Legify — Privacy Policy
Last updated: 18 October 2026
1. Introduction
Legify respects the privacy of individuals who interact with our website, use our software or communicate with us.
This Privacy Policy explains how personal information is collected, used, disclosed, retained and protected in connection with the Legify website, business operations and software platform.
Legify is a product and brand operated by:
Neurobay Ltd
Company number: 14906115
Registered in England and Wales
Registered office:
Suite 2458 Unit 5
399–405 Oxford Street
Mayfair, London W1C 2BU
United Kingdom
Website: https://www.legify.co.uk
Privacy enquiries: contact@legify.co.uk
For the purposes of this Policy, "Legify", "we", "us" and "our" refer to Neurobay Ltd.
2. Our role in handling personal information
Our data protection responsibilities depend on the context in which information is processed.
2.1 Where Neurobay Ltd is a data controller
We generally act as a data controller when determining how personal information is used for our own business purposes, including:
- Operating our public website.
- Responding to enquiries.
- Arranging product demonstrations.
- Managing prospective customer relationships.
- Administering commercial contracts and billing.
- Managing our own business contacts.
- Managing certain account administration and service security information.
- Communicating about products and services, where permitted by law.
- Meeting our legal and regulatory obligations.
In these circumstances, we determine the purposes and relevant means of processing.
2.2 Where Neurobay Ltd is a data processor
Where a law firm or other professional organisation uses Legify to store or manage its legal matters, client records, documents, correspondence or other information, that organisation will generally act as the data controller and Neurobay Ltd will act as a data processor, where we process such data on its behalf.
The customer organisation remains responsible for determining the lawful purposes for which that information is processed and for providing appropriate privacy information to individuals.
We process such customer-controlled information according to the applicable contract, Data Processing Agreement and lawful documented instructions.
Where a customer operates a separately hosted installation and Neurobay Ltd does not access or otherwise process its personal data, our processing role may be more limited.
The precise responsibilities depend on the services and technical arrangements agreed.
3. Personal information we collect
Depending on your relationship with Legify, we may process the following categories of personal information.
3.1 Website visitors
Information may include:
- IP address.
- Browser type and device information.
- Website usage and navigation information.
- Information collected through applicable cookies or similar technologies.
- Information voluntarily submitted through emails you send us.
3.2 Prospective and existing business customers
Information may include:
- Name and professional contact details.
- Company or law firm name.
- Job title and professional responsibilities.
- Business correspondence.
- Enquiry and demonstration information.
- Contractual, subscription and payment administration records.
- Customer support communications.
3.3 Authorised platform users
Depending on the relevant deployment and our role, information may include:
- Name and professional email address.
- Organisation affiliation.
- User role and permissions.
- Authentication and account activity.
- Support communications.
- Security and audit events.
- Technical information necessary for operating and protecting the service.
3.4 Information held within customer-managed legal matters
The Legify platform may be used by customers to process information about their clients, employees, witnesses, counterparties and other individuals.
This information may include:
- Names, addresses and contact details.
- Identification and verification documents.
- Contracts and legal correspondence.
- Financial information.
- Litigation or transaction records.
- Employment or immigration information.
- Health information.
- Other special-category information.
- Criminal offence information, where lawfully processed by the customer.
- Information potentially subject to legal professional privilege.
We do not determine which information a law firm chooses to place into a legal matter as part of its professional services.
Such processing is governed by the customer's instructions and the applicable processing arrangements.
4. How we use personal information and our lawful bases
Where we act as controller, the purposes and lawful bases may include:
| Purpose | Lawful basis |
|---|---|
| Responding to enquiries and arranging demonstrations | Legitimate interests or steps relating to a contract, as applicable |
| Administering contracts with individual customers or contacts | Contract, where applicable, or legitimate interests |
| Managing relationships with business customers | Legitimate interests |
| Providing account administration and relevant support | Contract where applicable, or legitimate interests |
| Securing systems and preventing misuse | Legitimate interests and, where applicable, legal obligations |
| Keeping necessary accounting and business records | Legal obligation |
| Sending marketing communications | Consent or another permitted basis, subject to electronic marketing rules |
| Managing disputes and protecting legal rights | Legitimate interests or legal obligations, as applicable |
Where we rely on legitimate interests, these include operating and improving our business, communicating with professional customers, protecting our services and maintaining appropriate commercial records.
