Data processing summary

HDR Compass is built on a zero-retention model: case files stay in firm-controlled storage and AI processing uses the firm’s own API key (BYOK). We do not become a second repository of your clients’ case papers, and we are not the AI processor for document content.

• Account and billing data (organisation name, user name, work email, subscription identifiers): EWLPS Legal Protocol Systems acts as an independent controller, using Supabase and Stripe as processors for the account platform.
• Client / matter data (case documents, photos, prompts containing client facts, generated reports): the subscribing firm remains the controller. This data does not reside on our servers; HDR Compass is not a processor of case content under the zero-retention model.

When a firm enables AI features, prompts and document excerpts are sent from the firm’s browser to the provider under the firm’s own API key. That firm–provider relationship (including any DPA and international transfers) is between the firm and the provider. HDR Compass is not party to it. Firms should review their provider’s terms, DPA and data-residency options before use.

The complete data processing addendum, privacy notice and terms of use live inside the application, alongside the zero-retention explainer on this site. For supplier due-diligence questions, contact privacy@ewlps.co.uk (compliance officer: Shaine Stead).