Privacy Policy — DRAFT
Draft for review, not legal advice. Written as a starting point under UK GDPR and the Data Protection Act 2018, using the company details and positions already in Vergel's policies. A qualified adviser should review it before launch. Items still in [brackets] need confirming.
Last updated: September 2026
Who we are
Evidence Board ("we", "us") is operated by MTG Technical Consulting Ltd, a company registered in England and Wales (company number 17342687), registered office Office 1665, 60 Tottenham Court Road, London W1T 2EW. [ICO registration number, once the data protection fee is paid.] Contact us about privacy at support@mtgtechnical.com.
Two kinds of data, two roles
Evidence Board handles personal data in two different capacities:
- Your account data. Your email address, login details, billing records and how you use the service. We decide how this is used, so we are the controller.
- Case content. The evidence you upload and write: photos, documents, recordings, notes, links, and your conversations with the AI about a case. Case content often contains personal data about other people (witnesses, subjects, members of the public). You decide what goes into a case and why, so you are the controller of case content and we process it on your behalf as your processor, under the data processing terms in our Terms of Service. You are responsible for having a lawful basis (and, for special category or criminal offence data, a condition under the Data Protection Act 2018) for the case content you upload.
The rest of this policy covers the data we control. It also explains how case content flows through our providers, because that matters to you as a controller.
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Email address, password (stored hashed), account creation date | To create and secure your account | Contract |
| Case content | To store it, show it on your board, share it when you enable sharing, and analyse it with AI when you ask | Contract (we process it on your instructions as your processor) |
| Credit balance, purchases and payment references | To sell and account for credits | Contract; legal obligation (tax records) |
| AI usage records (which case, when, tokens used, cost) | To charge credits, stop abuse and run the service | Contract; legitimate interests (preventing abuse, controlling costs) |
| Technical logs (errors, IP address in request logs) | To keep the service secure and working | Legitimate interests |
| The days on which you used the service (a date per day, nothing about what you did) | To measure whether people come back, which decides whether we keep developing the product | Legitimate interests |
We don't sell personal data, and we don't use your case content to train AI models.
AI processing
When you run an AI review, chat about a case, or upload a file, the relevant case content is sent to Anthropic (the provider of the Claude models) for processing. Uploaded files are processed once, at upload, to extract their text. Reviews and chat send the extracted content, your notes and links, and the case's conversation history. Anthropic processes this to return a response. Under Anthropic's commercial terms, content sent through its API is not used to train its models. [Adviser: confirm and state Anthropic's current API data retention period.]
AI output can be wrong. It is analysis to help you think, not a finding of fact.
Who we share data with (subprocessors)
| Provider | What for | Location | Transfer safeguard |
|---|---|---|---|
| Supabase | Database, file storage, authentication | London, UK (eu-west-2) | Stored in the UK; [confirm Supabase's transfer terms for support access] |
| Vercel | Application hosting | [regions] | [confirm] |
| Anthropic | AI processing of case content | United States | [UK Extension to the EU-US Data Privacy Framework if Anthropic is certified, otherwise the ICO International Data Transfer Addendum — confirm] |
| Stripe | Card payments for credits | [US / Ireland] | [confirm] |
| Brevo [confirm as the email provider, roadmap 4.4] | Account emails (confirmation, password reset) | EU | [confirm] |
| Sentry (Functional Software, Inc.) | Error reports (technical details of failures; configured not to collect IP addresses or request contents) | EU (Germany) | Stored in the EU; [confirm Sentry's transfer terms for support access] |
When sharing is enabled for a case, anyone with the case's share link can view that board. You control this per case, and you can turn it off at any time.
International transfers
Some providers above process data outside the UK. Where they do, we rely on UK adequacy regulations or an approved transfer mechanism (the UK International Data Transfer Agreement or Addendum), listed per provider above.
How long we keep data
- Account and case content: until you delete it or delete your account. Deleting a case deletes its evidence, files, links and AI conversation.
- Account deletion removes your account, all cases, files, conversations and credit history from our systems immediately. Deleted data can persist in encrypted backups for up to seven days before those backups age out.
- Payment records: Stripe keeps its own records of each payment. We keep the records we need for tax and accounting for six years, as UK law requires. [Adviser: confirm that Stripe's records plus our accounts satisfy this, given the credit ledger is deleted with the account.]
- AI request logs: the text we sent to and received from the AI provider is deleted after 30 days. The rest of each record (model, tokens used, cost, timing) is deleted after 13 months.
- Days you used the service: deleted after 13 months, or with your account.
Your rights
You can:
- Access and export your data. The account page downloads everything we hold about you as a file, including links to your uploaded files.
- Delete your account and all its data from the account page.
- Ask us to correct or restrict processing of your data, or object to processing based on legitimate interests.
Contact support@mtgtechnical.com for anything the app doesn't do for you. We respond within one month.
If someone whose data appears in your case content contacts us, we'll refer them to you as the controller, and help you respond as your processor.
You can complain to the Information Commissioner's Office (ico.org.uk). We'd appreciate the chance to resolve it first.
Cookies
We use only cookies that are strictly necessary to keep you signed in. Measuring return visits uses your existing sign-in, not an analytics cookie or tracker.
Children
Evidence Board isn't intended for anyone under 18.
Changes
We'll post changes here and, if they're significant, email you before they take effect.