Privacy Policy

Who we are

Dave.AI Ltd ("Dave.AI", "we", "us", "our") is a company registered in England and Wales. We operate the platform at daveai.law, which provides AI-assisted legal drafting and research tools for legal professionals.

For the purposes of UK GDPR and the Data Protection Act 2018, Dave.AI Ltd is the data controller for personal data collected through this platform.

Contact us: privacy@daveai.law

What data we collect

We collect the following categories of personal data:

• Account data — your name, email address, and firm name provided at registration
• Subscription data — your chosen plan, billing cycle, and payment status (we do not store card details — payments are handled by Stripe)
• Usage data — features you use, documents you generate, and session activity logs
• Technical data — IP address, browser type, device type, and cookies necessary for the platform to function
• Content data — text you submit to our AI tools (contract instructions, document text, legal questions)

How we use your data

We use your personal data to:

• Provide, maintain, and improve the Dave.AI platform
• Manage your account and subscription
• Process payments through our payment provider (Stripe)
• Send you service-related communications (receipts, security alerts, product updates)
• Comply with our legal obligations under UK law
• Detect and prevent fraud or abuse of the platform

We do not use your data for advertising and we do not sell your data to third parties.

AI-generated content and your inputs

When you use our AI tools, the text you submit is transmitted to Anthropic PBC (our AI provider) to generate a response. This transmission is governed by Anthropic's API usage policy.

We do not use your submitted content to train our AI models. Anthropic's data handling policies apply to API interactions; please review anthropic.com/privacy for details.

Legal basis for processing

Under UK GDPR, we rely on the following lawful bases:

• Contract performance — processing necessary to provide the service you have subscribed to
• Legitimate interests — improving our platform, preventing fraud, and ensuring security
• Legal obligation — complying with applicable UK law and regulation
• Consent — where we ask for your permission for specific uses (e.g. marketing communications)

Data sharing and third parties

We share data with the following trusted third-party providers where necessary to operate the platform:

• Supabase Inc. — authentication and database hosting (EU/US data centres)
• Stripe Inc. — payment processing
• Anthropic PBC — AI model inference
• Netlify Inc. — website and function hosting

All providers are contractually bound to handle data securely and in accordance with applicable data protection law. Where data is transferred outside the UK, we ensure appropriate safeguards are in place (such as UK adequacy decisions or standard contractual clauses).

Data retention

We retain your personal data for as long as your account is active and for a reasonable period thereafter to comply with legal obligations. Specifically:

• Account data is retained for the duration of your subscription plus 7 years (for financial record-keeping purposes)
• Usage and content data is retained for 12 months from the date of creation
• You may request deletion of your account at any time — see "Your rights" below

Cookies

We use only essential cookies necessary to operate the platform (session authentication and security). We do not use advertising or tracking cookies. You cannot opt out of essential cookies without losing access to the platform.

Your rights under UK GDPR

You have the following rights regarding your personal data:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests

To exercise any of these rights, email privacy@daveai.law. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

Security

We protect your data using 256-bit TLS encryption in transit and industry-standard security measures at rest. Access to personal data is restricted to authorised personnel only. We will notify you and the ICO of any personal data breach in accordance with our obligations under UK GDPR.

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on the platform. Continued use of Dave.AI after changes take effect constitutes your acceptance of the revised policy.