Privacy Policy

Last updated: 17 May 2026

BundleRight is operated by Nimble Tech Ltd ("we", "us", or "our"). This privacy policy explains how we collect, use, and protect your personal data when you use our document bundling service.

1. Information We Collect

Waitlist Information: When you join our waitlist, we collect:

• Your full name
• Your email address
• An optional indication of whether you would like to be considered for early-access beta testing
• The date and time you joined the waitlist

Account and Billing Information: When you purchase credits, we collect:

• Your firm name
• Your billing email address
• Payment information (processed securely by Stripe; we do not store your card details)
• Your licence key usage and credit balance
• Your credit expiry date (refreshed on every top-up; used to trigger reminder emails 30 days before expiry per terms.html §5)

Contact and Support Enquiries: When you contact us through our contact form or by email, we collect:

• Your name and email address
• Your firm name (optional)
• The subject and content of your message

Document Processing: When you use BundleRight to process documents:

• Documents are processed in temporary, session-only storage
• Extracted text is sent to AWS Bedrock, where Claude classifies it on our behalf. AWS is the data processor under the AWS Data Processing Addendum (see section 3 for detail)
• All documents are permanently deleted when your session ends
• We do not retain or store document content, and we do not log document content, filenames, or extracted text. Our operational logs contain only counts, processing times, and a server-issued session identifier.

SENDIST Matter Information: If you use the SENDIST Bundle workflow, you enter matter details on a short form to render the title page, the four-column contents table, and the practice-direction filename. This is the only personal data BundleRight reads from the content of your bundle. We collect:

• Appeal number
• Claimant (child) name and date of birth
• Respondent local authority
• Hearing date and bundle date
• Preparer name, firm, and client reference

SENDIST matter information lives only in session memory, is embedded in the title page and output filename, and is destroyed alongside the session directory when the bundle is downloaded or the session expires. It is never written to a database. Legal basis: contract (you are processing a SEND Tribunal appeal on your client's behalf and these fields are required by Practice Direction No. 1 of 2025).

Security and Abuse-Detection Logs: For each sign-in, session creation, and bundle generation we log:

• The event type (e.g. licence-validate, session-create, export-generate) and its outcome (success, failure, denied)
• Your source IP address
• An irreversible 16-character hash of your licence key — used to correlate events for the same firm without ever recording the key itself
• Small per-event metadata such as document counts and remaining credits

These logs never contain document content, filenames, extracted text, or your raw licence key. We retain them for 90 days and they are then automatically deleted. Legal basis: legitimate interests (security monitoring, fraud and abuse prevention).

2. How We Use Your Information

We use the information we collect to:

• Notify waitlist members when BundleRight launches
• Process payments and manage licence keys
• Provide the document bundling service
• Track credit usage against your licence key
• Send essential service communications (e.g., credit balance notifications)
• Respond to support requests

We will never:

• Sell or share your personal data with third parties for marketing purposes
• Use your document content for any purpose other than providing the service
• Retain your document content after your session ends
• Allow AI providers to train models on your documents

3. Zero Data Retention (ZDR)

BundleRight is built with law firm security requirements in mind. We do not send your document text to the Claude API directly. AI calls are routed through AWS Bedrock — the same AWS account in which our application and database run — so that AWS is the data processor for those calls under the AWS Data Processing Addendum that already governs the rest of our infrastructure. Anthropic, as the underlying model provider, does not receive your content directly under this arrangement.

Under the AWS DPA covering our Bedrock calls:

• AWS does not retain the prompts we send or the completions Claude returns
• Your document content is not used to train, fine-tune, or evaluate any model
• AWS does not log the content of your requests; the Usage-Policy / safety-classifier carve-outs from Anthropic's direct-API ZDR terms do not apply on this path

The Claude API itself is not invoked directly from BundleRight at any point — every regression test on every code change verifies this. If a future code change accidentally tried to bypass Bedrock, the automated test suite would fail before the change could ship.

