Privacy Policy

Last updated 8 August 2026

1. Who we are

Judisyn is a legal research platform operated by Alltures Advisory Pvt Ltd ("we", "us"). We are the data controller for the personal data described in this policy, except where stated otherwise in section 5.

Operator

Alltures Advisory Pvt Ltd, trading as Judisyn

Email

hello@judisyn.uk

2. What we collect

Account information

When you register we collect your name, email address and a password. Your password is stored only as a cryptographic hash, so nobody at Judisyn can read it. If you choose to complete the optional fields on your profile, we also store what you enter there.

Sign-in and session records

To keep you signed in and to protect your account we record your IP address, your browser's user-agent string and the time of your most recent activity. If you tick "Remember me" at sign-in, a long-lived token is stored so your browser can re-authenticate.

Search activity

Each time you run a search we store the text of your query, any filters you applied, the number of results returned, how long the search took and your IP address. We use this to show your recent searches on your dashboard, to diagnose faults and to understand which parts of the corpus are in demand. Search queries in a legal context can be revealing, so we treat this record as confidential: we never publish or sell it, and we disclose it to no one beyond the hosting sub-processor listed in section 6. Search queries are not sent to any AI provider.

Research you save

Folders, bookmarks, highlights and any notes you write are stored against your account so they are available the next time you sign in.

Advocate Diary entries

If you use the Advocate Diary, the entries and matters you create are stored against your account. These may contain personal data about other people — for example client names and contact details, instructing solicitors, opposing counsel, judges, case notes, fee arrangements and legal aid references. See section 5 for how responsibility for that information is divided between us.

Billing information

If you subscribe to a paid plan, we store a customer reference issued by our payment processor together with your subscription status, plan, amounts charged and invoice records. We never see or store your card number. Card details are entered on a payment page hosted by Stripe and are handled entirely by them.

3. What we do not do

We want to be specific rather than reassuring in general terms. Judisyn contains no analytics platform, no advertising network and no tracking pixels of any kind. We do not profile you for marketing, we do not build advertising audiences, and we do not sell or rent your personal data to anyone.

4. Why we are allowed to process it

Under the UK GDPR we rely on the following legal bases:

• Performance of a contract — to create and run your account, provide search and research features, and take payment for a plan you have chosen.
• Legitimate interests — to keep the service secure, prevent abuse, diagnose faults and understand aggregate usage. We balance this against your interests and use the minimum data needed.
• Consent — for any optional cookies, and for marketing email if you ever opt in. You can withdraw consent at any time.
• Legal obligation — to retain billing and tax records where the law requires it.

5. Client data you enter (controller and processor)

For your own account information we are the controller. For information you enter about your clients and cases — principally in the Advocate Diary and in notes — you or your chambers or firm remain the controller, and we act as a processor handling that data on your instructions. In practice this means:

• You are responsible for having a lawful basis to enter that information, and for your own professional and regulatory duties of confidentiality.
• We process it only to provide the service to you, and we do not use it for any purpose of our own.
• You can amend or remove entries at any time, and can ask us to delete them.

Please do not enter more client information than your work actually requires.

6. Sub-processors

These are every third party that processes personal data on our behalf. We do not share your data with anyone else, and we never sell it.

7. AI features, and what happens to what you type

This section is deliberately specific, because "confidential" means little without the detail behind it.

The AI features are currently configured to use OpenAI's API. When you request a summary, headnote or answer, we send OpenAI the text of the judgment concerned together with the question or message you typed. That transmission leaves our servers and is processed in the United States.

Based on OpenAI's published API terms for the endpoint we use:

• Your content is not used to train their models. OpenAI states that data submitted through its API has not been used to train or improve its models since 1 March 2023 unless the customer explicitly opts in. We have not opted in and will not.
• It is retained for up to 30 days. OpenAI keeps API inputs and outputs for up to 30 days for abuse and misuse monitoring, after which they are deleted. Authorised OpenAI staff can access that content during this window where an investigation requires it.
• We do not have a Zero Data Retention agreement. OpenAI offers an arrangement that removes the 30-day window, but it requires their prior approval and we have not obtained it. We will say so here if that changes, rather than implying a protection we do not have.

You can read OpenAI's own description of this at platform.openai.com/docs/guides/your-data. These are OpenAI's commitments rather than ours, and we cannot guarantee a third party's conduct.

Searching, browsing, bookmarking and note-taking do not involve any AI provider. Nothing is sent to OpenAI unless you actively use an AI feature.

8. Where your data is stored

We think you should be told this plainly rather than having to ask. The Judisyn database and any files you upload are stored on servers located in Mumbai, India, provided by Hostinger International Limited. Your data is therefore held outside the United Kingdom.

This matters if you are a solicitor or barrister weighing up where client information sits. If your professional or client obligations require UK or EU data residency, Judisyn does not currently meet that requirement, and you should keep identifying client details out of the platform until it does.

Where personal data is transferred out of the UK — to our hosting region, to OpenAI in the United States, or to Stripe — we rely on the transfer mechanisms permitted by UK data protection law, being the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with the additional safeguards those instruments require. You can ask us for details of the mechanism applying to any particular transfer.

9. How long we keep it

• Account information — for as long as your account is open.
• Search history, saved research and diary entries — for as long as your account is open, unless you delete them sooner.
• Billing and invoice records — for six years after the relevant transaction, to meet UK accounting and tax requirements.
• Session and security records — for a short period, after which they expire automatically.

10. Deleting your account

You can close your account at any time from Profile & Settings. Doing so immediately ends your access and withdraws your data from the running service.

To have your personal data permanently erased from our systems and backups, email us at hello@judisyn.uk and we will complete the erasure and confirm when it is done. We will keep only what the law requires us to retain, such as billing records.

11. Your rights

Under UK data protection law you have the right to:

• be told what personal data we hold about you and receive a copy of it;
• have inaccurate data corrected;
• have your data erased, in the circumstances the law allows;
• restrict or object to how we process your data;
• receive your data in a portable form; and
• withdraw any consent you have given.

To exercise any of these, email hello@judisyn.uk. We will respond within one month. If you are not satisfied with our response you can complain to the Information Commissioner's Office at ico.org.uk, or by calling their helpline on 0303 123 1113.

12. Security, and what "encrypted" does and does not mean here

Vague assurances are not much use to a professional assessing risk, so here is the actual position.

What is in place:

• All traffic between your browser and Judisyn is encrypted in transit using TLS (HTTPS), as are our connections to OpenAI and Stripe.
• Passwords are stored only as cryptographic hashes and never in readable form.
• Session cookies are marked HttpOnly so scripts in your browser cannot read them, and requests that change data are protected against cross-site request forgery.
• Access to the production database is limited to the people who need it to operate the service.

What is not in place:

• We do not currently apply application-level encryption to stored data. Your search history, notes and diary entries are held in the database as readable text, protected by access controls rather than by encryption at rest.
• We do not hold ISO 27001, SOC 2 or any equivalent third-party security certification, and you should not assume one from the presence of security features.

We would rather you knew this and made your own judgement than relied on the word "encrypted" doing more work than it should. No system is completely secure; if you believe your account has been compromised, contact us immediately.

13. Children

Judisyn is a professional research tool intended for adults. It is not directed at children and we do not knowingly collect data from anyone under 18.

14. Changes to this policy

If we change how we handle personal data we will update this page and revise the date above. Where the change is significant we will tell account holders directly.

See also our Cookie Policy and Terms of Service.