Privacy Policy
Last updated: 24 October 2026 · Version 1.0
1. Who we are
Vindex is operated by Adade Group Ltd ("Vindex", "we", "us"), a company registered in England and Wales (company number 16724207) with registered office at 5a Hythe Road, Thornton Heath, England, CR7 8QQ. Vindex is the data controller for the personal data described in this policy.
You can contact us about anything in this policy at privacy@vindex.legal.
This policy is written to satisfy the UK GDPR and Data Protection Act 2018, the EU GDPR where it applies to users in the European Economic Area, and the Ghana Data Protection Act 2012 (Act 843) for users in Ghana.
2. What Vindex is
Vindex is a software-as-a-service legal workspace. You upload legal documents, correspondence and evidence; the service extracts, analyses, critiques and drafts using a combination of our own software and third-party AI models. Because of what the service does, the data you upload can include sensitive personal data — including data about legal proceedings — belonging to you and to other people.
3. The data we hold
| Category | What it includes | Why we hold it |
|---|---|---|
| Account data | Email address, name, password (stored only as a salted hash), company/workspace name, role, phone number and address fields if you complete them, email verification records. | To create and secure your account (contract). |
| Sign-in data | Login history (timestamps, IP address, browser user-agent, success/failure), session records. | Security, abuse detection, troubleshooting (legitimate interests). |
| Case content | Documents and files you upload, the text extracted from them, document versions, case folders, summaries, critiques, form drafts, and annotations. May contain special category data (e.g. details of legal claims, health or financial information appearing in your documents). | To provide the service (contract). For special category data: establishment, exercise or defence of legal claims. |
| Conversations | Chat messages with the assistant (folder, document and selection chats), agent run records including their transcripts, support tickets you raise. | To provide the service and support you (contract; legitimate interests). |
| Voice data | Dictated audio clips, speech transcripts, voice-command logs, your trained phrases and pronunciation preferences. | To provide voice dictation and voice control (contract). Audio clips are also used to correct transcription accuracy for your account (legitimate interests; deletable on request). |
| Ambient sessions | Doorstep, case-prep and conference session transcripts, speaker labels you assign, and a record that you acknowledged the consent notice. | To provide live coaching features (contract). The consent record is kept as evidence of consent (legal obligation / legitimate interests). |
| Billing | Credit ledger entries, top-up orders, PayPal order and capture IDs, token-usage metering per request. We never see or store your card details — payment is handled entirely by PayPal. | To charge for metered features (contract) and to keep required financial records (legal obligation). |
| Technical | A per-request application log (endpoint, model used, token counts, success/failure, error traces), browser console diagnostics you opt into, cookie preferences. | Operating, securing and improving the service (legitimate interests). |
Your data, downloadable. You can obtain a machine-readable copy of the data we hold for your account at any time using the export in section 9 below — no request needed.
4. What we are NOT sent automatically
Browser-side preferences (voice settings, panel layouts, "don't show again" choices) live in your browser's local storage and are not transmitted to us. On-device speech recognition provided by your browser is processed by the browser vendor under its own terms; it never passes through us.
5. Who processes your data (sub-processors and recipients)
To run the service we send limited categories of data to the following processors. Document text, chat content and (for voice) audio clips are sent to AI providers only when you use the features that need them.
| Provider | Used for | Data sent | Location |
|---|---|---|---|
| Anthropic (Claude) | AI analysis and drafting | Document text, chat context | USA |
| OpenAI | AI analysis; Whisper audio transcription | Document text, chat context, dictated/uploaded audio | USA |
| Google (Gemini) | AI analysis and transcription; Google sign-in; Google Drive import if you connect it | Document text, chat context, audio; account email; Drive file data | USA |
| DeepSeek | AI analysis (low-cost engine) | Document text, chat context | China |
| OpenRouter | Overflow/fallback AI routing | Document text, chat context | USA |
| Brave Search | Web and legal research queries | Search terms derived from your requests (which may contain case names) | USA/EU |
| PayPal | Credit top-ups | Order details, your PayPal account | Per PayPal's policy |
| SMTP2GO | Relay for email sent by the service (receipts, alerts) | Email content, recipient address | EU |
| Our own servers | Hosting, database, local AI models (Ollama), text-to-speech (Piper), mail server | Everything above may also be stored or processed on servers we rent and operate | European datacentres |
Where an AI provider offers contractual terms restricting use of API data for model training, we operate under those terms. Processing by each provider is governed by its own data processing terms; the list above reflects the providers configured today and may change as engines are added or removed — this page is kept current.