Independent of AWS's retention, on our own systems:

• All temporary files are permanently deleted at the end of each session
• No document content is stored in any database
• Our application logs record counts, processing times, and a server-issued session identifier only — never document content, filenames, or extracted text

4. Data Storage and Security

We implement appropriate security measures to protect your information:

• All data transmission uses HTTPS/TLS encryption
• Documents are processed in temporary, session-scoped storage only
• Services are hosted on AWS infrastructure in accordance with industry standards
• Payment processing is handled by Stripe, a PCI-compliant payment processor
• Access to systems is restricted and logged

5. Data Sharing

We share your information only with trusted service providers who help us operate BundleRight:

• Amazon Web Services (AWS): To host our application, store licence-key records, and run document classification and OCR through AWS Bedrock. Application and database run in the UK (London region, eu-west-2). AI processing runs on AWS Bedrock in the UK for classification, and within AWS EU regions for OCR and PDF-split detection (see section 9 for the routing detail).
• Anthropic: The underlying model provider for the Claude language model. With our AI calls routed via AWS Bedrock, AWS is the data processor and Anthropic does not receive BundleRight traffic directly (see section 3).
• Stripe: To process payments securely
• Netlify: To host the BundleRight marketing site and receive waitlist and contact-form submissions
• Google Fonts: To serve the typefaces used on our pages. Google receives your IP address when fonts are loaded but does not receive any other personal data through this load.

These providers are contractually obligated to protect your data and use it only for the purposes we specify.

6. Your Rights

Under UK data protection law (UK GDPR), you have the right to:

• Access your personal data
• Correct inaccurate personal data
• Request deletion of your personal data
• Object to processing of your personal data
• Request restriction of processing your personal data
• Request transfer of your personal data (data portability)
• Withdraw consent at any time

To exercise any of these rights, please contact us at privacy@bundleright.co.uk.

7. Data Retention

• Waitlist data: Retained until launch, then for 90 days, then deleted unless you become a customer
• Account and billing data: Retained for the duration of your licence, plus 6 years afterwards to meet UK statutory tax record-keeping requirements
• Document content: Deleted at the end of your session (typically within minutes of the session ending)
• SENDIST matter information: Held only in session memory and destroyed alongside the session directory when the bundle is downloaded or the session expires. Never written to a database.
• Operational logs: Counts, processing times, and session identifiers are retained for 90 days, then automatically deleted. Logs never contain document content or filenames.
• Security and abuse-detection logs: Event type, outcome, source IP address, and an irreversible hash of your licence key are retained for 90 days, then automatically deleted. These logs never contain document content or your raw licence key.
• Credit usage records: Retained for the life of your licence plus the 6-year tax retention period described above

8. Cookies, Browser Storage, and Tracking

BundleRight is designed to minimise client-side state:

• The BundleRight application itself sets no cookies and uses no browser storage. Your licence key, session identifier, and any in-progress work live only in the page while it is open and are cleared when you close the tab.
• Marketing site forms (waitlist and contact): our forms are processed by Netlify, which sets a small number of essential cookies to detect spam and prevent duplicate submissions. These are not used for analytics or advertising.
• Web fonts: our pages load fonts from Google Fonts. Google receives your IP address when fonts are requested, but no cookies are set by this load.

We do not use tracking cookies, analytics cookies, or advertising cookies.

9. International Transfers

BundleRight is hosted entirely on AWS in the United Kingdom (London region, eu-west-2), and your licence and billing data does not leave the UK.

Document processing also runs inside AWS, with the following routing:

• Classification runs in the UK. The Claude Sonnet model is invoked through AWS Bedrock in the London region; the call does not leave the United Kingdom.
• OCR and multi-document PDF splitting use the Claude Haiku model, which is currently invoked through AWS Bedrock's EU geo profile. AWS routes the call to one of its EU regions (London, Dublin, Frankfurt, Stockholm, Milan, Madrid, or Paris). The call stays within the EU; AWS chooses the specific EU region per request based on capacity. When AWS adds Haiku in-region to London, these calls will become UK-only.

The AWS Data Processing Addendum covers all of this AI processing. Document text is not transferred to the United States as part of BundleRight processing.

Stripe processes payment information under its own international transfer safeguards; we never see or store your card details.

10. Children's Privacy

BundleRight is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of significant changes by email (if you have provided one) or by posting a notice on our website. The "Last updated" date at the top of this policy indicates when it was last revised.

12. Contact Us

If you have questions about this privacy policy or how we handle your data, please contact us:

Nimble Tech Ltd
Please contact us using our contact form
Website: bundleright.co.uk

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk.