Privacy Policy

1. Who We Are

Litigo Limited (trading as GoLitigo) is a company registered in England and Wales. We operate GL Adviser and the GLEAN marketplace. We are the data controller in respect of the personal data we collect about advisers, clients, and visitors to the platform.

Our contact for data protection matters is: support@golitigo.ai

2. What We Collect

We collect the following categories of personal data:

Account information: name, email address, phone number, firm name, and the password you create (stored as a cryptographic hash - we never store your password in plain text).

Professional credentials: SRA number or equivalent professional registration, qualifications, years of experience, specialisations, professional biography, and details of your professional indemnity insurance where provided.

Identity and AML verification data: date of birth, address, identification documents, and source of funds declarations collected as part of anti-money laundering compliance for client engagements.

Platform usage data: pages visited, features used, documents created, engagement activity, and session data collected automatically when you use the platform.

Engagement and billing records: records of client engagements accepted, documents reviewed, feedback provided, fees earned, and payment transaction records.

Communications: messages and correspondence sent through the platform.

Cookies and analytics data: see our Cookie Policy for details.

3. Why We Collect It

We collect and use personal data for the following purposes:

(a) Account creation and management - to set up and maintain your adviser account, verify your identity, and provide you with access to the platform;

(b) Professional verification - to verify your SRA number, qualifications, and suitability to accept client instructions on the platform;

(c) GLEAN marketplace operation - to match you with client instructions, facilitate engagements, process payments, and support dispute resolution;

(d) Payment processing - to process fees and commissions through Stripe Connect;

(e) Legal and regulatory compliance - to comply with our AML obligations, respond to regulatory inquiries, and maintain records required by law;

(f) Platform improvement - to analyse how the platform is used and improve our AI tools and services (using anonymised and aggregated data where possible);

(g) Security and fraud prevention - to protect the platform, our users, and Litigo Limited from fraud and misuse.

4. Legal Basis for Processing

We rely on the following legal bases under UK GDPR:

Contract performance (Article 6(1)(b)): processing necessary to provide the GL Adviser platform and GLEAN marketplace services under our agreement with you.

Legal obligation (Article 6(1)(c)): processing required to comply with our AML obligations, respond to lawful regulatory requests, and maintain required records.

Legitimate interests (Article 6(1)(f)): platform security, fraud prevention, improving our services, and maintaining accurate professional records. We have assessed that these interests are not overridden by your rights.

Consent (Article 6(1)(a)): for analytics cookies and marketing communications, where you have given explicit consent. You may withdraw consent at any time.

5. How We Use Your Data

Your professional profile information (name, qualifications, specialisations, bio, rating) is displayed to clients on the GLEAN marketplace when you are listed as accepting clients. This is necessary for the marketplace to function.

Engagement records are used to process payments, generate invoices, calculate platform commission, and resolve disputes.

Platform usage data is used to improve AI tool performance, identify technical issues, and understand how advisers use the platform, using aggregated and anonymised analysis where possible.

AML verification data is used solely for compliance purposes and is not shared with clients or used for commercial purposes.

6. Data Sharing

We share personal data only where necessary and with appropriate safeguards in place:

Stripe: payment processing and Stripe Connect for adviser payouts. Stripe's privacy policy governs their processing.

Supabase: our database and authentication provider. Data is hosted within the EU with row-level security applied to all tables.

Vercel: our hosting and deployment infrastructure.

Google Analytics: anonymised and aggregated platform usage data, only where analytics cookies have been accepted. IP addresses are anonymised before processing.

We do not sell, rent, or trade personal data. We do not share personal data with third parties for their own marketing purposes.

Your professional details are visible to clients only during an active engagement. On conclusion of an engagement, client access to your personal contact details is removed.

We may disclose personal data to law enforcement or regulatory authorities where required by law or in response to a valid legal order.

7. Data Retention

Account data: retained for the duration your account is active, plus 6 years from account closure to satisfy professional record-keeping obligations and the standard limitation period under the Limitation Act 1980.

Engagement records: retained for 6 years from the date of the engagement, consistent with the standard limitation period for professional negligence claims.

AML verification records: retained for 5 years from the end of the business relationship, as required by the Money Laundering Regulations 2017.

Analytics data: anonymised after 26 months in line with Google Analytics default retention settings.

Cookie consent records: retained to evidence compliance with our consent obligations.

8. Your Rights

Under UK GDPR you have the following rights in relation to your personal data:

Access: you may request a copy of the personal data we hold about you.

Rectification: you may request correction of inaccurate or incomplete data.

Erasure: you may request deletion of your personal data where there is no legitimate reason for us to continue processing it (subject to our legal retention obligations).

Restriction: you may request that we restrict processing in certain circumstances.

Portability: you may request a machine-readable copy of data you have provided to us.

Objection: you may object to processing based on legitimate interests.

Withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact: support@golitigo.ai. We will respond within 30 days. If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

9. International Transfers

We process data primarily within the UK and EU using Supabase's EU-hosted infrastructure. Where any transfer of personal data outside the UK occurs (for example, in connection with Stripe or Google Analytics), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the UK Information Commissioner, or adequacy decisions where applicable.

10. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These include: encryption in transit (TLS) and at rest; row-level security policies on all database tables; access controls limiting data access to authorised personnel only; and regular security review processes.

No system is completely secure. If you believe your account security has been compromised, please contact us immediately at support@golitigo.ai.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law, our practices, or our services. Where changes are material, we will notify you by email to the address associated with your account. The date at the top of this page indicates when the policy was last updated. Continued use of the platform after notification constitutes acceptance of the updated policy.

12. Contact

Data protection enquiries: support@golitigo.ai

Litigo Limited, England and Wales.