Privacy Policy
This policy explains, in plain English, what personal information ConsumerSuit collects, why, who we share it with, and the rights you have over it. It is written to meet the UK GDPR and the Data Protection Act 2018.
1. Who we are
ConsumerSuit is a self-help tool that helps individuals in England & Wales understand and assert their consumer, tenancy, employment and similar rights. It is operated by Athi 360, trading as ConsumerSuit ("we", "us"). For data-protection purposes, Athi 360 is the data controller for the information described here.
Contact for any privacy question or request, including to exercise any of the rights in section 8: [email protected].
2. The information we collect
If you create an account (Google sign-in)
When you sign in with Google we receive, from Google, your name, email address, profile picture and your Google account ID. We store these to create and identify your account. We never see your Google password.
When you use the tool
We process the content you submit — your description of a dispute, any documents or images you upload, and messages you send to the assistant — in order to generate your analysis, evidence map and draft documents.
If you buy a paid plan
Payments are taken by Stripe, our payment processor. We do not see or store your card details. We store only a Stripe customer reference, a payment reference, which tier you bought, and the date it expires (paid tiers are a one-off purchase lasting 30 days — there is no subscription), so we know what your account can access.
If you save a document to Google Drive
If you choose "Save to Drive", we ask Google for permission limited to files this app creates — we cannot see the rest of your Drive. We store the access token needed to place that file in your Drive, and nothing else about your Drive.
If you use a free checker (flight, parking, council tax)
If you ask us to keep you posted, we store the email address you give and the details of that specific claim, so we can send the confirmation and reminder you requested.
Automatically
To prevent abuse and protect our costs, our systems briefly note request timing and a rate-limit marker tied to your network address. We do not build advertising profiles.
When you confirm the England & Wales scope
ConsumerSuit covers the law of England & Wales only. Before an analysis, you confirm that your matter is governed by that law. We keep a minimal record of that confirmation — the time, the country and region you selected, and a coarse, country-level signal of where you connected from (provided by our hosting network). We do not store your full IP address for this, and we never attach your case details to it. This record exists only to confirm the basis on which you used the tool, and it is automatically deleted after about three years.
3. Why we use it, and our lawful basis
| What for | Lawful basis (UK GDPR) |
|---|---|
| Creating your account and signing you in | Performance of a contract |
| Generating your analysis and documents | Performance of a contract |
| Taking payment and applying the tier you bought | Performance of a contract |
| Sending the confirmation and reminder emails you asked for | Consent (you can opt out anytime) |
| Preventing abuse and controlling our running costs | Legitimate interests |
| Keeping a minimal record that you confirmed the England & Wales scope (fraud prevention and protecting us against unfounded claims) | Legitimate interests |
4. Who we share it with
We use a small number of trusted service providers ("processors") to run ConsumerSuit. We share data with them only as needed to provide the service:
- Cloudflare — hosting, and the databases that store your account and saved data.
- Google — sign-in (only if you choose to sign in with Google), and Google Drive (only if you choose to save a document there).
- Stripe — payment processing.
- Resend — sending the confirmation and reminder emails.
- AI providers — this is the important one, so we are specific about it. To produce your analysis, the text you submit and the text extracted from documents you upload are sent to third-party AI services. Our primary provider is Amazon Web Services (AWS Bedrock). Where that is unavailable or a different step is needed, we may also use Mistral, Google (Gemini), Anthropic (Claude), Groq, NVIDIA, or Cloudflare Workers AI. Your text is sent solely to generate your result — never to train anyone's model, and never for advertising. Please don't upload anything you would not be willing to have processed by these providers.
- Translation providers — if you write your case in another language, or download your document in another language, the relevant text is sent to a translation service to translate it: Sarvam AI (for Indian languages) and DeepL (for other languages). It is sent solely to translate your text.
- Tavily — to look up current UK law and figures, short search queries derived from your case (not your full text) are sent to this legal-search service.
We do not sell your personal data, and we do not share it for third-party advertising.
5. Cookies
We use only the cookies needed to make the site work — there are no advertising or third-party analytics cookies:
- cs_sess — keeps you signed in (essential).
- cs_oauth_state — a short-lived security cookie that protects the sign-in flow (essential).
- cs_tier — remembers a plan preview (essential to show the right features).
6. International transfers
Some of our providers (for example Amazon Web Services, Stripe, Anthropic, Google and Groq) are based in the United States. Where data is transferred outside the UK, it is protected by appropriate safeguards such as the UK International Data Transfer Agreement or equivalent contractual protections.
7. How long we keep it
- Account data — for as long as your account is open. Delete your account and we remove it.
- Sign-in sessions — expire automatically after 30 days.
- Checker leads — kept for up to 12 months so we can send the reminders you asked for, then deleted; removed sooner on request.
- Payment records — the tier, payment reference and expiry date, kept while your account is open and for as long as tax and accounting law requires.
- Your case text & uploads — processed to generate your result and not stored on our servers afterwards; they stay in your browser only.
8. Your rights
Under UK data-protection law you have the right to: access a copy of your data; correct it; have it deleted; restrict or object to how we use it; receive it in a portable format; and withdraw consent at any time. To exercise any of these, email [email protected]. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.
9. Children
ConsumerSuit is intended for adults (18+) and is not directed at children.
10. Changes to this policy
If we change this policy we'll update the date at the top. Significant changes will be made clear on the site.