Privacy Policy

This policy explains, in plain English, what personal information ConsumerSuit collects, why, who we share it with, and the rights you have over it. It is written to meet the UK GDPR and the Data Protection Act 2018.

1. Who we are

ConsumerSuit is a self-help tool that helps individuals in England & Wales understand and assert their consumer, tenancy, employment and similar rights. It is operated by ATHI 360 LTD, trading as ConsumerSuit ("we", "us"). For data-protection purposes, ATHI 360 LTD is the data controller for the information described here.

Contact for any privacy question or request, including to exercise any of the rights in section 8: support@consumer-suit.uk.

ATHI 360 LTD is a private limited company registered in England and Wales, company number 17401160. Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

2. The information we collect

If you create an account (Google sign-in)

When you sign in with Google we receive, from Google, your name, email address, profile picture and your Google account ID. We store these to create and identify your account. We never see your Google password.

When you use the tool

We process the content you submit — your description of a dispute, any documents or images you upload, and messages you send to the assistant — in order to generate your analysis, evidence map and draft documents.

If you buy a paid plan

Payments are taken by Stripe, our payment processor. We do not see or store your card details. We store only a Stripe customer reference, a payment reference, which tier you bought, and the date it expires (paid tiers are a one-off purchase lasting 30 days — there is no subscription), so we know what your account can access.

If you save a document to Google Drive

If you choose "Save to Drive", we ask Google for permission limited to files this app creates — we cannot see the rest of your Drive. We store the access token needed to place that file in your Drive, and nothing else about your Drive.

If you use a free checker (flight, parking, council tax)

If you ask us to keep you posted, we store the email address you give and the details of that specific claim, so we can send the confirmation and reminder you requested.

Messages you send us, and beta feedback

If you contact support, report a problem, or send us feedback while we are testing, we store what you wrote, the email address we reply to, and a reference number — so that a request cannot be lost and so we can answer you. We also record which area it relates to and how urgent it is, so that anything about a legal deadline is seen the same day.

Our lawful basis is performing our contract with you (Article 6(1)(b)) where you are a user, and our legitimate interest in running a support desk (Article 6(1)(f)) otherwise. We do not need, and do not ask for, your consent to hold a message you chose to send us — but you can ask us to delete it at any time.

During the beta, feedback may also be submitted through a Google Form. That form does not collect your email address. Responses are stored in Google Sheets and forwarded into our support queue.

What we do with feedback

We use it to fix the tool. Telling us the tool reached a wrong section, a wrong time limit or a wrong conclusion is the single most useful thing a user can do, and that is what beta feedback is for: we use it to correct the rules, the citations and the checks behind the analysis, and to build the test cases we grade ourselves against. To be precise about what that does not mean — we do not use your feedback, or your case, to train an AI model. It is used to improve the product itself.

Some general comments may be shown on the site. Short, everyday opinions about ConsumerSuit may appear publicly on the site as brief quotes. Complaints, problem reports and anything abusive are never published — they go to a private queue that only we see. We never publish your name, your email address or anything about your case alongside a comment. If you would rather nothing you wrote appeared publicly, say so in the message or email us and we will remove it.

If a report suggests the tool got something wrong, we may send you a short follow-up form asking for a bit more detail, so we can reproduce the mistake and fix it properly. Filling it in is always optional.

Automatically

To prevent abuse and protect our costs, our systems briefly note request timing and a rate-limit marker tied to your network address. We do not build advertising profiles.

When you confirm the England & Wales scope

ConsumerSuit covers the law of England & Wales only. Before an analysis, you confirm that your matter is governed by that law. We keep a minimal record of that confirmation — the time, the country and region you selected, and a coarse, country-level signal of where you connected from (provided by our hosting network). We do not store your full IP address for this, and we never attach your case details to it. This record exists only to confirm the basis on which you used the tool, and it is automatically deleted after about three years.

3. Why we use it, and our lawful basis

3a. Sensitive details inside your case

Some cases cannot be explained without sensitive information. A disability discrimination claim is about your health; a race or religion claim is about your ethnic origin or beliefs; others involve sexual orientation or pregnancy. UK GDPR calls this special category data and gives it extra protection, so we want to be specific about it rather than leave it unsaid.

When we process it: only when you put it there — in what you type, or in a document you upload. We do not ask for it separately, and we do not infer it about you for any purpose other than analysing the claim you brought us.

Our condition for processing it: UK GDPR Article 9(2)(f) — processing necessary for the establishment, exercise or defence of legal claims. That is precisely what this tool is for: you are preparing a claim, and the sensitive detail is part of the claim itself. This sits alongside the Article 6 basis in the table above, not instead of it.

What that means in practice: it is handled the same way as the rest of your case — sent to the AI providers listed below to produce your analysis, and not stored on our servers afterwards; it stays in your browser. It is never used to advertise to you and never sold. On training, see “Training and retention at the AI providers” in section 4 — we set out there exactly what each provider has confirmed, rather than making a single promise on their behalf.

If a case involves an allegation of criminal conduct — for example a dismissal for alleged theft — please think carefully before including detail you do not need. The tool works from the facts you consider relevant, and you are always free to describe events without naming the allegation.

