1. Who we are (the controller)
Trance Limited (trading as MyAIDefence) is the controller of your personal data. Contact via our contact form.
2. What we collect
- Account data: name, email, optional phone number, password (hashed using bcrypt)
- Billing data: where you pay for a downstream service (mediation or panel-solicitor retainer), we hold the Stripe customer ID and payment status. Card details are held by Stripe — we never see them
- Service data: the matters you create, questions you ask the AI, documents you attach, drafts the AI generates, conversation history, your interactions with panel solicitors via our service
- Technical data: IP address, browser, timestamps and minimal logs needed to operate the service securely
3. Special category data
The information you choose to share when describing a legal matter may include special category data under UK GDPR Article 9 (for example health, sexual orientation, religious beliefs, criminal records). You disclose this voluntarily for the purpose of obtaining help with your matter. We process it under Article 9(2)(a) (your explicit consent) and to establish, exercise or defend legal claims under Article 9(2)(f). Only share what is relevant to your question.
4. Lawful basis (UK GDPR Article 6)
- Performance of contract — to deliver the service you signed up for
- Legitimate interests — security, fraud prevention, service improvement (we never use your content to train AI models)
- Legal obligation — accounting and tax records, regulatory compliance
- Consent — for any optional marketing communications, withdrawable any time
5. Who we share data with
- Stripe — payment processing
- Anthropic — AI processing of your questions (data sent for inference, not retained for training under their commercial API terms)
- Resend — transactional email delivery
- Hetzner — server hosting (UK / EU data residency)
- Panel solicitors — only if you explicitly choose Panel mode and select a firm; we transmit your matter information to them
We do not sell or rent your data. We do not share it with advertising networks.
6. Where your data is stored
Your data is stored on servers located in the United Kingdom / European Economic Area. Some providers (e.g. Anthropic for AI inference) may process data outside the UK; this is done under appropriate contractual safeguards including the UK International Data Transfer Addendum.
7. How long we keep it
- Account data: while your account is active, plus 6 years after closure for limitation/regulatory purposes
- Service content: while your account is active. You can delete individual conversations any time. On full account deletion, deleted within 30 days except where retention is required by law
- Billing records: 6 years (statutory)
- Backups: rolling 7 days local + offsite
8. Your rights
Under UK GDPR you have the right to: access your data, correct inaccurate data, erase your data, restrict processing, object to processing, port your data to another service, and withdraw consent. Contact us via our contact form to exercise any right. We aim to respond within 30 days.
If you are unhappy with how we handle your data you can complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113.
9. Cookies
See our Cookies Policy.
10. Security
We use TLS encryption for all traffic, encrypted backups, hashed passwords, principle-of-least-privilege access controls, and offsite data backups. No system is perfectly secure; if we have a notifiable breach we will notify the ICO within 72 hours and affected users without undue delay.
11. Children
The service is not intended for under-18s. We do not knowingly collect data from children.