddha account and mark your message for the attention of the Data Protection Contact.

2 Information we collect

We collect account and identity information, such as your name or chosen display name, email address, account identifier and authentication records. Authentication is provided through Supabase. We do not have access to your password in readable form.

We collect private service content, including questions, follow up messages, documents you upload, document instructions, answers, offers and other communications with an expert. This content may contain information about you and other people. It is not a public post.

We collect transaction information, such as the service bought, amount, date, currency, payment status, transaction reference and limited card details made available by Stripe. Stripe processes the full card details. We do not store your full card number.

We collect communication and support information, including enquiries, complaints and records of action taken. We may retain scheduling and call metadata for a telephone consultation, but Legal Buddha does not record the call.

We collect technical and usage information, such as IP address, device and browser information, timestamps, login and security events, pages or functions used, and cookie or similar technology identifiers.

3 How we obtain information

Most information comes directly from you when you use Legal Buddha. We also receive transaction information from Stripe, authentication and database information from Supabase, delivery information from Resend, and technical information from our hosting, security and communications providers.

An expert may add notes, an answer or other material created while dealing with your request. If another person submits a document or question that identifies you, we may receive information about you from that person.

4 Why we use information and our lawful bases

We use account information to create, secure and administer your account. We use question and document content to consider a free question, match a request with an expert, prepare and deliver an answer, provide document work, arrange a call and manage the seven day follow up period. This is necessary to take steps at your request before a contract and to perform a contract with you.

We use payment and transaction information to take a one-off payment, issue refunds, prevent payment fraud and maintain accounting records. Legal Buddha does not operate subscriptions, automatic renewals or recurring charges. The lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in preventing misuse and keeping accurate business records.

We use support and complaint information to respond, investigate quality concerns, establish what service was supplied and deal with legal claims. The lawful bases are performance of a contract, compliance with legal obligations and our legitimate interests in resolving disputes and improving service quality.

We use technical and security information to operate, protect and troubleshoot the platform, prevent unauthorised access, enforce our terms and understand service performance. We rely on our legitimate interests in providing a secure and reliable service and, where applicable, compliance with legal obligations.

We do not use automated systems to scan or analyse the substance of questions, messages, answers or uploaded documents for security, abuse detection or content moderation. The assigned expert assesses submitted content manually as part of providing the service. If the expert identifies suspected misuse, illegality, a serious safety concern or a breach of the terms, the expert may refer the relevant content for proportionate manual review by authorised personnel. This is separate from automatic technical operations needed to transmit, store, back up or control access to data, and from payment-fraud or network-security controls applied by the relevant providers to the data they process.

We may use aggregated or anonymised information that no longer identifies an individual to understand overall demand and improve the operation of the platform. We do not sell personal information. We do not publish service content, make it available to other customers or external search engines, use it to target advertising, or use it to train or fine-tune artificial intelligence models.

We do not currently send promotional marketing emails. Service messages about an account, purchase, answer, document offer, call or security issue are not marketing. If we introduce marketing, we will provide the information and choices required by law and every marketing message will provide a way to opt out.

5 Sensitive information

Legal questions and documents can reveal special category information, including racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data used for identification, health, sex life or sexual orientation.

Where you voluntarily submit special category information about yourself, we rely on your explicit consent and, where applicable, the condition for processing needed to establish, exercise or defend legal claims. You give explicit consent through a separate unticked confirmation before submitting this type of information. You may withdraw consent at any time, although this does not affect processing that was lawful before withdrawal. If the information is necessary to answer your question, withdrawal may mean that we cannot continue the service.

Information about criminal allegations, proceedings, convictions or offences is subject to separate rules. Where you submit your own criminal offence information, we rely on an Article 6 lawful basis described above and an applicable condition in Schedule 1 to the Data Protection Act 2018, including explicit consent or processing connected with legal proceedings, obtaining legal advice or establishing, exercising or defending legal rights, where the relevant condition applies.

