Privacy Notice

This Privacy Notice covers how we use and manage any data we collect from users of our Service.

How we use cookies and similar technologies is set out separately in our Cookie and Storage Policy (the "Cookie Policy").

Our app, database and servers are hosted by Amazon Web Services in London. Some of our providers process data elsewhere (see section 9).

1. Who we are

Solved Technologies Ltd ("Solved", "we", "us") runs solved.legal, the Solved MCP server (together, the "Service").

Solved is registered with the Information Commission (the ICO; reference ZC256813). For matters related to this notice, please contact: [email protected]

Solved's company number is 17359939 and its registered address is 32 Dean Court Road, Cumnor Hill, Oxford, OX2 9XD, England.

2. User types

The Service is used in two ways, and we treat them differently:

The terms that govern your use of the Service are in our Terms of Use (for Website Visitors) and our Terms of Service (for App Users).

The Service is not intended for anyone under 18, and you must be 18 or over to open an account.

3. Data we collect

This section describes the personal data we collect for each type of user.

3.1 Website Visitors

Page analytics are collected without cookies. For more detail refer to the Cookie Policy.

The following personal data is collected on Website Visitors:

3.2 App Users

For App Users, we collect everything described in section 3.1 plus the information in this Section.

3.2.1 Your account

This applies however you use the Service.

Payment information: We never see your full card details. Stripe handles these under its own privacy notice.

3.2.2 Using the Service in a browser

If you opt-in, you can choose to opt-out of session recordings at any time via your Workspace settings.

3.2.3 Using our MCP server

3.3 Marketing emails

We only send you product news and marketing emails if you have agreed to receive them, for example by ticking the box when you create an account. You can unsubscribe at any time using the link in every email or in your Workspace settings.

4. Exceptions

4.1 Unsolicited personal data

Our Terms of Use and Terms of Service ask you not to include personal data in searches, queries or feedback. For website feedback, we require your own email address in the email field so we can reply.

If personal data reaches us anyway, including information about someone else:

• We do not use it. We process it only as part of the search or message it arrived in. We do not try to identify the person or combine it with other information.
• We delete it when we find it. Otherwise, it is deleted when the record it is part of reaches the end of the relevant retention period (specified above).
• The same providers handle it as handle the search or message itself (section 7).

For searches, queries, or feedback received via the MCP, we also apply our client-data filter (section 5).

4.2 If you are mentioned by someone else

Solved is a legal research tool. It is not impossible that our users, and the AI agents acting for them, include personal information about third parties in what they send us.

We ask users not to do this. Our Terms of Service and Terms of Use prohibit it.

If a user ignores this:

• We do not use it. We process it only as part of the search or message it arrived in. We do not try to identify the person or combine it with other information.
• We delete it when we find it. Otherwise, it is deleted when the record it is part of reaches the end of the relevant retention period (specified above).
• The same providers handle it as handle the search or message itself (section 7).

For searches, queries, or feedback received via the MCP, we also apply our client-data filter (section 5).

You have the rights in section 10. Because we hold such data only as part of query or feedback text, we may need specific details from you, such as the wording used, to find it.

We generally cannot tell you directly that you were mentioned, because we have no way of knowing who you are or how to reach you. This section is how we tell you instead.

4.3 If you email us

If you contact us by email, we keep your name, email address and what you tell us, so that we can reply and keep a record of our correspondence. We keep it for 2 years after our last contact, unless we need it for a legal claim.

5. Our client-data filter

Before a request received via the Solved MCP is processed, our own servers check it for the following and reject it if any are found:

When we reject something, we return an error that explains why, so that you or your AI can rephrase it.

Rejection only applies to a specific request; it does not restrict your account, and your AI can rephrase and try again.

For feedback, only the feedback message is filtered. Users voluntarily providing their email in the relevant field will not be rejected by the filter.

We do not keep the text of rejected requests. We record only that a request was rejected and which type of identifier triggered it.

The filter runs entirely on our own servers; the text is not sent to any outside service for checking.

6. Why we use your data, and our lawful basis

Where we rely on legitimate interests, we have weighed our interests against yours. You can ask us for details, and you can object (section 10).

7. Who we share data with

We do not sell personal data. We share it only with the providers that run the Service for us, under contracts that require them to protect it:

If you sign in with Google, Google processes your sign-in as an independent controller under its own privacy policy.

We also use standard business software to run the company.

We may also disclose data where the law requires it, to protect our rights or the safety of others, or to a buyer if our business is sold. In the last case, we would tell you before your data became subject to a different privacy notice.

8. How long we keep your data

9. International transfers

We host the Service in the UK. Some of our providers process data outside the UK, as shown in section 7.

• European Economic Area (PostHog). UK law treats transfers to EEA countries as approved, so no further safeguards are needed.
• United States (Cloudflare, Resend, Calendly). Each of these providers is certified under the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge"), and we rely on that certification. Their data processing terms also include the UK Addendum to the EU standard contractual clauses as a fallback, in case the certification stops applying.
• Stripe transfers payment data under its own safeguards, as described in its privacy notice.
• Google Workspace (our email and documents). Google may process data in any country where it has facilities. We rely on the standard contractual clauses in Google's data processing terms.

You can ask us for a copy of the relevant safeguards.

10. Rights

Under UK data protection law, you can ask us to:

• give you a copy of your personal data;
• correct data that is wrong or incomplete;
• delete your data;
• restrict how we use it;
• give your data to you, or another provider, in a portable format, where we hold it on the basis of contract or consent;
• stop using it where we rely on legitimate interests. You can always object to marketing, and we will then stop;
• withdraw consent at any time, where we rely on it. This does not affect anything we did before you withdrew.

To exercise any of these rights, email [email protected] or use your Workspace settings. We will respond within one month. If we need to confirm your identity, or need more information to find the data (for example, the wording of a query that mentioned you), the month runs from when we receive it. We may extend the deadline by up to two further months if a request is complex or you have made several. If we do, we will tell you why within the first month. We will search for your data reasonably and proportionately.

10.1 Do you have to give us your data?

No law requires you to give us personal data.

• Website Visitors: you don't need to give us anything to read pages or search. Your browser has to send us your IP address and browser details for pages to load (section 3.1). To send feedback, you must provide your email address so we can reply.
• App Users: you must give us your name and email address to open an account (directly or through your SSO provider). Without them we can't provide one. We also need billing details to invoice you. Session recording and marketing emails are optional and are off unless you switch them on.

11. Complaints

If you are unhappy with how we have handled your personal data, please complain to us first at [email protected]. We will acknowledge your complaint within 30 days and tell you the outcome.

You also have the right to complain to the Information Commission: ico.org.uk, 0303 123 1113.

12. Security

Data is encrypted in transit. Our session cookie is encrypted and inaccessible to scripts, and access to stored feedback is limited to authorised personnel only.

13. Changes to this notice

We will update this notice when our practices change, and change the date below when we do. If a change significantly affects how we use App Users' data, we will tell them by email or in the app before it takes effect.