JusFund Privacy Notice

LexQuity Ltd, a company incorporated in England and Wales under company number 17288154 with its registered office at Flat 205, 5 Barking Wharf Square, Barking, England, IG11 7HZ, operates JusFund and is the controller of the personal data described in this notice. Write to info@jusfund.tech for anything about your data. Where the law requires a data protection officer or a representative in a particular region, the details are published at the end of this notice.

Where you upload documents that contain personal data about other people, such as the parties, witnesses, counsel or arbitrators in a case, you decide why that data is processed and you are its controller. We process it on your instructions as your processor, on the terms in section 12.

Account data. Your name, email address, organisation and role, whether you are the party or act for it, your password in hashed form, and, if you sign in with Google or Microsoft, the name and email address they pass to us. If you add a mobile number for sign-in codes, we keep the number and use it only to send those codes.

Verification data. For fund seekers before a case can be listed, and for funders before the Deal Desk opens: identity documents, company registration extracts, regulatory status, proof of authority to act, and the results of sanctions and registry checks.

Case data. The documents you upload, the answers you give about the case, the assessments the platform produces from them, and every version of them. These frequently contain personal data about people who are not our users.

Activity data. What you do on the platform: uploads, assessment runs, report views, listings, access requests, NDA acceptances and decisions, support requests, and administrative actions taken on your account. This is kept as an audit trail because confidential material is involved.

Technical data. IP address, browser and device information, the pages and features you use, timestamps, security events, error reports and the result of the bot-protection check on sign-in and sign-up.

Communications. Emails you send us, support requests, and the emails we send you.

From you, from the organisation you act for, from the Google or Microsoft account you sign in with, from the documents you upload, from public registries we query to verify a firm or check a counterparty, and from the operation of the platform itself.

• To create and run your account, produce assessments, present listed cases to funders and record acceptances. Basis: performance of our contract with you.
• To verify identity, firms and authority, and to screen against sanctions and registry data. Basis: legal obligation where one applies, otherwise our legitimate interest in a marketplace of identifiable, professional participants.
• To keep an audit trail of access to confidential material. Basis: our legitimate interest in evidencing who saw what and when, which is also in the interest of every fund seeker.
• To secure the platform, detect abuse, and defend against attacks. Basis: legitimate interest and legal obligation.
• To send service emails about your account, your cases and your access requests. Basis: performance of the contract. Marketing emails are sent only with your consent, and you can withdraw it at any time.
• To improve the platform, using aggregated or de-identified information wherever possible. Basis: legitimate interest.
• To comply with law, respond to lawful requests, and establish, exercise or defend legal claims. Basis: legal obligation and legitimate interest.

We do not sell personal data, and we do not share it with third parties for their own marketing. We do not use your case documents to train any model, ours or anyone else's.

To produce an assessment, the platform sends the extracted text of your record to AI model providers, one section at a time, together with instructions written by us. It sends queries derived from the facts of the case to search services and public registries. A second AI model from a different provider reviews the finished assessment. The output is labelled as AI-generated, versioned, and traceable to the framework version used.

Our contracts with these providers prohibit them from training on your content and limit retention to what the service needs, typically zero or a short abuse-monitoring window. Section 6 describes them. The assessment is not a decision about you with legal effect. It is a research document that you, and any funder you admit, read and decide on. You can question any output, ask for a human review by writing to us, and re-run the assessment with more material.

We use service providers who process data on our instructions under written contracts. At the date of this notice they are:

• Supabase, our database, file storage and authentication provider, hosted on Amazon Web Services in Paris, France. All case documents and records are stored there.
• Vercel, which hosts the website and serves it from a global network. Static pages only, no case data is stored with Vercel.
• Cloudflare, whose Turnstile service checks that a sign-in or sign-up is made by a person. It receives your IP address and browser signals.
• Resend, which delivers our emails. United States.
• An SMS delivery service, which sends sign-in codes to the mobile number you add. United States.
• Sentry, which receives error reports from the platform so we can fix faults. Reports may include your account identifier.
• AI model providers established in the United States, whose models read the record and write the assessment, and document-reading services in the European Union and the United States, used for scanned documents.
• A second review model provider, a different provider from the ones that write the assessment, used to check the finished assessment. Its international service is operated from outside the United Kingdom and the European Union. It receives the assessment text and the passages of the record needed to check it, under a contract that prohibits training and retention beyond the service.
• Search services in the United States, which receive queries derived from the facts of a case, never your documents.
• Public registries and screening lists, including Companies House in the United Kingdom, the SEC's EDGAR system and the United States consolidated screening list, which receive the name of a firm or party being checked.

