CrimeLine — Privacy Notice

CrimeLine Training Limited · Version 1.7 · 16 October 2026 · Owner: Data Protection Lead · Review: annually and on material change

This notice explains how CrimeLine collects and uses personal data, and the rights you have. It is written to be read by the people whose data we handle — our members and the individuals who use them, visitors to our website, and anyone who contacts us. It is deliberately plain and complete; a fuller technical account of our data flows and the suppliers we use is maintained separately in our DPIA Data Map, which we make available to customers carrying out due diligence.

1. Who we are

CrimeLine is the subscription legal reference service for criminal-law practitioners in England and Wales, operated by CrimeLine Training Limited (registered office: 41 Bridgeman Terrace, Wigan WN1 1TT; registered in England and Wales). We are registered with the Information Commission under registration number Z2096592. For anything in this notice, or to exercise any of your rights, contact our Data Protection Lead at [email protected]. We have assessed our activities under Article 37 UK GDPR and are not required to appoint a statutory Data Protection Officer; the Data Protection Lead named here is nonetheless our single point of accountability for data protection.

2. What this notice covers — and the important difference between your account data and the content you submit

For most of the personal data we handle — your account and membership details, how you use the service, security, support and marketing — CrimeLine is the controller, and this notice explains what we do and why. There is one important exception. When you use our AI tools (CrimeLine Ask and DocAssist) through a firm’s subscription, the documents and questions you submit to those tools (which we call “Submitted Content”) are handled on your firm’s behalf: your firm is the controller of that content and CrimeLine acts as its processor under a written contract. How that content is handled is summarised in section 5 below and governed by our subscriber terms and our standalone Data Processing Agreement, not primarily by this notice. This notice tells you how CrimeLine handles personal data for which CrimeLine itself is the controller.

3. The personal data we collect, why we use it, and our lawful basis

We collect only what we need to run the service. The table below sets out the personal data we hold as controller, why, and the lawful basis under Article 6 UK GDPR.

4. Where your data comes from

Almost all of the personal data we hold comes directly from you — when you register, use the service, contact support, or sign up for updates. Some technical data (such as IP address and device information) is generated automatically when you use the site, and some billing information comes from our payment processor. We do not buy personal data or build profiles of you from third-party sources.

5. Content you submit to our AI tools

When you use CrimeLine Ask or DocAssist, the documents and questions you submit are treated as highly sensitive and are handled under a strict rule: they are processed only for the moment needed to produce your answer and are not added to any search index, log or training process, and DocAssist does not ask the AI service to cache them. The AI processing is carried out for us by Amazon Web Services in London, United Kingdom, using Anthropic’s Claude models run by AWS. Your questions, documents and answers travel directly between your browser and AWS in London, where our UK-hosted website collects them to prepare your answer. While your answer is being prepared, temporary copies are held in an encrypted CrimeLine store in London. Your browser deletes the copy of your request and answer as soon as it has collected the answer, and DocAssist documents are deleted as soon as the analysis finishes. Any other copy (for example, the prepared request for our longer-running tools, or anything left behind if you close your browser) is removed by a clean-up that runs every 10 minutes and deletes anything more than 30 minutes old, with an automatic one-day deletion rule as the final backstop. The store is used for no other purpose and no one at CrimeLine reads it. CrimeLine Ask no longer accepts uploaded documents (please use DocAssist to work with a document), so no document you submit is stored on our website, and question text is not otherwise retained after your answer is produced. AWS processes your content under a “zero data retention” setting: it is not kept by AWS once your answer is returned, is never used to train any model, and is not shared with the model provider. A correction. From 17 September 2026, DocAssist asked the AI service to keep a temporary working copy of the documents it was analysing (a “prompt cache”), so that a follow-up question on the same documents cost less. AWS kept that copy within the AI service for up to five minutes after it was last used and, from 12 October 2026, for up to an hour. It was held in Ireland until 10 October 2026 and in London after that, it was not used to train any model, it was not shared with the model provider, and CrimeLine could not read it. Earlier versions of this notice said that AWS kept nothing once your answer was returned; for DocAssist documents during that period, that was not accurate. DocAssist stopped asking for the prompt cache on 16 October 2026 (version 3.30.2), and CrimeLine Ask asks the AI service to cache only its own instructions, never anything you submit. AWS’s logging of requests and answers is switched off, and we check both settings automatically every day. If no London model is available to handle a request, the request is refused; it is never sent to another region or provider. Two narrow opt-in features (feedback and watched questions) are the only exceptions in which any element of what you type is retained, and only with your express consent, as described in section 3. Watched-question alert emails say only that there is new material, with a link: the question and the material found are shown only on CrimeLine after you sign in. Because this content belongs to your firm’s matters, your firm is its controller and we process it on your firm’s behalf; the full terms are in our subscriber agreement and Data Processing Agreement. Three DocAssist tools (Exhibits and Legislation & authorities, under Extract, and the comparison of two versions of one document) work in your browser without AI. Legislation & authorities then checks the case citations it finds automatically, using CrimeLine’s citation checker on our London server (our website also looks them up in CrimeLine’s library): it sends each citation with its paragraph numbers, and nothing else from your documents (the case name written beside a citation stays in your browser, where it is compared with the name the register gives). Those citations are part of the content you submit through DocAssist, so, under a firm’s subscription, they are handled on your firm’s behalf in the same way.