Choosing your engine matters. The model picker offers a per-request choice of AI engine, including DeepSeek (China). Transfers to providers outside the UK/EEA — including to DeepSeek — are international transfers made under the safeguards required by Chapter V of the UK GDPR (or, for Ghana users, Act 843). If you prefer your content never to be processed by a particular provider, choose a different engine in the model picker; "Auto" routing may select any configured engine including DeepSeek.
6. Lawful bases
- Contract (Art 6(1)(b)) — providing the service, billing, support.
- Legitimate interests (Art 6(1)(f)) — security, abuse prevention, service improvement, transcription-correction learning on your own account's data.
- Legal obligation (Art 6(1)(c)) — financial/tax records, consent audit records.
- Consent (Art 6(1)(a)) — ambient listening sessions (doorstep/prep/meeting) require your in-app acknowledgement before each session type is used; Google Drive connection; optional diagnostic sharing.
- Special category (Art 9) — case content is processed under Art 9(2)(f) (establishment, exercise or defence of legal claims), and otherwise under your explicit consent as the person choosing to upload it.
Where you upload documents containing other people's personal data, you confirm you are entitled to process and share that data for your matter (for example as a party or representative in a dispute).
7. Cookies and storage
We use one essential session cookie (la.sid, 7 days, keeps you signed in) and a separate admin cookie on admin surfaces. We do not use advertising, analytics or tracking cookies. Preference data lives in your browser's local storage and is not sent to us. No consent banner is needed because we only use strictly-necessary cookies — if that ever changes, this policy and a banner will change with it.
8. Retention
- Account and case content: kept while your account is active. Deleted documents move to a Recycle Bin and can be restored until the bin is emptied; emptying the bin is irreversible.
- Voice dictation audio: retained to power transcription-correction features; deleted when the account is deleted or on request.
- Technical and request logs: rotated and kept for a limited period needed for operations and security.
- Billing records: kept for the period required by UK tax law (normally 7 years).
- When your account is deleted we delete or anonymise your personal data within a reasonable period, except records we must keep by law.
9. Your rights — and the self-service export
Under the UK/EU GDPR and Ghana's Act 843 you can: access your data, rectify it, erase it, restrict or object to processing, and receive a portable copy. You can also withdraw consent where processing is based on it (this may disable the related feature).
Self-service export (access + portability): sign in, then use the button below. It downloads a JSON file containing your account record, workspace content, conversations, voice records, billing ledger and activity logs — everything in section 3.
For anything the export doesn't cover — or for erasure, restriction or correction requests — email privacy@vindex.legal. We respond within one month.
You can complain to the UK ICO (ico.org.uk), your EU supervisory authority, or the Ghana Data Protection Commission — but please contact us first so we can try to fix the problem.
10. Other points
- Children: the service is not intended for anyone under 18.
- Automated decisions: we do not make decisions with legal or similarly significant effect about you by solely automated means. AI output is assistance for your decision, not a decision about you.
- Security: encrypted transport (HTTPS), hashed passwords, tenant isolation per company workspace, admin access restricted and audit-logged. No system is perfectly secure; if a breach affects your data we will tell you as the law requires.
- Changes: material changes are announced in-app or by email before they take effect; the "last updated" date at the top always shows the current version.
- Other controllers: if you connect Google Drive or pay via PayPal, those services are independent controllers for what they receive; their own policies apply.