Legal
Privacy Notice
Last updated: 3 August 2026
This notice explains how Solicity ("we", "us") collects and uses personal data when you use our platform. We act as data controller for account and usage data. For the content of matters — client details entered by a professional in the course of a transaction — the professional's organisation is the controller and we act as its processor.
1. What we collect
Account data — name, work email, phone number, password (stored hashed), optional profile photo, your role and organisation.
Organisation data — company name, size, website, address, regulatory identifiers such as an SRA number, and an optional logo.
Matter data — property details, transaction parties and documents entered by users in the course of a transaction. We process this on the organisation's instructions.
Usage data — log records of actions taken in the Service (who did what and when), device and browser information, and IP addresses, kept for security and audit.
2. Why we use it and our lawful bases
To provide the Service and your account — performance of a contract. To secure the platform, keep audit trails and prevent abuse — legitimate interests. To meet legal obligations that apply to us. To send service emails such as invitations, confirmations and material changes to terms — performance of a contract; anything promotional would be sent only with consent.
We record the date and version of the terms and privacy notice you accepted at signup.
3. Who we share it with
Infrastructure and processing suppliers under contract: Supabase (database, authentication and file storage) and our hosting providers. People you invite to a matter or organisation see the data their role permits. We do not sell personal data, and we do not share it with advertisers.
4. International transfers
We aim to keep data in the UK or EEA. Where a supplier processes data outside those regions, we rely on UK-approved safeguards such as the International Data Transfer Agreement or addendum to the EU Standard Contractual Clauses.
5. How long we keep it
Account data is kept while your account is active and deleted or anonymised within 30 days of account closure, except where law or a live dispute requires longer retention. Matter data is retained according to the controlling organisation's instructions. Audit logs are kept for as long as needed for security and legal compliance.
6. Your rights
Under UK GDPR you can ask for access to your data, correction, deletion, restriction, portability, and you can object to processing based on legitimate interests. Write to us at the address below. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).
7. Cookies
We use only the cookies and local storage necessary to sign you in and keep your session. We do not use advertising or cross-site tracking cookies.
8. Contact
Data protection queries: privacy@solicity.co.uk.