Our citation checker and extradition case-law search use no AI. They run on a CrimeLine server in the AWS London region, and for these tools CrimeLine is the controller. When you check a document with the citation checker, your browser reads it and it is never uploaded: only the citations go to our server, each with the case name, the paragraph numbers and any quotation you ask us to check. Our server checks them against Find Case Law and legislation.gov.uk (both run by The National Archives) and keeps nothing once the check is done, and our website looks the same citations up in CrimeLine’s library. The extradition case-law search sends the words you type, with your other choices, to public case-law databases in other countries (see section 9). Please search with legal terms, and do not type a person’s name or other personal data into it. Your recent searches, and any digest you download, are held on our server until the search service restarts, which it does every night.

Our hidden text check runs entirely in your browser. The document you check is not uploaded, nothing about it is sent to CrimeLine or anyone else, and no AI is used. CrimeLine does not receive or keep anything from it.

6. Special category and criminal-offence data

Given the nature of criminal-law practice, the content you submit to our AI tools or to support may include criminal-offence information and special-category data, and may be legally privileged. We handle it under the strict controls described above and in our Information Security Policy, and we never use it for any purpose other than providing the service you have asked for. The court transcripts in our library are public court documents; the personal data we create around your use of them is only the access record described in section 3.

7. Cookies

We use cookies and similar technologies that are strictly necessary to run the website and keep it secure — for example, to sign you in, keep you signed in, remember your session, and support two-factor authentication. These are always on because the service cannot work without them. The extradition case-law search sets its own sign-in cookie, which lasts 12 hours. Where we use any non-essential cookies (for example, to measure how the site is used), we set them only with your consent, which you can give or withdraw through our cookie controls. You can also manage cookies in your browser settings.

8. Who we share your data with

We do not sell your personal data and we do not share it for anyone else’s marketing. We use a small, carefully chosen set of service providers who process personal data on our behalf under written contracts (Article 28 UK GDPR), each permitted to use it only to provide their service to us:

• WP Engine — our website and application hosting (United Kingdom), including the membership system, the transcript library and short-lived processing stores.

• Amazon Web Services (AWS) — the AI processing behind CrimeLine Ask, DocAssist and our search (model inference and search embeddings), our secure relay, the stamping of transcript downloads, and the encrypted store that holds temporary copies of your questions, documents and answers, all in the United Kingdom (AWS London region). Answers are produced by Anthropic’s Claude models, run by AWS in London; Anthropic, as their developer, receives no content from us and is not one of our service providers. Search embeddings are produced by an Amazon model in London. We no longer use Cohere, and search reranking has been switched off. AWS also hosts the CrimeLine server in London that runs our citation checker and extradition case-law search (neither uses AI).