We assess those interests against individuals' rights and reasonable expectations.
Where consent is required, it can be withdrawn.
We will not treat acceptance of our general contractual terms as blanket consent for unrelated marketing or tracking activities.
5. Legal case information and sensitive personal data
Legify is designed for use in professional environments that may involve confidential and sensitive information.
Where we act as processor, we handle customer-controlled case information only for the purposes authorised by the relevant customer and permitted by the applicable agreement.
We do not claim ownership of customer case information.
We do not independently use privileged legal documents or confidential case content for advertising, unrelated commercial profiling or the training of general-purpose artificial intelligence models.
Any proposed AI functionality involving customer-controlled case information would require an appropriate contractual, technical and data protection assessment, including a clear account of any external AI providers and applicable processing arrangements.
6. Sharing information
Where necessary and lawful, personal information may be disclosed to:
- Employees and authorised contractors who require access for their duties.
- Approved hosting, infrastructure and technology service providers.
- Relevant payment or billing service providers.
- Professional advisers, auditors and insurers.
- Public authorities, regulators or courts where required or permitted by law.
- Other parties involved in a lawful business transaction, subject to appropriate safeguards.
Where we act as processor, the engagement of sub-processors is governed by the relevant Data Processing Agreement.
We do not sell personal information to third parties.
7. International transfers
Depending on the infrastructure, hosting region, external services and support arrangements used for a particular Legify deployment, personal information may be processed outside the United Kingdom.
Where UK data protection law requires safeguards for an international transfer, we will use a lawful transfer mechanism and any necessary supplementary protections.
Such mechanisms may include applicable adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to recognised standard contractual clauses or another legally permitted mechanism.
Information about relevant transfers and safeguards will be made available as required by law.
The actual hosting locations, service providers and international transfer arrangements for customer-controlled case data should be described in the relevant customer documentation.
8. Information security
We recognise that the nature of legal case management requires careful protection of confidential information.
We aim to apply appropriate technical and organisational measures proportionate to the nature of the information and the risks involved.
These measures may include, as applicable to the deployed service:
- Access controls and user permissions.
- Authentication and account security.
- Encryption of communications.
- Protection of stored records.
- Secure infrastructure configuration.
- Monitoring and audit capabilities.
- Backup and recovery measures.
- Appropriate controls over authorised personnel.
- Security testing and incident management.
The precise controls applicable to a customer deployment are described in its contractual and security documentation.
No online platform can guarantee absolute security, and we do not represent that all potential security risks can be eliminated.
9. Data retention
We retain personal information only for as long as reasonably necessary for the relevant purpose, subject to legal obligations and applicable retention policies.
The retention of legal matter records is primarily a decision for the customer law firm acting as controller.
On termination, return and deletion of customer-controlled information are governed by the relevant contractual arrangements and Data Processing Agreement.
Information may remain temporarily within protected backup systems in accordance with a documented deletion schedule where legally and contractually permitted.
The following standard periods apply to personal information for which Neurobay Ltd acts as controller. These are purpose-based policy periods, not universal statutory time limits. We delete or anonymise records sooner where they are no longer needed, and review this schedule at least annually.
| Record category | Standard retention period and starting point |
|---|---|
| Website enquiries and demonstration requests that do not become customers | 12 months after the enquiry is resolved or the last substantive contact, whichever is later, to manage follow-up and repeat enquiries. |
| Marketing prospect records | Until consent is withdrawn or an objection is received, or 24 months after the last meaningful engagement, whichever is earlier. Meaningful engagement means an enquiry, reply or other active interaction, not merely receiving a message. |
| Marketing suppression records | Only the minimum information needed to honour an opt-out, for as long as the relevant marketing activity continues; necessity is reviewed annually. These records are not used for marketing. |
| User account profile and routine account administration records | For the active account and up to 12 months after closure to resolve access and administrative issues; unnecessary profile fields are removed sooner. Contract, financial and security records follow the separate periods below. |
| Customer contracts and essential commercial correspondence | 6 years after the contract ends, to address contractual queries and potential claims. A longer period applies only where justified by the particular agreement or legal obligation. |
| Billing, accounting and tax records | 6 years from the end of the last company financial year to which they relate, or longer where applicable tax rules, an enquiry or another legal obligation requires it. |
| Routine support enquiries | 24 months after the enquiry is closed, to resolve recurring issues. Unnecessary attachments and copied case information are removed sooner; information needed for a dispute follows a documented legal hold. |
| Routine website and application diagnostic logs | 90 days from creation, for troubleshooting and operational reliability. |
| Security, authentication and administrative audit logs | 12 months from the recorded event, for detecting and investigating misuse. Evidence relevant to an incident is isolated and retained only as necessary for that investigation or a legal hold. |
| Backups of controller records | A rolling period of up to 90 days from backup creation. Deleted information remaining in backups is kept beyond operational use until expiry; if restored for recovery, applicable deletion instructions are reapplied. |
These periods do not impose a blanket retention period on customer-controlled legal matter files, client documents or matter audit trails. The customer law firm determines and documents appropriate periods according to the matter type, applicable law, professional obligations and client instructions. This may require different periods for, for example, matters involving children, wills, trusts or property. The agreed Data Processing Agreement governs return, deletion and backup expiry for customer-controlled information.
