Privacy

Who we are

Legal Graph is run by W&W Contracting Ltd, company number 15284174, registered office 43 Railway Road, Ilkley, England, LS29 8HT. It is the controller of your personal data. Contact: will@legal-graph.com.

Your account

Your Legal Graph sign-in is shared with the other services W&W Contracting Ltd runs: the same email, password and two-step sign-in work on each. What you do in Legal Graph is kept in its own workspace, separate from those services. Resetting your password signs you out everywhere.

What we hold

• Your account: your name, email address, a one-way hash of your password (never the password itself), whether your email is verified and your two-step sign-in settings. If you sign in with Google, the name and email address Google shares with us.
• Sign-in sessions: the IP address and browser details recorded with each session, to keep your account secure.
• Your place: the invitation you used, when you claimed your place and the version of the terms you accepted.
• Your email choice: whether you asked for news about Legal Graph, the words you agreed to and when.
• Your research: the questions you ask, the answers, the searches run for them and the collections you keep, in your Legal Graph workspace.
• Your daily use: how much of your daily allowance you have used, so the allowance can be applied.

Why we use it

To provide Legal Graph to you under its terms: to run your account, answer your questions and keep your collections. To keep the service secure and working: to protect sign-in, apply usage limits and find and fix faults. To send you news only if you asked for it; you can stop at any time. Account and security emails are sent either way.

Who processes it for us

• Amazon Web Services, in the United Kingdom (London): hosting, the database and sending email.
• OpenAI, in the United States: writes the answers. It receives your question, the conversation so far and the passages found.
• Langfuse, in the European Union (Frankfurt): records how each answer was produced, to find and fix faults. For your account it holds technical details only (which steps ran, how long they took and the length of the question and answer), not their words. Kept for 30 days.
• MongoDB Atlas, in the United Kingdom (London): the search index of published sources. It receives the searches run for your questions.
• Google: if you choose Google sign-in, Google confirms your identity to us. Google also provides our email, so messages you send to a legal-graph.com address are held by Google.

Transfers outside the United Kingdom

Some of these processors, including OpenAI, process data in the United States. Those transfers rely on safeguards recognised under UK data protection law: the UK Extension to the EU-US Data Privacy Framework where the recipient is certified to it, or the International Data Transfer Addendum to the European Commission's standard contractual clauses.

How long we keep it

Your account is kept while it is open. Closing your Legal Graph account does not close your account on the other services W&W Contracting Ltd runs. Sign-in sessions end when you sign out or when they expire.

• Your conversations and collections: until you delete them or close your Legal Graph account.
• Service logs: 14 days.
• Records in Langfuse: 30 days.
• Automatic database backups: 35 days.
• A place on the waitlist that is never admitted: 12 months.
• Your email choice and the words you agreed to: for as long as we need them to show your consent.

Your rights

You can ask for a copy of your data, and ask us to correct it, delete it, restrict or object to its use, or give it to you in a portable form. Write to will@legal-graph.com.

If you are unhappy with how we use your data, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

Cookies and storage on your device

Legal Graph uses only the storage it needs to work. The cookie notice lists it.