4. Who we share it with

We use a small number of trusted service providers ("processors") to run ConsumerSuit. We share data with them only as needed to provide the service:

• Cloudflare — hosting, and the databases that store your account and saved data.
• Google — sign-in (only if you choose to sign in with Google), Google Drive (only if you choose to save a document there), and, during the beta, Google Forms and Sheets for the feedback form.
• Stripe — payment processing.
• Resend — sending the confirmation and reminder emails.
• AI providers — this is the important one, so we are specific about it. To produce your analysis, what you give us is sent to third-party AI services. Exactly what leaves your device depends on the file:
  • What you type — your description, and messages to the assistant — is sent as text.
  • PDF, Word and RTF files are converted to plain text inside your browser. Only that extracted text is sent. The file itself never leaves your device.
  • Images are sent as images. A picture has to be looked at to be read, so photos of letters, screenshots of messages, and scanned PDFs that contain no selectable text are transmitted as the image itself, not as text. These go to AWS Bedrock.
  • Audio is sent as an audio file to be transcribed — a recording has to be listened to. Transcription is done by Groq, because it is the only provider we use that handles audio.
  Our primary provider is Amazon Web Services (AWS Bedrock), which handles both text and images. Where that is unavailable, we use Groq, which runs the same family of models (Qwen). No other provider analyses your case; translation and legal search use the services listed next. What you send is used solely to generate your result, and never for advertising. On training and retention, see the next paragraph. Please don't upload anything you would not be willing to have processed by these providers.
• Translation providers — if you write your case in another language, or download your document in another language, the relevant text is sent to a translation service to translate it: Sarvam AI (for Indian languages) and DeepL (for other languages). It is sent solely to translate your text.
• Tavily — to look up current UK law and figures, short search queries derived from your case (not your full text) are sent to this legal-search service.

We do not sell your personal data, and we do not share it for third-party advertising.

Training and retention at the AI providers

We ask every provider to use your text only to produce your result. What each provider commits to differs, and it can depend on the plan an account is on, so rather than give you a single promise on their behalf we tell you where we stand:

• AWS Bedrock (our primary provider) states that your content is not used to improve its base models and is not shared with any model provider. We have also set our AWS account’s data-retention mode to “none”, so the text and images you send are not retained after your result is produced. Some of the models we run there are built by other companies (for example Qwen and DeepSeek); this setting is what stops your text being passed on to them, and we check it automatically.
• Groq’s Services Agreement states it is not permitted to use inputs or outputs to train or fine-tune any model unless we instruct it to, which we do not. It does not retain inputs and outputs for standard requests, and we have additionally enabled Zero Data Retention on our account — which we enabled for both the text and the audio-transcription interfaces, so it covers any recording you upload. Audio is the one thing AWS cannot process for us, which is why recordings go here rather than to our primary provider.

So every provider that receives your case text has now been checked against its own terms, and every one of them says it will not train on it.

What we removed, and why. Until 11 August 2026 two further providers sat in this list. Checking their terms properly showed that the plans we were on permitted them to use submitted content to improve their own products. We removed both from the system rather than reword this page. We would rather lose a fallback than keep one we cannot describe honestly.

If this matters to your decision to use ConsumerSuit, please ask us — we will tell you straight.

5. Cookies

We use only the cookies needed to make the site work — there are no advertising or third-party analytics cookies. Separately, some pages count anonymous events (for example "flight checker opened") as simple tallies: no cookie, no identifier and nothing you typed is sent with them.

• cs_sess — keeps you signed in (essential).
• cs_oauth_state — a short-lived security cookie that protects the sign-in flow (essential).
• cs_tier — remembers a plan preview (essential to show the right features).
• cs_drive_state — a short-lived security cookie that protects the "Save to Drive" flow, set only if you use it and deleted as soon as it finishes (essential).

6. International transfers

Some of our providers (for example Amazon Web Services, Stripe, Google and Groq) are based in the United States. Where data is transferred outside the UK, it is protected by appropriate safeguards such as the UK International Data Transfer Agreement or equivalent contractual protections.

7. How long we keep it

• Account data — for as long as your account is open. Delete your account and we remove it.
• Sign-in sessions — expire automatically after 30 days.
• Checker leads — kept for up to 12 months so we can send the reminders you asked for, then deleted; removed sooner on request.
• Support messages & beta feedback — kept for up to 120 days, then deleted automatically; removed sooner on request.
• Payment records — the tier, payment reference and expiry date, kept while your account is open and for as long as tax and accounting law requires.
• Your case text & uploads — processed to generate your result and not stored on our servers afterwards; they stay in your browser only.

8. Your rights

Under UK data-protection law you have the right to: access a copy of your data; correct it; have it deleted; restrict or object to how we use it; receive it in a portable format; and withdraw consent at any time. To exercise any of these, email support@consumer-suit.uk. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

9. Children

ConsumerSuit is intended for adults (18+) and is not directed at children.

10. Changes to this policy

If we change this policy we'll update the date at the top. Significant changes will be made clear on the site.