Privacy notice

Data controller

HDR Compass is a product of EWLPS Legal Protocol Systems (“we”, also trading as EWLPS). The controller of account personal data for this service is EWLPS Legal Protocol Systems.

• Compliance officer: Shaine Stead
• Privacy: privacy@ewlps.co.uk
• Support: support@ewlps.co.uk
• Company site: https://ewlps.co.uk
• Address: 10 Devon Close, Macclesfield, Cheshire SK10 3HB
• ICO registration: ZB861396
• Governing law: England and Wales

What we process

We process account and billing data only, for example:

• Organisation and user accounts
• Subscription / licence status
• Work email and name used to create the account
• SRA firm number (format-validated, not verified against the SRA register)
• Legal-acceptance records (which versions of our Terms, Privacy notice and DPA you accepted, and when)
• Organisation invitations (email address, role, and status of pending invitations)
• Stripe customer and subscription identifiers

What we do not process on our servers

• Case documents or file contents
• AI prompts or completions containing client facts
• Vetting or case-review report bodies
• Connected folder inventories beyond the live session

Case files stay in firm-controlled storage (A local or synced firm folder the browser is granted (Microsoft Graph OAuth not yet shipped)). AI requests use your BYOK key and are not retained by HDR Compass for training or later retrieval.

Lawful basis

Contract (providing the subscribed service) and legitimate interests (securing accounts, preventing abuse, improving reliability of the account platform). Where required, we rely on consent for optional communications.

Processors and international transfers

We use the following processors for the account platform. Some may process data outside the UK; where they do, we rely on appropriate safeguards offered by those providers (for example standard contractual clauses or UK adequacy arrangements) as applicable to the service configuration.

• Supabase — Authentication and account database hosting. Personal data in profiles/organisations/subscriptions. Region depends on the configured Supabase project (currently UK, London — eu-west-2).
• Stripe — Subscription payments and customer billing portal. Name, email, and payment metadata as required to take and manage fees.
• Firm-chosen AI provider (BYOK) — Optional AI drafting / analysis. Prompts and document excerpts are sent from the browser to the firm’s provider under the firm’s API key. HDR Compass is not the controller of that processing relationship.

Cookies

We use essential cookies / local storage required for authentication sessions and product settings (for example Supabase auth cookies and your BYOK API key held only in your browser). We do not currently use analytics or advertising cookies.

Retention

Account and billing records are kept while the organisation account exists and thereafter for up to 6 years where needed for tax, accounting, dispute, or security logs, unless a longer period is required by law. Case content is not retained on HDR Compass infrastructure.

Your rights

Under UK GDPR / the Data Protection Act 2018 you may request access, rectification, erasure, restriction, or portability of account data we hold, and may object to certain processing. Contact privacy@ewlps.co.uk (compliance officer: Shaine Stead). We are registered with the ICO under number ZB861396. You may complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we handle account personal data.

England & Wales scope

Product workflows are oriented to England housing-disrepair practice. Wales (including Renting Homes (Wales) Act frameworks) is not fully modelled — treat outputs as advisory and jurisdiction-check locally.