Privacy Policy

WHATWOULDAJUDGESAY LTD (trading as “What Would a Judge Say?”) (“we”, “us”, “our”) is the data controller for personal information collected through this website. We are registered in England and Wales (Company No. 15937694) and registered with the Information Commissioner’s Office (ICO Registration: ZB810938).

Our data protection lead is Karen Arndt. You can contact her, or us generally, about data protection matters at: privacy@whatwouldajudgesay.com

Health and other special category information. Some of what a court considers is health-related, so the form asks whether you, the other party, or a child has a health issue or a special need, and you may add more in free-text answers. This is “special category” data under UK GDPR. We rely on your explicit consent to process it in order to produce your report, and you can withdraw that consent by removing the information or deleting your case. Where you instead ask us to pass documents to a solicitor for legal advice, we rely on the separate condition for establishing, exercising or defending legal claims.

Information about other people. To estimate an outcome we have to record information you give us about the other party, and often about your children and any new partner. We rely on our legitimate interests in providing the service you asked for, kept to what the estimate needs. We never ask you to upload the other party’s Form E.

Your financial data is submitted to Anthropic (Claude) and OpenAI to generate the SmartJudge analysis report. These providers process data under our instructions and are bound by data processing agreements. Data is not used to train their models. The analysis is a decision-support tool only - it is not legal advice (see our Terms of Service).

If you choose to upload your own completed Form E to pre-fill the form, the document is sent to Anthropic (Claude) so the information in it can be read and mapped to your answers. You should only upload your own Form E - not the other party’s. The uploaded file is deleted from our storage once it has been processed, and the extracted data is shown to you to review before anything is saved.

We share data only with the following categories of processor:

• Google Firebase / Google Cloud - authentication, database storage, file storage, serverless functions (EU region)
• Anthropic - AI analysis (your financial data is sent to generate the report)
• OpenAI - AI analysis and document embeddings
• Vercel - web hosting and deployment (EU region where available)
• Resend - transactional email delivery
• Upstash - rate limiting and abuse prevention (stores identifiers such as your user ID or IP address; no case content)
• PostHog - privacy-first, cookieless product analytics (pseudonymous usage events; EU-hosted)
• Sentry - error monitoring (anonymised stack traces; no financial data is included in error events)

Some of these providers are based outside the UK and EEA - in particular Anthropic and OpenAI process data in the United States. Where personal data is transferred outside the UK/EEA, we rely on appropriate safeguards - the UK International Data Transfer Agreement (or Addendum) and the EU Standard Contractual Clauses - under our data processing agreements with each provider.

We do not sell, rent, or trade your personal data with any third party for marketing purposes.

The paid reviews are optional. If you ask for one, we use the name, email address and phone number you give us to arrange the call. We do that because you asked us to, so that we can take the steps needed before any agreement is entered into - not on the basis of consent, and never as a marketing list. We will not add you to marketing without asking you separately.

Judge or barrister review. Your enquiry goes to our own team inbox at What Would a Judge Say?. Your documents are not attached to it. If you tick to share them, a member of the team opens them in your account.

Solicitor review. Your enquiry goes to Paradigm Family Law, a separate law firm. If, and only if, you tick to send them, your SmartJudge report and your Form E draft are attached to that email so its solicitors can review them and contact you about obtaining legal advice. Nothing is sent unless you tick it, and the boxes start unticked. Because your Form E can contain health information, we rely on the condition for establishing, exercising or defending legal claims for that part.

Paradigm Family Law decides for itself how it handles your information once it has it - in data protection terms it is a separate controller, not one of our processors - so its own privacy notice applies to what it does next. If you would rather not send documents up front, leave the boxes unticked and share them on the call instead.

We retain your account and submission data for as long as your account is active and for 7 years thereafter (consistent with UK limitation periods for civil claims). Audit logs are retained for 3 years. You may request earlier deletion - see section 7.

Feedback you submit while signed in is kept for as long as your account is active and is deleted with your account (or earlier via “My Information”). Feedback submitted without an account (anonymous) is automatically deleted after 6 months.

The only cookie we set is a strictly-necessary session cookie (HttpOnly, Secure, SameSite) that keeps you signed in. For product analytics we use privacy-friendly, cookieless tools - PostHog (configured to store nothing on your device: no cookies and no local storage), Vercel Web Analytics (cookieless), and Vercel Speed Insights (cookieless page-performance metrics). We do not use advertising cookies, cross-site tracking, or tracking pixels, and we do not send your email or other identifying details to our analytics. Our anti-fraud protection (Google reCAPTCHA, via Firebase App Check) may set a strictly-necessary security cookie. Because we set no non-essential cookies, no cookie consent banner is required.

Under UK GDPR you have the right to:

• Access - request a copy of all personal data we hold about you
• Rectification - correct inaccurate data
• Erasure - ask us to delete your data (“right to be forgotten”)
• Portability - receive your data in a machine-readable format
• Restriction - ask us to limit how we use your data
• Objection - object to processing based on legitimate interests
• Withdraw consent - where processing is based on consent, withdraw it at any time without affecting prior lawful processing

To exercise any right, use the “My Information” section in the app or email privacy@whatwouldajudgesay.com. We will respond within 30 days.

If you signed in with Apple, deleting your account removes your data and login from our systems. To also revoke the app’s access to your Apple ID, open Settings → your name → Sign in with Apple → What Would a Judge Say? on your device and choose Stop Using Apple ID.

If you are unhappy with how we handle your data you may lodge a complaint with the Information Commissioner’s Office: ico.org.uk/concerns · 0303 123 1113.

All data is encrypted in transit (TLS 1.2+) and at rest. We apply least-privilege access controls, multi-factor authentication for administrative access, and regular security reviews. In the event of a breach that is likely to result in a risk to your rights and freedoms we will notify the ICO within 72 hours and inform affected users without undue delay.

We may update this policy from time to time. Material changes will be notified by email or an in-app notice at least 14 days before they take effect. The date at the top of this page shows when it was last updated.