You must not provide sensitive information about another person unless it is relevant and you are entitled to disclose it. Where a question or document contains another person's special category or criminal offence information, we process only what is reasonably necessary to provide the requested service, comply with law or establish, exercise or defend legal rights. Your consent cannot operate as consent on behalf of another person.

6 Who receives information

Before an expert takes on a question, experts can see only its category. The expert assigned to a request can view the question, relevant account details and documents needed to provide the service.

To give you consistent answers with proper context, the expert assigned to your question can also see your earlier questions on Legal Buddha and the answers given to them, including those written by other experts. This is limited to the text of those earlier questions and their published answers. It does not include your follow-up messages, documents you uploaded, service requests or payment details from those earlier matters. Questions we have removed from the service are not included.

Experts are independent contractors engaged under written confidentiality and data protection obligations. They may download a document only where necessary for the assigned work and must use it only for that matter, protect any local copy and delete that copy when it is no longer needed. Apart from the access described above, another expert will not receive the content unless the matter must be reassigned or additional expertise is required, in which case access will remain limited to what is necessary. An expert may have independent legal or regulatory duties if their profile expressly identifies a regulated professional status.

Authorised Legal Buddha personnel may access service content only where necessary to provide support, administer or reassign the service, investigate a complaint or manually review a matter referred by an expert, protect legal rights or comply with law. Access does not create a solicitor and client relationship or legal professional privilege. The contractual duty to handle information confidentially is distinct from privilege.

We use Supabase for database, file storage and authentication services; Vercel for website hosting and delivery; Resend for transactional email; and Stripe for payment processing. These providers receive only the information needed for their function and process it under contractual and security arrangements. Transactional emails should direct you to the private account area rather than reproduce the full question, answer or uploaded document unless including content is necessary for the service and appropriate. Depending on the function used, a provider may act as our processor or as a separate controller for limited information, such as its own account, fraud prevention or legal compliance data.

We may share information with professional advisers, insurers, auditors, courts, regulators, law enforcement or other public authorities where reasonably necessary to obtain advice, protect rights, investigate wrongdoing or comply with law. We may disclose information as part of a genuine sale, reorganisation or transfer of the business, subject to appropriate confidentiality and data protection safeguards.

We do not give experts full payment card details. We do not sell customer lists or service content, disclose service content to advertisers, or permit providers to use it for their own advertising or artificial intelligence model training.

7 International transfers

Some providers and their subprocessors operate in the United States and other countries outside the United Kingdom. In particular, Vercel, Resend and Stripe may process information internationally, and Supabase processing depends on the project region and subprocessors used.

Where UK personal information is transferred to a country that is not covered by UK adequacy regulations, we use an approved transfer safeguard where required, such as the United Kingdom International Data Transfer Agreement, the United Kingdom Addendum to approved standard contractual clauses, or another lawful mechanism. Where a provider relies on the UK Extension to the EU-US Data Privacy Framework, we check that the recipient and transfer fall within it. We also consider whether additional contractual, technical or organisational measures are needed for sensitive information.

You may contact us for more information about the safeguards relevant to your information.

8 How long we keep information

We retain personal information where we have an ongoing legitimate business need to do so. This includes providing a service you requested, keeping your account available, complying with applicable legal, tax or accounting requirements, preventing payment fraud, safeguarding people, resolving complaints or disputes, and establishing, exercising or defending legal claims.

When we no longer have an ongoing legitimate business need to process personal information, we delete or anonymise it. If this is not immediately possible, for example because the information remains in a backup archive, we securely store it and isolate it from further processing until deletion is possible.

9 Your data protection rights

Depending on the circumstances, you may ask for access to your personal information, correction of inaccurate information, deletion, restriction, or transfer of information you provided. You may object to processing based on legitimate interests and withdraw consent where consent is the basis used. You also have the right not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. Legal Buddha does not currently make that kind of solely automated decision about customers and does not use automated content moderation or abuse scoring for service communications.

