DenningAI Privacy Policy
IMPORTANT: This is a privacy notice, not a contractual waiver of statutory rights. It explains how Denning Technologies Ltd processes personal data through DenningAI. It should be read with the Terms of Use, Data Processing Notice and, where relevant, Dispute Marketplace terms.
Who we are
DenningAI is operated by Denning Technologies Ltd, a company registered in England and Wales under company number 16646089. Denning Technologies Ltd is the controller of personal data processed through the core DenningAI consumer platform unless we expressly state otherwise.
Privacy contact: [email protected].
DenningAI is a technology platform for organising, structuring and analysing dispute information. DenningAI is not a firm of solicitors and does not provide regulated legal advice. Information supplied by a claimant is not created, approved, verified or certified by DenningAI merely because it is organised or displayed by the platform.
UK data-protection framework
We process personal data in accordance with applicable UK data-protection law, including the UK GDPR and Data Protection Act 2018, as amended from time to time, including relevant amendments made by the Data (Use and Access) Act 2025, and the Privacy and Electronic Communications Regulations 2003 (PECR) where applicable.
The UK GDPR principles of lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability apply to our processing.
Scope
This Policy applies to website visitors, people who create or build a dispute, registered users, invited collaborators, prospective and approved marketplace participants, and other individuals whose personal data is contained in material lawfully submitted to DenningAI. Separate terms may apply to enterprise customers or legal professionals.
Personal data we process
| Category | Examples |
|---|---|
| Account and identity | Name, email address, account identifiers, authentication and verification data, and contact details. |
| Dispute narrative | The user's own account of events, allegations, circumstances, losses and desired outcome. |
| Documents and evidence | Contracts, correspondence, payslips, employment, tenancy, insurance or financial records, images and other material uploaded by a user, plus extracted text, dates and metadata. |
| Structured case data | Dispute type, dates, timeline, amounts, evidence mappings, answers to questions and other structured fields. |
| Audio and transcript | Audio submitted when a user chooses voice input and the resulting transcription. |
| Generated and inferred data | Summaries, classifications, document labels, arguments, estimates, probability ranges, suggested options and other outputs generated or assisted by automated systems. |
| Marketplace data | Structured case information made available when a user elects to enter the Dispute Marketplace; expressions of interest, connection status and related communications. |
| Technical/security data | IP address, browser/device information, session and authentication events, security/audit logs, diagnostic information and service telemetry reasonably required to operate and secure the platform. |
| Billing data | Subscription, invoice and transaction metadata. Full payment-card data should be handled by the applicable payment provider rather than stored by DenningAI where practicable. |
Special-category and criminal-offence data
A dispute may reveal special-category personal data, including health or disability information, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade-union membership, genetic data, biometric data used for identification, or information concerning sex life or sexual orientation. Dispute material may also contain criminal allegations, proceedings, convictions or related security measures.
Special-category data is not treated as ordinary personal data. For processing that is genuinely necessary to establish, exercise or defend a legal claim or legal right, we may rely on Article 9(2)(f) UK GDPR. This is additional to, and does not replace, the Article 6 lawful basis described below. Criminal-offence data is treated separately under Article 10 UK GDPR and the Data Protection Act 2018; where applicable, we rely on an appropriate Schedule 1 condition, including the legal-claims condition where its statutory requirements are met.
We ask users to provide only information reasonably relevant to their dispute. We do not treat the fact that a user can upload sensitive information as permission for unlimited processing of that information.
