This notice explains how Bainary Ltd (company number 16085415, registered office Flat 6, Paine Court, 57 Westcombe Park Road, London SE3 7RN) ("Bainary", "we") uses personal data as a controller. Contact us about it at info@bainary.ai.
Client data in the portal
When a law firm uploads its clients' documents to Bainary, the firm is the controller and we process that data for it as its processor, under our Data Processing Agreement at www.bainary.ai/dpa. If you are a firm's client, the firm's own privacy notice explains how your data is used, and you should contact the firm about it. We will pass any request we receive to the firm.
What we collect and why
| Data | Why | Lawful basis |
|---|---|---|
| Early-access and contact requests: name, work email, firm, role, caseload and anything you write to us | To reply, assess fit and follow up about Bainary | Legitimate interests (responding to and developing business enquiries) |
| Account data for firm users: name, work email, firm, login and usage records | To provide the portal, keep it secure and support you | Contract with your firm, and legitimate interests |
| Billing data: billing contact, invoices, payment records (card details are handled by Stripe, not us) | To take payment and keep accounts | Contract, and legal obligation (tax and accounting records) |
| Security and service logs: IP address, device and browser information, request logs | To keep the website and portal secure and working | Legitimate interests |
| Website analytics: aggregated page views, without cookies or cross-site tracking | To understand how the site is used | Legitimate interests |
| Emails between you and us | To communicate and keep records | Legitimate interests, or contract |
We may send firm contacts occasional emails about Bainary. You can opt out at any time by replying or using the unsubscribe link.
Cookies
The portal uses one strictly necessary cookie to keep you signed in. The website sets no advertising or tracking cookies, so we don't ask for cookie consent.
Who we share it with
Our service providers, under contract, for the purposes above: hosting, storage and AI processing (Vercel), database (Neon), email (AgentMail and Google Workspace) and payments (Stripe). We also share data with professional advisers, with a buyer if our business is sold, and where the law requires. We don't sell personal data.
International transfers
Some of our providers process data outside the UK, including in the United States. We use UK adequacy regulations or the safeguards UK law requires, such as the ICO's International Data Transfer Agreement or the UK Addendum.
How long we keep it
- Early-access and contact requests: up to 24 months after our last contact.
- Account data: while your firm's account is open, then up to 12 months.
- Billing records: six years after the end of the financial year they relate to, as tax law requires.
- Security logs: up to 12 months.
Your rights
You can ask us for a copy of your data, or to correct, delete or restrict it, to object to how we use it (including for marketing), or to move it to another provider. Email info@bainary.ai. We reply within one month. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, though we'd like the chance to help first.
Changes
We'll update this notice when our practices change and show the new version date at the top.