• Cloudflare — our global edge network and web application firewall (traffic protection and delivery); it carries website traffic in transit (such as page loads, and the reference our website uses to collect an AI request from London) and does not store your content. The questions, documents and answers you exchange with our AI tools do not pass through Cloudflare: they travel directly between your browser and AWS in London.

• Stripe — payment processing (your card details are provided directly to Stripe and are not stored by us).

• Xero — our accounting system, for invoices and billing records.

• Google Workspace — our email and business productivity systems.

• Amazon Web Services (AWS): Amazon Simple Email Service — delivers the emails we send you (the CrimeLine Alert, renewal reminders, account and service emails, and watched-question and watched-provision alerts) from the AWS London region in the United Kingdom, for which it receives your name, your email address and the email itself. Watched-question alerts say only that there is new material for a question you are watching, with a link (the question and the material found are shown only on CrimeLine after you sign in). We stopped using Mailchimp and Mailchimp Transactional (services of Intuit in the United States) for our emails on 16 October 2026 and have closed our Mailchimp account.

Our citation checker and extradition case-law search also send searches to public services that are not our service providers: The National Archives (Find Case Law and legislation.gov.uk, in the UK) for the citation checker, and public case-law databases in other countries for the extradition search. The searches come from our server, so these services receive nothing that identifies you.

We may also disclose personal data where we are required to by law, by a court order, or to establish, exercise or defend legal claims. A full, current list of these providers — with the data each receives, its location and the transfer safeguard — is maintained in our DPIA Data Map, available to customers on request.

9. Sending data outside the UK

All AI processing behind CrimeLine Ask, DocAssist and our search, and the temporary storage connected with it, takes place in the United Kingdom (AWS London region, with our website hosted by WP Engine in the UK). The questions, documents and answers you exchange with our AI tools travel directly between your browser and AWS in London. No “restricted transfer” arises for this processing.

We use service providers outside the UK only for services that do not involve AI processing, and none of them receives the questions, documents or answers you exchange with our AI tools. Our emails are sent from the United Kingdom, by Amazon Simple Email Service in the AWS London region (since 16 October 2026; before that, Mailchimp and Mailchimp Transactional, services of Intuit in the United States, sent them). Some of our other providers (for example, for payments, email and business productivity) are based in, or transfer data to, the United States or process it globally. Where personal data is transferred outside the UK to a country without UK “adequacy”, we rely on the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum, as the appropriate safeguard. You can ask us for more detail about the safeguards that apply to a particular transfer.

The extradition case-law search is the one exception for what you type. It sends your search words, with your other choices, to public case-law databases in other countries, including countries without UK “adequacy” such as the United States (one database, in Lebanon, is reached without encryption). These services receive the search from our server, with nothing that identifies you, and we have no contract with them, so no transfer safeguard applies. That is why the search should be used with legal terms only, and never with a person’s name or other personal data.

10. How long we keep your data

• Account and membership data — for the life of your membership and for about three months afterwards, then deleted.

• Billing and accounting records — for the period required by law, then destroyed.

• Login-security records — for members using our self-hosted second factor, your passkey public key and/or encrypted authenticator secret and hashed recovery/remember-device tokens are kept while you remain enrolled; a “remembered device” is trusted for up to 30 days. Login-protection and sign-in records used for security are kept on a short rolling basis.

• Support tickets — deleted when the ticket is closed.

• Content submitted to AI tools — temporary copies in our encrypted London store are deleted by your browser as soon as your answer is collected, or as soon as a DocAssist analysis finishes; any other copy is removed by a clean-up every 10 minutes once it is more than 30 minutes old, with a one-day automatic deletion as the final backstop. CrimeLine Ask no longer accepts uploaded documents, and question text is not otherwise retained after your answer is produced. Our London relay keeps a technical record of each request it handles (for example, timings, the model used and your user ID, but no question, document or answer text and no IP address) for 14 days.