Why we process data and our lawful bases
| Purpose | Article 6 UK GDPR basis | Special-category / criminal-offence position |
|---|---|---|
| Create, save and operate a case; provide requested dispute-management features | Article 6(1)(b): necessary to take steps at your request or perform our contract with you. | Article 9(2)(f) where special-category processing is necessary for legal claims; Article 10/DPA 2018 condition where criminal-offence data is necessary and permitted. |
| Transcribe voice input, extract document information and generate requested case analysis | Article 6(1)(b), to the extent necessary to provide the feature requested by the user. | Same additional conditions as above where sensitive data is actually necessary. |
| Authentication, account administration and service delivery | Article 6(1)(b). Security aspects may also rely on Article 6(1)(f). | Authentication systems should not receive dispute special-category data. |
| Cybersecurity, fraud/abuse prevention, troubleshooting and service integrity | Article 6(1)(f): our legitimate interests in securing and reliably operating DenningAI, subject to a balancing assessment; Article 6(1)(c) where law requires processing. | Sensitive data used only where necessary and supported by a valid additional condition. |
| Comply with law, regulatory requests and establish, exercise or defend DenningAI's own legal rights | Article 6(1)(c) and/or 6(1)(f), depending on the purpose. | Article 9(2)(f) and applicable Article 10/DPA 2018 condition where relevant. |
| Make a case available in the Dispute Marketplace and connect the user with a legal professional when requested | Article 6(1)(b) for the marketplace functionality requested by the user. | Article 9(2)(f) / applicable Article 10 condition where necessary for the legal-claims purpose. |
Where we rely on legitimate interests, we assess necessity, proportionality and the impact on individuals. We do not use consent as a catch-all basis for core processing that is necessary to provide the service. If we rely on consent for a genuinely optional activity, consent may be withdrawn without affecting processing already lawfully carried out.
Before you create an account
You may be able to build a case before creating an account. A case/session identifier may be used to associate that case with your device and later attach it to your account. This is pseudonymisation, not a guarantee of anonymity: the contents of a dispute may identify you or another person even if your name is not yet attached to the account.
Unsaved edits may be retained locally on your device to preserve work. The current intended product rule is that local drafts expire after 24 hours, or after 30 minutes where no case has yet been created, and are cleared sooner after a confirmed save or deletion where technically possible.
Just-in-time notices
Before microphone activation, DenningAI should display a concise notice explaining that audio will be sent to a transcription provider, may contain sensitive dispute information, and should not include another person's recording unless the user has lawful authority.
Before the first document upload in a case, DenningAI should display a concise notice explaining that uploaded material will be stored with the case and may be sent to document/AI processors for extraction and analysis, and that users should upload only relevant material they are entitled to provide.
Processors and technology providers
DenningAI relies on specialist processors and infrastructure providers. Using a processor does not transfer DenningAI's controller responsibilities to the user. We are responsible for selecting processors appropriately, putting required contractual terms in place, assessing relevant transfers and maintaining appropriate oversight.
| Provider | Function | Data / location position | DenningAI control required |
|---|---|---|---|
| Vercel | Application hosting/deployment and related infrastructure. | The current architecture may involve US processing. Exact production regions, document/object storage and logs must be verified. | Applicable DPA; Article 28 terms; UK transfer mechanism where required; subprocessor review; data protection test/TRA where required. |
| Neon | Primary database for case and structured data. | Production database should be configured in the intended UK/London region. Neon publishes TLS 1.2+ in transit and AES-256 at rest. | Confirm production region, DPA, history/backup settings, deletion behaviour and subprocessor position. |
| Deepgram | Speech-to-text. | Audio/transcript. Deepgram offers an EU regional endpoint. Its 6 August 2026 general Terms permit model training unless the API request opts out. | Use the EU endpoint where appropriate; set training opt-out on every production request; execute/confirm DPA limiting processing to service delivery; document retention and onward transfers. |
| Mistral AI | Core conversational AI for “Talk with DenningAI”; processing prompts and generating responses. May also extract and analyse uploaded documents and draft case material where enabled. | The content submitted to Mistral can include free-text dispute narratives, selected case context, extracted document content and model outputs, including sensitive information. Mistral may process this data as a processor for DenningAI; its published DPA also describes certain independent-controller purposes. Production region and account-specific settings require verification. | Article 28 agreement; resolve special-category data scope; verify no-training opt-out, moderation retention, zero-data-retention eligibility, subprocessors and UK transfer position. See Mistral Privacy Policy: https://legal.mistral.ai/terms/privacy-policy/?lang=en and DPA: https://legal.mistral.ai/terms/data-processing-addendum/ |
| Clerk | Authentication/account services. | Account/authentication data. Clerk's DPA prohibits use of its service for special-category data. | Keep dispute narrative/documents/special-category data out of Clerk fields and metadata; maintain DPA and transfer safeguards. |
The list above should be kept current. Material changes to processors or purposes should be reflected in this Policy and, where appropriate, brought to users' attention.
