Privacy notice

1. Who is responsible

SafeLegalAI (safelegalai.com) is a free resource from LegalAI Space, a Cognesio product, and is operated by Cognesio LLP. Cognesio LLP is the controller of the personal data described here. Contact: hello@safelegalai.com. Postal address: Cognesio LLP, 9th Floor, Tower D, Unitech Cyber Park, Sector 39, Gurugram, Haryana 122001, India.

LegalAI Space is a separate service with its own privacy notice; nothing you do on this site is shared with it, unless you book a demo of it yourself (section 6a).

2. Cookies and storage on your device

We set no cookies. The site can write a theme value if you press the light/dark toggle, and the report/contact form script stores short-lived intake context in localStorage and sessionStorage (cg_intake, cg_intake_paths, cg_intake_session) so a submission can include the page path, first referrer and referral tags. Clearing site data removes it.

Analytics still store nothing on your device. We do not show a cookie banner because the storage above is used to operate forms and remember your preference, not for advertising or cross-site tracking. If we ever add technology that needs consent under the Privacy and Electronic Communications Regulations, we will ask first.

3. Analytics (cookieless)

We use PostHog in its cookieless mode to understand which pages are read. PostHog is configured so that:

• no cookies, local storage or session storage are used, and no identifier is placed on your device;
• no person profiles are created, no session recordings are made, no surveys are shown, and we never call identify();
• your browser's “Do Not Track” signal is respected — if it is on, nothing is sent;
• visitors are counted with a hash computed on PostHog's servers from your IP address, user agent and a salt that changes daily and is then deleted. Your IP address is not stored and, in this mode, is not used for location lookup.

What we see: the page viewed, the referring site, screen size, browser and operating system family, and the time. Autocapture of clicks and form inputs is switched off. PostHog Inc. processes this data for us on PostHog Cloud (US region) under its data processing agreement. Our lawful basis is legitimate interests (understanding what is read so we can keep the record useful); the impact on you is minimal because no identifier persists.

4. Server logs

Like every website, our hosting infrastructure records requests (IP address, user agent, URL, time) so we can keep the site secure and diagnose faults. We do not use these logs for analytics or profiling, and they rotate within 30 days. Lawful basis: legitimate interests (security and reliability).

5. The weekly briefing

If you subscribe, your email address and the date you subscribed are processed by Buttondown, our newsletter processor, on our instructions. Open and click tracking is disabled in our account, so emails contain no tracking pixels. Every email has a one-click unsubscribe; we also delete your address on request. Lawful basis: consent, which you give by subscribing and can withdraw at any time. Buttondown is based in the United States; the transfer is covered by the data processing terms in Buttondown's agreement, including the standard contractual clauses and the UK addendum.

Watch digests. If you subscribe from a "Watch this jurisdiction" or "Watch this tool" box, Buttondown also stores a tag naming that scope (for example watch:jurisdiction:uk) and the page you subscribed from, so you receive only that scope's digest. The tag is the only extra data; it is removed with your address when you unsubscribe.

5a. Widgets, feeds and syndication on other sites

Third-party sites may embed our widgets or run our syndication blocks. A widget is a page from this site shown in a frame: it sets no cookies, stores nothing on your device, runs no analytics inside the frame, and cannot read anything from the host page. Our server logs record the request as described in section 4. If you follow a link from a widget or block back to a record, the address carries a referral tag (utm_source) that tells us the visit came from an embed; it identifies the channel, not you. The host site's own privacy notice governs the host page.

6. When you contact us or report something

Reports and contact messages — tips, corrections, vendor updates, rights of reply — are sent through our intake form or by email and are read by the SafeLegalAI editorial team. The intake form stores the submitted fields plus page URL, referrer, referral tags, browser/device details and any readable cookies in Azure Blob Storage, then emails the team. We keep correspondence for as long as the matter is open and for up to two years afterwards so we can show how a record was handled. Reports may be triaged with AI tools for routing and de-duplication; decisions are made by people. Lawful basis: legitimate interests (running an accurate publication and answering you). Please do not send us information about third parties beyond what is needed to make your point.

6a. Booking a demo of LegalAI Space

The demo page, and no other page, loads a booking widget from BookingsXP (bookingsxp.com/embed/) that shows free times from Microsoft Bookings. The widget sets no cookies, and the page switches off its campaign attribution, so it stores nothing on your device; it receives only the page address without its query string and the referring site's origin. BookingsXP counts widget use with anonymous events (page path, country, device type and the steps taken; no name, email or IP address). If you book, the name, email and any notes you enter, and the time you choose, pass through BookingsXP to LegalAI Space's Microsoft Bookings calendar to arrange the call. LegalAI Space is responsible for that data under its own privacy notice; SafeLegalAI does not receive it. If you do not book, nothing you type is sent.

7. Personal data in our datasets

The Incident Tracker and Regulation Tracker record what courts and regulators have decided. Judgments, orders, disciplinary decisions and official guidance are public documents, and they name lawyers, parties, firms, judges and regulators. We reproduce those names only as they appear in the public record, link the source, and record the outcome. We do not add allegations of our own.

We process this personal data under legitimate interests, for the purposes of journalism and public-interest research into AI in legal practice, and we rely on the journalism and academic/research provisions of the Data Protection Act 2018 where they apply. Where a court has anonymised a judgment, we keep the anonymisation.

If you are named in a record you can ask us to correct an error, add context or a reply, or reconsider inclusion. We correct confirmed errors with a dated note and consider every request on its facts; we do not remove accurate reports of public court or regulator findings simply because they are unwelcome.

8. Links to other sites

External links open in a new tab and take you to sites we do not control; their privacy notices apply. Links to commercial vendors carry referral tags (utm_source and similar) so the vendor can see that traffic came from SafeLegalAI; those tags contain no information about you. Links to courts, regulators and legislation carry nothing.

9. Who we share data with

Only the processors named above — PostHog (analytics), Buttondown (newsletter), Microsoft Azure (intake storage and workflow email) and our hosting provider — each under a contract that limits what they may do with the data. We do not sell personal data, run advertising, or share it with LegalAI Space or any other business. A demo you book on the demo page goes from your browser to LegalAI Space through BookingsXP and Microsoft Bookings (section 6a).

10. Your rights

Under the UK GDPR (and the EU GDPR if you are in the EEA) you can ask for access to the personal data we hold about you, have it corrected or erased, restrict or object to its processing, and receive a copy in a portable form. Some rights are limited where we process public-record data for journalism. Write to hello@safelegalai.com; we respond within one month. You can also complain to the Information Commissioner's Office (ico.org.uk) or, in the EEA, to your local supervisory authority.

11. Retention, security and children

We keep personal data only as long as the purposes above require: analytics events are aggregated by PostHog and raw events expire under its retention settings; newsletter addresses until you unsubscribe; correspondence for up to two years after a matter closes; dataset records for as long as they are part of the public record we maintain. Data is protected with access controls, encryption in transit and the security practices of our processors. This site is not directed at children and we do not knowingly collect data from anyone under 16.

12. Changes

We update this notice when our practices change and show the date at the top. Related pages: disclaimer and terms, editorial standards, about and ownership.