Privacy policy

Obiter Research Limited (company number 17333423, registered office 71-75 Shelton Street, Covent Garden, London WC2H 9JQ) operates the Obiter legal research platform: this website, the signed-in workspace, the desktop application, and our APIs. We are the controller for the personal data described in this policy, except where we say otherwise.

Privacy questions and rights requests: privacy@useobiter.com. Security vulnerabilities: security@useobiter.com.

This policy covers four things separately, because they work differently: personal data in published judgments; your account; documents you or your organisation upload; and our redaction tool.

We republish court judgments and tribunal decisions from The National Archives’ Find Case Law service, under licence. Judgments are public documents and often contain personal data. The courts decide what is published and apply anonymity orders and reporting restrictions before publication. We publish judgments as the courts and The National Archives publish them: we do not edit their text, and we add no personal data to them.

Our lawful basis is legitimate interests, Article 6(1)(f) UK GDPR: supporting open justice by making public law freely searchable, and enabling verification of AI-generated legal statements against authoritative sources. Judgments necessarily record sensitive matters, so for special category data we rely on the condition for the publication of legal judgments (Schedule 1 paragraph 26, Data Protection Act 2018) and the research condition (Schedule 1 paragraph 4). We maintain the Appropriate Policy Document those conditions require, together with a Legitimate Interests Assessment and a Data Protection Impact Assessment.

We index judgments to provide search, citation checking and verification, and to evaluate the redaction technology described below. We do not currently use judgment text to train models; if that changes, we will update this policy first. We do not build profiles of individuals named in judgments, we do not offer people-search features, and we prevent search engines from indexing judgment pages, so appearing in a judgment here does not make you findable through a general web search of our site.

If you are named in a judgment: we keep our corpus aligned with The National Archives, so if a judgment is withdrawn or revised there, we remove or replace it here, and we comply with judicial decisions restricting the use of personal data, including anonymity orders and reporting restrictions. If you believe a judgment on our platform should not be public, that a restricted or withdrawn version is showing, or you wish to object to our processing, contact privacy@useobiter.com and we will assess your request individually within one month.

We cannot change the content of the public record. Applications to anonymise or restrict a judgment must be made to the court, and the authoritative published record is maintained by The National Archives at caselaw.nationalarchives.gov.uk. Where a judgment remains lawfully published there, we will not normally remove it here, because our processing remains necessary for the publication of the judgment and for the open justice interests above. We will explain our decision either way.

Browsing and searching judgments needs no account. If you create one, we process your name, email address, password (stored hashed), organisation membership, and security and usage records such as sign-ins, session data, feature usage and API activity.

• Performance of a contract: providing the service you signed up for.
• Legitimate interests: securing the platform, preventing abuse and bulk extraction of the corpus, and improving the product.
• Legal obligation, where one applies to us.

Accounts are required for the desktop application and the API, which is one of the controls that prevents bulk scraping of judgments. We keep account data while your account is active and for 24 months after closure, then delete or anonymise it.

For documents uploaded to the matter workspace, or to our hosted redaction service, by an organisation, we act as processor: your organisation is the controller, we process the documents only on its instructions under our data processing agreement, and questions about that data should go to your organisation first.

Matter documents are intended to be stored in Europe, are never mixed with or indexed into the public judgment corpus, and access is enforced server-side at organisation level. Where a feature uses an external AI model, confidential document content crosses that boundary only after redaction or pseudonymisation, and those calls are recorded and visible to your organisation.

If you work at a firm, university, public body, supplier or other organisation we deal with or approach, we process your name, role, work contact details and our correspondence with you, so that we can contact you, run pilots and partnerships, and manage the relationship. Our lawful basis is legitimate interests, and where you are the counterparty to a contract, performance of that contract.

We keep this data while the relationship is live and for 24 months after our last meaningful contact. Every outreach email includes an opt-out, and if you ask us to stop contacting you we keep the minimum record needed to make sure we do.

Redact exists to find personal data in documents so it can be removed or pseudonymised. Detection runs on our own European infrastructure or, where the on-device option is available, entirely on your machine, in which case document content never reaches us at all.

Hosted processing is transient and purpose-limited: we use your documents to perform the redaction you asked for, not to train models. Audit records show what was detected and what was decided, including a hash of the original text rather than the text itself. Those records are yours.

We do not sell personal data. We share it with the following categories of recipient:

• Infrastructure and hosting providers in Europe, who store and serve platform data.
• AI model providers, where a feature calls one, under contracts that prohibit training on our data.
• Operational suppliers such as email delivery, error monitoring and payment processing, where used.
• Professional advisers, and public authorities or courts where the law requires disclosure.
• A successor entity if the business is reorganised, with equivalent protections.

Where we act as processor for your organisation, we maintain a current list of sub-processors and will provide it on request to the controller, with notice of intended changes and an opportunity to object, as Article 28 requires. Ask at privacy@useobiter.com. A published sub-processor page is not yet available.

Our services run on European infrastructure. Where a feature sends data to an external provider, any transfer outside the UK or EEA is protected by an adequacy arrangement, including the UK-US Data Bridge where it applies, or by the UK International Data Transfer Agreement or standard contractual clauses with the required transfer risk assessment.

This site currently sets only cookies that are strictly necessary for it to work, including sign-in and security. Those do not require consent.

We intend to add product analytics so that we can see how the platform is used and improve it. Analytics storage is not strictly necessary, so it will not run until you have been asked and have agreed, and you will be able to withdraw that agreement at any time. If we later use analytics data to improve or train our models, we will say so at the point we ask you, and we will not use signed-in search queries for that purpose, because a query can disclose the existence and subject of a client matter.

We apply technical and organisational measures appropriate to legal-sector risk: access control, multi-factor authentication, encryption in transit and at rest, separation of environments, audit logging, backups with a tested restore path, and least-privilege operation. No online service can guarantee absolute security, and you should use strong credentials and protect the devices that access matters.

If we become aware of a personal data breach likely to result in a risk to your rights, we will notify the ICO within 72 hours where UK GDPR requires it, and tell affected people where the risk is high. Security detail is on the Security page.

You have the rights under UK GDPR to access, rectify, erase, restrict, object to and port personal data we hold about you, and rights relating to automated decision-making. We do not make automated decisions producing legal or similarly significant effects about you. Your rights in relation to judgment content are qualified as explained above.

To exercise a right, email privacy@useobiter.com. We respond within one month and may need to verify your identity first. Where your organisation is the controller of the data, contact your organisation’s administrator first and we will support them.

You can complain to the Information Commissioner’s Office at ico.org.uk or 0303 123 1113, although we would welcome the chance to resolve your concern first.

Accounts are for people aged 18 or over. Public judgment search needs no account and no personal data, so it can be used by students of any age, and where a school or college wants supervised access we provide it through an institutional account held by the institution rather than by individual pupils.

If you believe someone under 18 has created an account, contact privacy@useobiter.com and we will remove it.

We will post changes on this page with a revised version number and date. Material changes affecting account holders will be notified by email, and material changes to workspace processing will be communicated to your organisation.

Judgment content is Crown copyright material reproduced by permission of The National Archives. The contents of judgments can be used under the Open Justice Licence. The material on this platform only partially represents the activities of the courts and tribunals of England and Wales and UK-wide jurisdictions.