We do not publish the names of individual model providers, because they change as the platform is tuned. The categories, the locations and the contractual terms above stay the same, and the current list is available on request.

Funders receive what you list: the anonymised summary first, then, for a funder you approve under an NDA, the full report and record. Our professional advisers, auditors and insurers may receive data where needed. Courts, tribunals, regulators and law enforcement receive data where the law requires. If LexQuity is sold or reorganised, data passes to the successor under this notice.

Your data is stored in France. The providers above operate in the United States, the European Union and Asia, so personal data leaves the United Kingdom and the European Economic Area when the platform uses them.

For readers in the United Kingdom, transfers rely on an adequacy regulation where one exists and otherwise on the International Data Transfer Agreement or the Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment. For readers in the European Economic Area, transfers to the United Kingdom rely on the European Commission's adequacy decision, and transfers onward rely on the Standard Contractual Clauses with supplementary measures where needed. For readers in Singapore, we transfer data only where the recipient is bound to a standard of protection comparable to the Personal Data Protection Act 2012. For readers in the United Arab Emirates, transfers are made to jurisdictions with adequate protection or under contractual safeguards as the Personal Data Protection Law permits. You can ask us for a copy of the safeguards that apply to a transfer.

Where a legal claim, a regulatory investigation or a legal duty requires it, we keep the relevant records for longer, and only for that purpose. Backups are overwritten on their ordinary cycle.

Everyone can ask us for a copy of their personal data, ask us to correct it, ask us to delete it, object to or restrict processing based on legitimate interest, receive the data they gave us in a portable form, and withdraw consent where consent is the basis. Some rights are limited by our legal duties, by the rights of other people whose data is in the same documents, and by the confidentiality obligations that attach to a case. We reply within one month, or sooner where a shorter period applies.

United Kingdom and European Union. You have the rights above under the UK GDPR and the EU GDPR, and the right to complain to a supervisory authority: the Information Commissioner's Office in the United Kingdom, or the authority in the EU member state where you live or work.

United States. Residents of states with comprehensive privacy laws, including California, have the right to know, to delete, to correct, to obtain a portable copy, and not to be discriminated against for exercising a right. We do not sell or share personal data for cross-context advertising, we honour browser opt-out preference signals where the law requires it, and we do not use sensitive personal information for any purpose beyond providing the service. Write to us to exercise a right, and you may use an authorised agent.

United Arab Emirates. You have the rights of access, correction, erasure, restriction, objection and portability under Federal Decree-Law No. 45 of 2021, and the right to complain to the UAE Data Office. Where you deal with us through a free zone with its own data protection law, such as the DIFC or the ADGM, the rights under that law apply.

Singapore. You have the rights of access and correction and the right to withdraw consent under the Personal Data Protection Act 2012, and the right to complain to the Personal Data Protection Commission. Our data protection officer for the purposes of the Act can be reached at info@jusfund.tech.

Everywhere else. The rights above are offered to every user as a matter of policy, subject to local law.

The platform does not make decisions about you by automated means that produce legal or similarly significant effects. The assessment is a research document. Whether a case is listed is your decision. Whether a case is funded is the funder's decision. Whether a funder is admitted is decided by a person at LexQuity after verification.

Personal data and case material are encrypted in transit and at rest, held in private storage that is never public, and accessible only to the account that owns them, to the funders they are disclosed to under an NDA, and to a small number of LexQuity staff whose access is role-based and logged. Where a breach is likely to result in a risk to you, we will tell you and the relevant authority within the time the law sets.

For personal data inside your documents, we act as your processor. We process it only to provide the platform and produce the assessment you requested, we apply the security measures in section 11, we use the sub-processors listed in section 6 under equivalent obligations, we help you respond to requests from the people concerned, we delete or return the data on the schedule in section 8, and we make information available to demonstrate compliance. If you need a separate signed data processing agreement, ask us.

The platform is for adults and organisations. We do not knowingly collect data from anyone under 18.

The platform uses only strictly necessary storage: your sign-in session and your interface preferences, kept in your browser, and the bot-protection check on sign-in. The Cookie Policy sets out the detail and what would change if analytics were ever added.

We will publish a new version here when the notice changes, with its date. Where a change materially affects you, we will tell you on the platform or by email.

Controller: LexQuity Ltd, company number 17288154, Flat 205, 5 Barking Wharf Square, Barking, England, IG11 7HZ, info@jusfund.tech. Data protection contact: info@jusfund.tech. Representative in the European Union under Article 27 GDPR: none appointed at present. LexQuity will appoint one when its processing of data about people in the European Union reaches the point at which the Regulation requires it, and will update this notice when it does. Until then, people in the European Union may write to info@jusfund.tech.