Mistral AI and Talk with DenningAI
When you enable “Talk with DenningAI”, the text you submit and the case context necessary to respond are transmitted to Mistral AI, a third-party artificial-intelligence technology provider. Mistral processes prompts and generates responses for this feature. Depending on the function used, DenningAI may also send relevant extracts from uploaded documents or case records to Mistral for analysis, extraction or drafting. Do not enter information you do not wish to be processed for these purposes.
This may include sensitive information about employment, health, disability, discrimination, financial affairs, relationships and third parties. DenningAI determines the purposes for which it submits this information to its service providers and remains responsible for its obligations as controller under UK data-protection law. Mistral generally acts as processor for customer API data under its commercial Data Processing Addendum, although its terms also identify limited purposes for which Mistral acts as an independent controller. Those distinctions, and the settings applicable to DenningAI’s production account, are subject to contractual and technical verification.
For information about Mistral’s own privacy practices, see Mistral AI Privacy Policy: https://legal.mistral.ai/terms/privacy-policy/?lang=en. Its business-customer processing terms are available at https://legal.mistral.ai/terms/data-processing-addendum/. Mistral’s consumer-facing Privacy Policy does not replace DenningAI’s Privacy Policy or establish the terms applicable to DenningAI’s business/API use. DenningAI users are not required to open a Mistral account or separately contract with Mistral merely to use this feature.
Mistral’s published Privacy Policy states that, for most API requests, inputs and outputs are retained for up to 30 rolling days for abuse monitoring unless zero data retention is activated, with exceptions for certain APIs. DenningAI has not confirmed in this notice that zero data retention is enabled for its production account. Model-training opt-out and other processing controls must be verified against DenningAI’s applicable agreement and production settings; a click-through acknowledgement is not a substitute for those safeguards.
If you choose not to enable this AI feature, DenningAI should not send new conversational prompts through it. Disabling it or deleting a case cannot retroactively recall information already transmitted; deletion and retention at Mistral are governed by applicable contractual controls and legal requirements. You may exercise data-protection rights by contacting [email protected].
Checking.
AI training, model improvement and content use
DenningAI does not intend to use identifiable dispute content to train DenningAI's own general-purpose models. We also intend to configure and contract with AI/speech providers so that production dispute content is not used for provider model training or general model improvement unless we have expressly told the user and have a lawful basis.
Because provider defaults differ, this is a control that must be verified provider-by-provider. In particular, Deepgram's current general Terms permit training unless the API request opts out, and Mistral's contractual/data-retention settings must be verified for the production account. DenningAI should not publish an unconditional 'zero retention' or 'no provider training' claim until those settings are demonstrably in force.
Dispute Marketplace and what legal professionals can see
Creating a DenningAI case does not automatically disclose the case to legal professionals. Marketplace visibility is a deliberate feature activated by the user.
While a legal professional is browsing a case in the marketplace, the product is intended to expose a structured representation of the dispute rather than the user's raw free-text narrative or original documents. If the user chooses to connect with or accept an offer from a legal professional, DenningAI may then release additional information, including contact details and summaries, arguments or other material derived from the user's free text or documents. Derived material may reveal the substance of the original narrative.
