Privacy Policy
Last updated: 11 October 2026
Who we are
Legalfy ("we", "us", "our") operates the website and platform at legalfy.io (the "Services"). We are the data controller responsible for your personal data processed through the Services.
For any privacy enquiry, contact us at support@legalfy.io.
What personal data we collect
- Account data: your name and email address when you register.
- Document data: the information you enter to generate legal documents, and the documents themselves (title, parties, generated content, review comments).
- Usage data: pages visited, referrer, approximate device/browser/OS, screen resolution, language, and a truncated (anonymised) IP address used only for aggregate analytics.
- Billing data: handled directly by our payment processor, Stripe. We store your subscription plan and credit balance; we do not store full card details.
Lawful basis for processing (GDPR Art. 6)
- Performance of a contract — to provide the documents and account features you sign up for.
- Consent — for anonymous analytics tracking, which you can switch off at any time.
- Legitimate interests — to secure the platform and prevent abuse.
- Legal obligation — where we are required to retain records.
How we use your data
We use your data to create and store your documents, operate your account, process payments, send signing and review notifications, secure the platform, and — only if you consent — produce aggregated analytics to improve the Services.
We do not sell your personal data to third parties.
Cookies and tracking
We use essential cookies to keep you signed in. Analytics cookies are only set after you accept them via the cookie banner. See our Cookie Policy for details.
Data sharing and subprocessors
We share personal data only with the following categories of processors, under contract:
- Cloud hosting & database — the platform infrastructure provider.
- Payments — Stripe.
- Email delivery — for transactional messages such as signing requests.
- AI providers — to generate document drafts; the information you submit to generate a document is sent to these providers.
We never transfer personal data outside these purposes.
International transfers
Some processors are located outside the UK/EEA. We rely on appropriate safeguards such as Standard Contractual Clauses, and only transfer the minimum data necessary to provide the Services.
How long we keep your data
- Account & documents — kept while your account is active, and deleted when you delete your account.
- Analytics logs — retained for a maximum of 12 months, then automatically purged.
- Billing records — retained as required by tax law.
Your rights (GDPR & UK GDPR)
You have the right to:
- Be informed about how we use your data
- Access your personal data (download a copy from your Account page)
- Rectify inaccurate data
- Erase your data ("right to be forgotten") by deleting your account
- Restrict or object to processing
- Data portability
- Withdraw consent for analytics at any time (it does not affect processing already carried out)
- Lodge a complaint with the ICO (ico.org.uk) or your local supervisory authority
Children's data
The Services are not intended for individuals under 18. We do not knowingly collect personal data from children.
Security
We apply reasonable technical and organisational measures to protect your data, including access controls and encryption in transit. No method of transmission or storage is fully secure, but we work to protect your data using industry standards.
Changes to this policy
We may update this Privacy Policy. Material changes will be reflected by updating the "Last updated" date at the top of this page.