• Opt-in feature data — “watched questions”, with the list of new material found for each, expire automatically after 90 days (and on your removal or account deletion); shared-feedback question text is kept only as a small rolling set with no identity; “amendment watch” references are kept until you remove them or close your account.

• Transcript access log — kept only as a rolling record of the most recent entries and then overwritten; the associated usage counters reset each hour and day.

• Citation checker and extradition search: what you send to the citation checker is not kept once the check is done; its access pass lasts 30 minutes, and our server’s record of each check (your member number, the kind of check, the result and how long it took) is kept for 14 days. The extradition search keeps recent searches, and any digest you download, until the search service restarts each night, and keeps its technical records, which never include your search words, for 14 days. Our server’s security records are kept for 90 days.

• Marketing data — until you unsubscribe or ask us to stop.

11. How we protect your data

We operate a documented set of security controls — including encryption in transit and at rest, two-factor authentication on administrative access and a self-hosted member second factor (passkeys / authenticator-app codes), least-privilege access, endpoint protection, independent penetration testing and a defined incident-response and breach-notification process. These are described in our Information Security Policy, which we make available to customers on request.

12. Your rights

Under UK data protection law you have the right, in the circumstances the law provides, to: access the personal data we hold about you; have inaccurate data corrected; have your data erased; restrict or object to our processing; obtain your data in a portable form (data portability); and, where we rely on your consent, withdraw that consent at any time (which does not affect processing already carried out). Where CrimeLine acts as processor for content submitted through your firm, a request about that content should usually be directed to your firm as controller, and we will support your firm in responding. To exercise any right, or if you have any question, contact [email protected]. We will respond within the statutory time limit (usually one month). We do not charge a fee for a valid request unless the law allows it.

13. Marketing choices

You can opt out of our marketing at any time — use the unsubscribe link in any marketing email, or email us. Opting out of marketing does not stop essential service messages (for example, about your account, security or a change to the service), which we need to send you to provide the service.

14. Automated decision-making

We do not make decisions about you by solely automated means that produce legal or similarly significant effects (Article 22 UK GDPR). Our AI tools produce research assistance for you to review and use in your own professional judgement; they do not make decisions about individuals.

15. Changes to this notice

We keep this notice under review and update it when our processing changes. Each version carries a version number and date at the top; this is version 1.7. Recent changes: version 1.3, dated 10 October 2026 (updated to reflect the move of the AI processing behind CrimeLine Ask, DocAssist and our search, and of the stamping of transcript downloads, from AWS in the European Economic Area (Ireland and Frankfurt) to AWS in London; the encrypted London store and relay through which content submitted to our AI tools now travels; the end of our use of Cohere and of search reranking; watched-question alert emails that no longer contain the question you are watching; and an updated account of the providers we use outside the UK, none of which is used for AI processing); version 1.4, dated 10 October 2026 (updated to say that we keep only anonymous counts of searches, and not the text of what you searched for, including for searches that return nothing, and that a remembered device is trusted for up to 30 days); version 1.5, dated 15 October 2026 (updated to describe our citation checker and extradition case-law search, which use no AI and run on a CrimeLine server in London: what they receive, the searches they send to The National Archives and to case-law databases in other countries, and how long their records are kept, and our hidden text check, which runs only in your browser); version 1.6, dated 16 October 2026 (corrected to say that from 17 September 2026 until 16 October 2026 DocAssist asked the AI service to keep a temporary copy of the documents, for up to five minutes, and from 12 October 2026 up to an hour, after their last use; and describing the DocAssist tools that work in your browser without AI and DocAssist’s automatic citation checks); version 1.7, dated 16 October 2026 (updated to say that our emails are now sent by Amazon’s email service in London, and that we no longer use Mailchimp or Mailchimp Transactional). Where a change is significant we will bring it to your attention. Earlier versions are available on request.

16. How to complain

If you have a concern about how we handle your personal data, please contact us first at [email protected] so we can try to put it right. You also have the right to complain to the Information Commission, the UK’s data protection regulator: Information Commission, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; helpline 0303 123 1113; ico.org.uk.