Accordingly, the public-facing statement should be: "Lawyers do not see your raw free text while browsing your case. If you choose to connect with a lawyer, we may share summaries or arguments derived from it, as explained in this Privacy Policy."
Once information has lawfully been disclosed to a solicitor, barrister, law firm or other professional for their own professional purposes, that recipient may act as an independent controller and will be responsible for its own professional, confidentiality and data-protection duties.
International transfers
Some processors or subprocessors may process personal data outside the UK. A restricted transfer is not justified merely because a provider has general privacy terms. Where UK adequacy regulations do not apply, DenningAI will use an appropriate safeguard where required, such as the ICO International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or another lawful Article 46 safeguard.
Where required, DenningAI will complete and document the applicable data protection test (also referred to by the ICO as a transfer risk assessment) to determine, reasonably and proportionately, that the standard of protection after transfer is not materially lower than in the UK. Supplementary contractual, organisational or technical measures will be used where necessary.
Retention and deletion
We retain personal data only for as long as necessary for the purpose for which it is processed, subject to legal, regulatory, security and legal-claims requirements. The production retention schedule must be configured to reflect the periods below and reviewed periodically.
| Data type | DenningAI retention position | Notes |
|---|---|---|
| Unsaved local draft | Up to 24 hours; up to 30 minutes before a case exists. | Cleared earlier following confirmed save/deletion where technically possible. |
| Active case, structured answers, extracted text and documents | For the life of the case/account while required to provide the service. | A dormant-account period should be adopted and communicated before automatic deletion is introduced. |
| User-deleted case | Removed from live application systems without undue delay, subject to short-lived recovery/back-up copies. | Deletion from processors follows configured/provider deletion cycles. |
| Database history/backups | Limited to configured resilience window. | Neon supports configurable history retention up to 30 days; DenningAI must record the actual production setting. |
| Authentication/account data | For the account life and then through the account-deletion workflow. | Clerk's DPA provides deletion of customer personal data within 90 days after termination of the customer contract; DenningAI must separately verify end-user deletion behaviour. |
| Security/audit logs | Normally up to 12 months, unless required longer for an active security incident or legal claim. | Review annually for necessity. |
| Accounting/tax records | Normally six years where UK law requires the underlying business record. | Dispute content should not be retained merely because an accounting record is retained. |
| AI/transcription content | Zero/limited retention or the shortest available production setting consistent with the feature. | Exact Deepgram/Mistral settings must be recorded and kept under review. |
Deletion is not necessarily instantaneous across encrypted backups, disaster-recovery systems or processors. Residual copies should be isolated from ordinary use and expire according to documented lifecycle rules. We do not use backup persistence as a reason to retain live user data indefinitely.
Security
DenningAI applies or requires risk-appropriate technical and organisational measures designed to protect confidentiality, integrity and availability. These should include encryption in transit and at rest; least-privilege role-based access; MFA for privileged access; separation of production and development; secrets management; access and security logging; vulnerability/dependency management; encrypted backups; incident-response procedures; and periodic access and vendor review.
No internet service can promise that a breach will never occur. That does not remove DenningAI's legal obligations. If a personal data breach occurs, DenningAI will investigate, contain and document it, work with relevant processors, and notify the ICO and/or affected individuals where UK law requires.
Automated processing
DenningAI uses automated and semi-automated systems to organise information and produce classifications, estimates, summaries and suggested options. These outputs are intended as decision support. DenningAI does not intend the current service to make a solely automated final decision that itself produces legal or similarly significant effects on a user.
If a future feature does make such a decision, we will assess the UK GDPR automated-decision provisions, including the stricter rules that can apply where special-category data is used, and implement required transparency and safeguards before deployment.
Children and third-party information
DenningAI is intended for adults aged 18 or over. Users should not create accounts for children unless DenningAI expressly introduces an authorised process for doing so. Dispute documents may nevertheless contain information about children, witnesses, colleagues, family members or other third parties. Users must have a lawful basis or other lawful authority to provide such material and should minimise irrelevant third-party information.