These rights are not absolute. For example, we may need to retain information to comply with law or establish, exercise or defend legal claims. We may ask for information needed to verify your identity and locate the relevant records. We normally respond to a valid rights request within one month, subject to any lawful extension.

To exercise a right, use the support function in your Legal Buddha account and mark the request for the attention of the Data Protection Contact.

10 Data protection complaints

You may complain to us if you believe we have infringed data protection law. Please explain what happened, identify the relevant account or service and state what you would like us to do. Submit the complaint through account support and mark it for the attention of the Data Protection Contact.

We will take appropriate steps to facilitate the complaint, acknowledge it without undue delay and within 30 days, investigate it, and respond without undue delay. We will tell you the outcome and, where appropriate, what action we have taken.

You may also complain to the Information Commissioner's Office. Its postal address is Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, and its telephone number is 0303 123 1113. We ask that you contact us first so we have an opportunity to resolve the issue, but you do not have to do so.

11 Cookies, analytics and abuse protection

We use storage and access technologies needed to provide requested functions, namely a sign-in cookie that keeps you signed in and protects your account, and a payment page provided by Stripe, which sets its own cookies. These technologies are used because they are strictly necessary or fall within another applicable statutory exception. We do not use advertising cookies or track you across other websites. Our Cookie Policy lists each technology, what it does and how long it lasts.

We use Vercel Web Analytics, provided by our hosting provider Vercel, to understand in general terms which pages are visited and how the site performs. It does not use cookies or save anything on your device. It records information your browser sends with each page request, such as the page visited, the page that led to it, and general browser, device and country details. We do not send your name, email address or the content of any question, answer or message to it. We use this information to operate and improve the service, relying on our legitimate interests, and not for advertising or to build a profile of you.

To protect the service from abuse, such as repeated attempts to guess a password or automated submission of questions, sign-in requests and messages, we count how often requests come from the same IP address, email address or account within a short period. The IP address, email address or account identifier is converted into a scrambled code (a hash), using a secret key that only our servers hold, before the count is stored, so the count does not hold the address itself. These counts are kept only for as long as needed to apply the limit and are deleted after two days. If a limit is reached, the request is temporarily refused. We rely on our legitimate interests in keeping the service secure.

If we introduce advertising, or analytics or other technologies that save information on your device and are not covered by an exception, we will provide clear information and obtain consent where the law requires it. Where an exception permits use without prior consent but requires an objection mechanism, we will provide a simple way to object. You can also control many technologies through browser settings, although blocking essential technologies may prevent the service from working.

12 Security

We use technical and organisational measures intended to protect personal information, including access controls, secure transmission, authentication safeguards, provider security controls, logging and written confidentiality requirements for experts. Access is limited to the experts described in section 6, authorised personnel and providers who need the information for an authorised purpose.

These safeguards do not include automated scanning or analysis of the substance of service communications for security, abuse or moderation. Content assessment is carried out manually by the assigned expert, with proportionate manual review by authorised personnel only where needed. Infrastructure and payment providers may still apply their own automated network-security, access-control or payment-fraud measures to the limited data they process.

No online service is completely secure. You should use a unique password, protect access to your email and device, and submit only information relevant to the service. If you believe your account or information has been compromised, contact us promptly through account support.

13 Children

Legal Buddha is intended for adults aged 18 or over. We do not knowingly offer accounts or paid services to children. If we learn that a child has submitted personal information contrary to this restriction, we will take appropriate steps to delete it, subject to safeguarding and legal obligations.

14 Changes to this policy

We may update this policy to reflect changes in the service, providers or law. We will publish the revised policy with a new date. If a change materially affects how we use information already collected, we will provide additional notice or obtain consent where required.

15 Contact details

You can contact us, including the Data Protection Contact, through the support function in your Legal Buddha account.