We take data protection seriously — the documents you upload to MyLiP are among the most sensitive information you have. Here are the key points: (1) we are the data controller. (2) We only process your data to provide the Service to you. (3) We never use your case documents to train AI models — ours or anyone else’s. (4) We use a small set of processors (Anthropic, Supabase, Vercel, Stripe, Resend) to run the Service; some of those are US-based, and we document the transfer safeguards. (5) You have the full set of UK GDPR rights. (6) You can complain to the ICO if we get this wrong.
This policy is issued by MyLiP Ltd (“MyLiP”, “we”), the data controller for personal data processed through the MyLiP.ai service.
We process the following categories of personal data:
| Category | Examples | Source |
|---|---|---|
| Account data | Name, email, password (hashed), subscription tier, billing records | From you at sign-up |
| Case content | Documents you upload (Form E, bank statements, correspondence, court orders, witness statements), notes you write, AI queries you run, AI outputs | From you, uploaded or generated during use |
| Special-category data (Art. 9 UK GDPR) | Health, family, sexual-orientation or similar information appearing in your case documents | Incidental to your case content |
| Usage data | Pages visited, features used, query counts, device and browser metadata, IP address | Generated automatically while you use the Service |
| Support data | Emails you send us, records of support interactions | From you when you contact us |
Under Article 6 UK GDPR, we rely on the following lawful bases:
For special-category data (Article 9 UK GDPR), which is commonly present in family, employment and benefits documents, we rely on:
| Data | Retention |
|---|---|
| Account data | Duration of your subscription + 6 years (statutory record-keeping) |
| Case content (documents, notes, queries, outputs) | Duration of subscription + 30 days after cancellation (for export), then deleted |
| Usage data | 24 months |
| Payment records | 6 years (UK tax-record obligations) |
| Support correspondence | 3 years from last interaction |
You can export and delete your case content at any time from your account settings. Deletion is final and irrecoverable after a 30-day grace window.
We use the following processors to run the Service. Each has a data processing agreement in place with appropriate safeguards.
| Processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Anthropic | AI model (Claude) that powers case analysis and drafting | USA | UK IDTA / UK Addendum to EU SCCs. Anthropic’s zero-retention configuration is used for Claude API calls. Your content is not used to train Anthropic’s models. |
| Supabase | Database and authentication | EU (Frankfurt) for UK customers | UK data stays in EU region; Supabase parent in USA under UK IDTA. |
| Vercel | Application hosting and edge functions | USA / EU edge nodes | UK IDTA. |
| Stripe | Payment processing | UK & Ireland (EU) | UK Stripe entity under UK GDPR; IDTA for any US transfers. |
| Resend | Transactional email delivery | USA | UK IDTA. |
| Netlify | Marketing site hosting (pre-launch) | USA / global CDN | UK IDTA. |
We do not sell your personal data to anyone, and we do not share it with advertisers. We may share it with law enforcement where required by law, with professional advisers in connection with our business, or with a successor in interest if the business is sold (in which case the acquirer will be bound by equivalent privacy commitments).
Our training-data commitment. Your case documents, inputs and AI outputs are never used to train any AI model — ours or any third party’s. We use Anthropic’s zero-retention API configuration. This is a firm contractual commitment, not a discretionary policy.
Some of our processors (above) are based in the United States. For those transfers, we rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with any additional organisational and technical safeguards required following the UK government’s adequacy assessments. Copies of the specific transfer documents are available on request.
We take security seriously because the alternative is not acceptable given the sensitivity of our users’ data. Our technical and organisational measures include:
No system is perfectly secure; if a breach occurs that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and notify affected users without undue delay.
Under UK GDPR you have the following rights. We will respond to any request within one month (extendable by a further two months for complex requests):
To exercise any of these rights, email hello@mylip.ai. We may ask you to verify your identity before responding. These rights are free to exercise; we may charge a reasonable fee or refuse manifestly unfounded or excessive requests.
Read this carefully. Because MyLiP is not a law firm and we are not your solicitor, communications between you and MyLiP are not covered by legal professional privilege. The UK judiciary’s October 2025 guidance treats inputs to AI tools as unprivileged. If you are in litigation, the opposing side may, in certain circumstances, be entitled to seek disclosure of your MyLiP content. Take this into account when using the Service.
We use a small number of cookies to run the Service — see our Cookie Policy for details.
The Service is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete it.
We may update this policy from time to time. Material changes will be notified to subscribers by email at least 30 days in advance, and the version history is available on request. Continued use of the Service after changes take effect is acceptance of the updated policy.
If you’re unhappy with how we’ve handled your data, please contact us first at hello@mylip.ai — we’d rather fix the problem. If you’re not satisfied, you can complain to the ICO: ico.org.uk, or by phone on 0303 123 1113.