DenningAI's controller obligations still apply to third-party personal data received through the platform. Where direct privacy information to a third party would be impossible or involve disproportionate effort, DenningAI will assess and document any applicable UK GDPR position rather than treating the uploader's responsibility as a blanket exemption.
Your rights
Subject to the conditions and exemptions in UK law, individuals may have rights of access, rectification, erasure, restriction, objection and data portability, rights relating to consent where consent is relied on, and rights relating to certain automated decisions. We may need to verify identity before acting on a request.
Requests may be sent to [email protected]. Individuals also have the right to complain to the Information Commissioner's Office (ICO): https://ico.org.uk/make-a-complaint/. Nothing in this Policy removes or contracts out of statutory rights or the ICO's regulatory powers.
Changes to this Policy
We may update this Policy to reflect changes in law, providers, security controls, data flows or product functionality. We will publish the current version and effective date. Where a change materially affects how personal data is used, we will provide appropriate notice rather than relying solely on continued use as deemed consent.
Governance commitments
DenningAI should maintain a current Record of Processing Activities, DPIA, processor/subprocessor register, lawful-basis register, international-transfer register and data protection tests, retention schedule, incident register, access-control evidence and, where legally required, an Appropriate Policy Document. These records support accountability but are not necessarily public documents.
Publication conditions / unresolved implementation items
- Complete and approve a DPIA before high-risk production processing at scale and review it when the AI stack, marketplace or data flows materially change.
- Deepgram: confirm DPA; use EU endpoint where appropriate; enforce the per-request training opt-out; document content/log retention and subprocessors.
- Mistral AI: confirm its commercial/API terms and DPA cover the actual Talk with DenningAI workflow and special-category information; implement and verify account-level no-training and any eligible zero-data-retention settings; assess moderation logs, subprocessors and international transfers. A user-facing acknowledgement does not cure a contractual gap.
- Vercel: confirm the applicable DPA/plan, actual execution/storage/log regions and UK restricted-transfer position.
- Neon: confirm London/UK production region and actual history/backup retention configuration.
- Clerk: keep all dispute and special-category content out of authentication metadata and confirm end-user deletion workflow.
- Implement microphone/document just-in-time notices and the qualified marketplace free-text statement.
- Adopt and technically enforce the retention schedule; test export, correction and deletion workflows.
- Confirm whether DenningAI's scale of special-category processing triggers a mandatory DPO appointment under Article 37 UK GDPR.
Authoritative sources used in strengthening this document
- Information Commissioner's Office (ICO), Special category data guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/lawful-basis/a-guide-to-lawful-basis/special-category-data/
- ICO, International transfers guidance and data protection test / transfer risk assessment: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/
- ICO, Appropriate safeguards, including the IDTA and UK Addendum: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/appropriate-safeguards/
- ICO, DPIA guidance: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/accountability-and-governance/data-protection-impact-assessments-dpias/
- Vercel Data Processing Addendum: https://vercel.com/legal/Vercel_Inc_-_Data_Processing_Addendum.pdf
- Neon Security & Compliance: https://neon.com/security
- Deepgram Terms of Service (updated 6 August 2026): https://deepgram.com/terms
- Deepgram EU regional endpoint: https://developers.deepgram.com/reference/custom-endpoints
- Deepgram privacy/subprocessor information: https://deepgram.com/privacy/subprocessors
- Mistral AI Data Processing Addendum (effective 27 July 2026): https://legal.mistral.ai/terms/data-processing-addendum
- Mistral AI Privacy Policy (effective 3 September 2026): https://legal.mistral.ai/terms/privacy-policy/?lang=en
- Clerk Data Processing Addendum: https://clerk.com/legal/dpa
Effective date: 25 August 2026 | Controller: Denning Technologies Ltd (company no. 16646089)