Privacy Policy

This Privacy Policy explains how ukworkrights.co.uk ("we", "our", or "the site") collects, uses and protects information when you use our free UK rights guidance tool. We are committed to protecting your privacy and being transparent about how we handle your information.

1. Who We Are

ukworkrights.co.uk is a free online guidance tool providing general information about a wide range of UK legal rights topics including employment, housing, benefits, consumer rights, driving, NHS, data protection, tax, wills, school rights, energy, travel, and more. The site is operated by an individual based in the United Kingdom. We are registered with the Information Commissioner\'s Office (ICO) as required under UK GDPR.

For any privacy-related queries, contact us at: privacy@ukworkrights.co.uk

2. What Information We Collect

We collect minimal information. When you register for a free account we collect your name and email address to provide access to the tool and send you important updates. Your situation descriptions entered into the tool are not stored after your session ends.

Information you provide:

• The text you type into the tool describing your situation. This is sent securely to the Anthropic API to generate your guidance. We do not store this text on our servers after your session ends.
• If you purchase a full report (£2.99), your payment is processed by Stripe. We receive confirmation of payment but do not store your card details — these are handled entirely by Stripe.
• If you contact us by email, we store your email address and the content of your message to respond to you.
• If you submit a bug or feedback report using the on-site report form, we collect your name, email address and the content of your report. This is used solely to investigate the issue and respond to you. We do this on the basis of legitimate interests — it is necessary for us to collect this information to operate, maintain and improve the site. You would reasonably expect us to keep a record of a problem you have reported.

Information collected automatically:

• Standard web server logs including your IP address, browser type, pages visited and time of visit. These are used for security and to understand how the site is used.
• Google Analytics data — anonymised usage statistics including pages viewed, time on site and general geographic location (country/region level only). We do not collect precise location data.
• Google AdSense cookies — if you view advertisements on the site, Google AdSense may set cookies to serve relevant ads. See Section 5 for more on cookies.

3. How We Use Your Information

• To provide the guidance tool service — your situation description is processed by the Anthropic Claude AI to generate a response
• To process payments for full reports via Stripe
• To improve the site based on anonymised usage analytics
• To respond to enquiries sent by email
• To investigate and respond to bug or feedback reports submitted via the on-site report form
• To serve relevant advertisements via Google AdSense
• To comply with our legal obligations

4. Third Party Services

We use the following third party services which may process data on our behalf:

• Anthropic (Claude AI) — processes the text you enter to generate guidance responses. Anthropic does not use API data to train its models. See Anthropic's privacy policy at anthropic.com/privacy.
• Brevo — stores your name and email address when you register and sends your welcome email. See Brevo's privacy policy at brevo.com/legal/privacypolicy.
• Google Analytics — anonymised website usage statistics. Data is processed in accordance with Google's privacy policy.
• Google AdSense — display advertising. Google may use cookies to serve relevant advertisements.
• Stripe — payment processing for full reports. Stripe is PCI-DSS compliant. See stripe.com/privacy.
• Netlify / Cloudflare — website hosting and delivery. Standard server logs are retained for security purposes.

5. Cookies

We use the following types of cookies:

• Essential cookies — required for the site to function. Cannot be disabled.
• Analytics cookies — Google Analytics, used to understand how visitors use the site. You can opt out via our cookie consent banner.
• Advertising cookies — Google AdSense, used to serve relevant advertisements. You can manage these via our cookie consent banner or your browser settings.

You can manage your cookie preferences at any time using the cookie settings link in the footer.

6. Your Rights Under UK GDPR

Under UK GDPR you have the following rights regarding your personal data:

• Right to access — request a copy of any personal data we hold about you
• Right to rectification — request correction of inaccurate personal data
• Right to erasure — request deletion of your personal data where we have no legitimate reason to continue processing it
• Right to restrict processing — request that we limit how we use your data
• Right to object — object to processing of your personal data for direct marketing
• Right to data portability — request your data in a portable format

To exercise any of these rights, contact us at privacy@ukworkrights.co.uk. We will respond within 30 days.

You also have the right to lodge a complaint with the Information Commissioner\'s Office (ICO) at ico.org.uk or by calling 0303 123 1113.

7. Data Retention

• Tool query text — not stored after your session. Processed in real-time and discarded.
• Registration data (name and email) — stored securely by Brevo for as long as you remain subscribed. You can unsubscribe at any time.
• Server logs — retained for up to 90 days for security purposes then deleted.
• Analytics data — retained by Google Analytics for 26 months (anonymised).
• Email correspondence — retained for up to 2 years then deleted.
• Bug and feedback reports — retained for up to 2 years then deleted. This period allows us to track recurring issues and maintain a record of correspondence.
• Payment records — retained for 7 years as required by HMRC for tax purposes.

8. Data Security

We take reasonable technical and organisational measures to protect your information. The site uses HTTPS encryption for all data in transit. We do not store sensitive personal information such as financial details — these are handled by Stripe's secure payment infrastructure.

No method of transmission over the internet is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.

9. Children

This site is intended for adults aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided information to us, please contact us and we will delete it promptly.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in law or our practices. We will update the "Last updated" date at the top of this page. Continued use of the site after changes constitutes acceptance of the updated policy.