Privacy Policy

This Privacy Policy explains how UK Work Rights Ltd ("we", "our", or "the site") collects, uses and protects information when you use our free UK rights guidance tool. We are committed to protecting your privacy and being transparent about how we handle your information.

1. Who We Are

UK Work Rights Ltd is the data controller for the personal information described in this policy.

• Company: UK Work Rights Ltd, registered in England and Wales, Company No. 17228507
• Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ
• ICO: Registered with the Information Commissioner's Office — registration number ZC239465
• Contact: hello@ukworkrights.co.uk

ukworkrights.co.uk provides free general guidance on UK legal rights including employment, housing, benefits, consumer rights, driving, tax and family matters. We are not a law firm and do not provide legal advice.

2. What Information We Collect

Information you give us

• Rights checker questions. The text you type describing your situation is sent to the Anthropic API to generate your guidance. We do not store this text after your session ends. Some checkers have optional boxes for dates or answers, such as a due date or the date a job ended. Anything you pick there is sent with your question, and the result our site works out from it is saved with the report for accuracy checking, for up to 90 days.
  
  Sensitive information. Because you describe your own situation in your own words, what you type may include what UK GDPR calls special category data (Article 9) — for example health conditions, disability, mental health, pregnancy, race, religion, sexual orientation or trade union membership — and information about criminal offences or allegations (Article 10). We ask for your explicit consent by way of the tick box shown before you submit a check, and that consent is our lawful basis under Article 9(2)(a) and our condition under Schedule 1 of the Data Protection Act 2018. You can withdraw consent at any time by not submitting further checks. We ask you not to include your name, address or anyone else’s identifying details, and the checkers do not require them.
  
  Transfer outside the UK. Anthropic PBC is based in the United States, so the text you enter is transferred outside the UK. That transfer is made under the safeguards permitted by Chapter V of the UK GDPR, using the standard contractual clauses, with the UK International Data Transfer Addendum, that form part of Anthropic’s data processing terms. Anthropic processes the text to generate your answer, acts on our instructions as a processor under a written agreement, and does not use it to train its models. Anthropic automatically deletes it within 30 days, unless its safety systems flag it for possible misuse of its service, in which case it may be kept for up to 2 years. You can ask us for details of these safeguards using the contact address above.
• Letter writer. When you ask our letter writer to draft a letter, the details you type — your name and address, the recipient, the date, your description of the situation and any optional details — are sent to the Anthropic API to write the letter. We do not store the details you type once your session ends. The letter written for you is kept for up to 90 days so we can check its accuracy. Your name, your address and the recipient’s name, as typed into those boxes, are taken out first, but it may still repeat details of your situation. The same terms apply as for checker questions above: Anthropic acts as our processor, does not use them to train its models, and deletes them within 30 days (or up to 2 years if its safety systems flag misuse), and the same safeguards cover the transfer to the United States. The letter is shown in your browser, and if you download it, it is saved on your own device. Only include other people's details where the letter needs them.
• The rights report our tool generates for you. This is written about the situation you described and will often repeat parts of it back to you.
• Blog comments. To post a comment you sign in with Google, and Google tells us your name and email address. We keep those with your comment. Your name and comment are published once approved. Your email address is never published and is used only to contact you about your comment if needed.
• Signing in to the site. If you sign in, your name and email address are saved in your own browser so the site remembers you. We do not keep them.
• Bug reports and feedback. If you use our on-site report or feedback form we collect your name, email address and the content of your message.
• Emails. If you contact us we keep your email address and message so we can reply.
• Donations. Donations are handled entirely by Buy Me a Coffee. We never see or store your payment details.

Information collected automatically

• Server logs. Standard web server logs including IP address, browser type, pages visited and time of visit, used for security.
• Rate limiting. To prevent abuse of the free checkers we record your IP address with a daily counter. This is held in a temporary cache and deleted automatically after 25 hours.
• Analytics. Google Analytics collects usage statistics — pages viewed, time on site, and general location at country or region level. This only runs if you accept analytics cookies.
• Advertising. Journey by Mediavine sets cookies to serve advertising. This only runs if you accept advertising cookies.

2a. Health and Other Sensitive Information

Some checkers cover subjects where you may choose to describe a health condition, a disability, a pregnancy, or trade union membership. UK GDPR treats information of this kind as special category data and gives it extra protection.

We process it only where you choose to include it, and we rely on your explicit consent under Article 9(2)(a) UK GDPR. You do not have to give any detail you are uncomfortable sharing — general terms are usually enough for a checker to give you a useful answer.

We use the text you type into a checker only to generate your guidance. We do not store it after your session (Anthropic’s own retention is explained in section 2), and it is never passed to our advertising or analytics providers.

Our checkers give general guidance and do not make any decision about you. If you want to question anything a checker has told you, email hello@ukworkrights.co.uk and a person will look at it.

Because a report is written about your situation, a report may also contain sensitive information you told us. Where we keep a report for the accuracy checking described in section 4, any sensitive information inside it is kept with it.

3. Our Lawful Bases

Under UK GDPR we must have a lawful basis for each use of your information.

