Privacy policy

1.What we collect

• Account data, if you register: your name, email address and a securely hashed password. Passwords are never stored in readable form.
• Profile data you choose to add: account type, organisation, job title and a home jurisdiction.
• Saved items: the records you bookmark, plus any label or note you attach to them.
• Research assistant conversations: the questions you ask and the answers returned, stored against your account so you can return to them.
• Corrections and messages: what you write in the correction and contact forms, including any source link, organisation and reply address you supply.
• Technical and usage data: aggregate page analytics, and standard server logs such as IP address and browser user agent.

2.What we do not collect

• We do not run advertising trackers and do not sell or rent personal data.
• We do not ask for or want documents, case files or other confidential material. Please do not send them.
• We do not knowingly collect data from children. The atlas is intended for adult professional and research use.

3.Why we hold it

• To operate accounts, keep you signed in, and show you your own saved items and conversations.
• To read, triage and act on corrections, and to reply to enquiries you send us.
• To understand in aggregate which parts of the atlas are used, so research effort goes where it is needed.
• To keep the service secure, including detecting abuse and scraping.

4.Legal bases

Where the UK GDPR or EU GDPR applies, we rely on: performance of a contract, for operating your account; legitimate interests, for security, aggregate analytics and improving coverage; and consent, where you volunteer optional profile information or contact us. You can withdraw consent at any time.

5.Analytics

In production the site uses Vercel Analytics to count page views and referrers. It is configured to measure traffic in aggregate rather than to build advertising profiles of individuals, and it is not loaded in development or preview environments.

6.The research assistant

Questions you put to the research assistant are sent, via the Vercel AI Gateway, to Anthropic’s Claude model in order to generate an answer. The exchange is also stored against your account so you can revisit it.

Do not enter confidential, privileged or personally sensitive details into the assistant. Treat it as you would a search box on a public website.

7.Processors and hosting

The site is hosted on Vercel and its data is held in a managed Neon PostgreSQL database. These providers process data on our instructions in order to run the service. Model inference for the research assistant is routed through the Vercel AI Gateway to Anthropic.

This means personal data may be processed in countries outside your own. Where required, transfers rely on the safeguards offered by those providers.

8.Retention

• Account, profile and saved-item data: kept while your account is open.
• Login sessions: expire seven days after they are issued.
• Corrections: kept as part of the editorial record, including after an account closes, because they document why a record changed.
• Enquiries: kept while the matter is open and for a reasonable period afterwards.

9.Your rights

Depending on where you live, you may have the right to access, correct, delete, port or restrict processing of your personal data, and to object to processing based on legitimate interests.

To exercise any of these, use the contact form. We may need to verify your identity first. If you are in the UK or EU you also have the right to complain to your national data protection authority.

10.Security

Passwords are hashed, sessions are carried in signed cookies, and traffic is served over HTTPS. No system is perfectly secure, so please use a unique password and tell us promptly if you suspect a problem with your account.

11.Changes

If this policy changes materially we will update the date above and, where the change significantly affects you and we hold your email address, tell you directly.