Where litigation, a regulatory investigation or another legal obligation requires preservation, only relevant records are placed on a documented hold. Access is restricted, the need for the hold is reviewed, and the records are deleted or anonymised when the hold ends and no other lawful purpose remains. This schedule is a retention policy, not a representation that automatic deletion functionality is available in every deployment.
10. Your data protection rights
Subject to applicable law and relevant exemptions, individuals may have rights to:
- Access their personal information.
- Request correction of inaccurate information.
- Request erasure in certain circumstances.
- Request restriction of processing.
- Object to certain processing.
- Obtain or transfer certain information.
- Withdraw consent where processing is based on consent.
- Challenge relevant solely automated decisions, where applicable.
Where Neurobay Ltd acts as controller, requests may be submitted to:
Where personal information is controlled by a law firm using Legify, requests concerning the legal matter should generally be directed to that firm.
If we receive such a request, we may refer it to the appropriate controller or assist that controller in accordance with our legal and contractual obligations.
Legal professional privilege and other applicable statutory exemptions may affect how particular requests are handled.
11. Data protection complaints
You may raise a concern or complaint about our handling of personal information by contacting:
We will maintain a process for receiving, acknowledging, investigating and responding to data protection complaints.
We will acknowledge qualifying complaints within 30 days of receipt, take appropriate steps to investigate without undue delay, and communicate the outcome in accordance with applicable legal requirements.
Where a complaint concerns personal information controlled by a customer law firm, we will coordinate appropriately with that organisation.
You may also complain to the UK Information Commissioner's Office:
Information Commissioner's Office
https://ico.org.uk/make-a-complaint/
We encourage individuals to contact us first so that we have an opportunity to address their concerns, although this does not remove any right to approach the regulator.
12. Marketing communications
We may contact business representatives regarding Legify products, demonstrations, updates or other relevant services where permitted by law.
Where consent is required, we will seek it.
Recipients of marketing communications may unsubscribe or object at any time using the instructions provided or by contacting us.
Operational communications required for account administration, billing, security or service delivery are distinct from promotional marketing.
13. Cookies and similar technologies
Our website may use cookies and related technologies to support functionality, security, preferences and website analytics.
Details about their purposes and the choices available to users are described in our Cookie Policy.
Where legally required, non-essential technologies will not be activated before valid consent has been obtained.
14. Automated decision-making
We do not intend to make decisions about individuals that have legal or similarly significant effects solely through automated processing as part of our own website and sales administration.
Customer organisations remain responsible for assessing any automated processing that they configure or perform within their own legal workflows.
Any future Legify feature involving such automated decisions would require separate assessment and appropriate transparency.
15. Children's information
Our public website and business services are not primarily directed at children.
However, customer law firms may lawfully process information concerning children within legal matters.
Where we act as processor, such information will be handled under the relevant customer's instructions and applicable protections.
16. Changes to this Policy
We may revise this Privacy Policy to reflect changes to our business, systems, processing activities or legal obligations.
The updated version will be published with a revised date.
Where legally required, we will provide additional notice of material changes.
17. Contact details
Neurobay Ltd — Legify Privacy
Suite 2458 Unit 5
399–405 Oxford Street
Mayfair, London W1C 2BU
United Kingdom
Email: contact@legify.co.uk
Website: https://www.legify.co.uk