• Processing your checker text — legitimate interests, providing the service you asked for
• Publishing blog comments — consent
• Replying to emails, bug reports and feedback — legitimate interests
• Rate limiting by IP address — legitimate interests, preventing abuse
• Server logs and security — legitimate interests
• Analytics cookies — consent
• Advertising cookies — consent
• Checking the accuracy of the guidance we produce — legitimate interests, making sure the information we give people is correct

Where we rely on legitimate interests you have the right to object. Where we rely on consent you can withdraw it at any time.

4. How We Use Your Information

• To generate your rights guidance
• To publish and respond to blog comments
• To reply to enquiries, bug reports and feedback
• To understand how the site is used, where you have consented
• To serve advertising, where you have consented
• To keep the site secure and prevent abuse
• To meet our legal obligations
• To check the guidance we produce is accurate. Our system automatically compares the figures and legal references in each report against our own verified list. Each report is kept for this for up to 90 days, and any that does not match is flagged so we can correct it. If you tell us whether a report was helpful, that answer is kept with it for the same period, and it is added to the public thumbs-up and thumbs-down totals shown on that checker. The totals are just numbers: nobody can be identified from them. We also keep a simple daily count of which search engine or site sent you here (for example, Google, Bing or Facebook) and which page you landed on, so we can see what is working. This does not need your permission because it never identifies you: we do not store your IP address, do not set a cookie for it, and do not link one visit to another. We also use a temporary code, held only in your browser for as long as your visit lasts, so we can see which page is currently being viewed on the site and roughly how many people are on it at once. This code is deleted the moment you close the tab, is never turned into a cookie, and is forgotten by our system within about two minutes of you going quiet — it shows us a snapshot of the site right now, not a record of where anyone has been. We do not send your original question, and we never attach your name, email address or any identifier.
• Some of this analytics activity involves reading or writing a small amount of information in your browser (not a tracking cookie) purely to tell separate page views on the site apart from each other during a single visit. Under the UK's electronic communications rules, this kind of first-party, statistics-only use does not require your consent, provided it is not used to build a profile of you or shared for advertising — which it is not.

5. Third Party Services

• Anthropic (Claude) — generates checker guidance from the text you enter. Anthropic does not use API data to train its models.
• Supabase — database hosting. Stores blog comment names, email addresses and comment text.
• Upstash — temporary cache holding your IP address and a request counter for 25 hours, then deleted automatically. Also holds the rights reports kept for accuracy checking, for up to 90 days, then deleted automatically.
• Brevo — sends us email notifications about new comments, feedback and bug reports.
• Google — Sign in with Google, used when you post a comment. Google tells us your name and email address.
• Google Analytics — usage statistics. Consent required.
• Journey by Mediavine — display and video advertising. Consent required. See their notice below.
• Buy Me a Coffee — optional donations, handled entirely on their platform. We hold no payment data.
• Netlify — website hosting. Standard server logs.

6. Cookies and Consent

Advertising and analytics cookies only load after you consent. Google Analytics and Google Ads tags are set to denied by default and activate only if you accept. If you decline, no analytics or advertising cookies are placed on your device and we receive no measurement data that identifies your browser.

Consent is managed through the Mediavine Consent Management Platform, which appears when you first visit the site. You can change your choice at any time using the Update Privacy Settings link in the footer.

Full detail is in our Cookie Policy.

7. Your Rights Under UK GDPR

You have the right to access, rectification, erasure, restriction of processing, objection, and data portability.

To exercise any of these, email hello@ukworkrights.co.uk. We will respond within one month.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

8. Data Retention

• The text you type — not stored by us after your session; deleted by Anthropic within 30 days, or kept up to 2 years if its safety systems flag it for misuse
• Details you type into the letter writer — not stored by us after your session; deleted by Anthropic within 30 days, or kept up to 2 years if its safety systems flag it for misuse
• Rights reports sent to us for accuracy checking, including any result worked out from dates or answers you picked in a checker’s optional boxes — 90 days, then deleted
• Letters written for you by the letter writer, with the name, address and recipient name you typed into those boxes taken out — up to 90 days, then deleted
• Blog comments — while the post remains published. Email us and we will delete yours.
• Rate limiting data — 25 hours, then deleted automatically
• Server logs — up to 90 days
• Analytics data — 26 months
• Email, bug reports and feedback — up to 2 years

9. International Transfers

Some providers process data outside the UK. Where that happens we rely on the safeguards those providers have in place, including UK International Data Transfer Agreements or the UK Addendum to the EU Standard Contractual Clauses. Providers that may process data outside the UK include Anthropic, Supabase, Upstash, Google and Mediavine.

10. Data Security

We use HTTPS for all data in transit. We do not store financial details. No method of transmission over the internet is completely secure, and while we take reasonable technical and organisational measures we cannot guarantee absolute security.

11. Children

Our guidance is for anyone who needs it, including young workers. You must be 16 or over to post a comment. If you are under 13, please use the checkers with a parent or guardian, because they ask for your consent before you describe your situation. We do not knowingly collect personal data from children under 13. If you believe a child has given us information, contact us and we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law or our practices. We will update the "Last updated" date at the top of this page. Continued use of the site after changes constitutes acceptance of the updated policy.