Last updated: 27 March 2026
Serverity is operated by Serverity Ltd (company details to be inserted after incorporation). We are the data controller for personal data processed through the Serverity platform.
Serverity is a legal workflow platform for self-represented litigants (litigants in person) in England and Wales. We provide document management, AI-assisted drafting, legal source retrieval, and structured case management tools.
We process your data for the following purposes, each with a lawful basis under UK GDPR:
| Purpose | Lawful Basis |
|---|---|
| Providing the Serverity platform and features | Contract (Art. 6(1)(b)) |
| Processing documents through AI for analysis and drafting | Contract (Art. 6(1)(b)) |
| Billing and subscription management | Contract (Art. 6(1)(b)) |
| Security monitoring and fraud prevention | Legitimate interest (Art. 6(1)(f)) |
| Platform improvement and error resolution | Legitimate interest (Art. 6(1)(f)) |
| Service communications (account, security, changes) | Contract (Art. 6(1)(b)) |
| Marketing communications (only with consent) | Consent (Art. 6(1)(a)) |
| Legal compliance and regulatory obligations | Legal obligation (Art. 6(1)(c)) |
Special category data: Legal case documents may contain special category data (health information, racial/ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation). We process this data under Art. 9(2)(f) — processing necessary for the establishment, exercise, or defence of legal claims. You control what documents you upload.
Serverity uses two AI providers to process your data:
Important: Neither AI provider retains your data after processing. Inputs and outputs are not used for model training. Serverity uses the API (not consumer) tiers of both services, which have stronger data protection commitments.
AI processing is integral to the Serverity service. If you do not wish your documents to be processed by AI, you should not use Serverity.
We share your data only with the following categories of processor, all under appropriate data processing agreements:
| Processor | Purpose | Location |
|---|---|---|
| Anthropic | AI document processing and analysis | United States |
| OpenAI | AI adversarial audit review | United States |
| Vercel | Application hosting and edge functions | Global (edge network) |
| Supabase | Database and file storage | EU / United Kingdom |
| Stripe | Payment processing | United States / Ireland |
| Google (OAuth) | Authentication | United States |
We do not sell your personal data. We do not share your legal case data with any party other than the processors listed above, and only for the stated purposes.
Serverity retrieves and displays legal source material (legislation, case law, procedural rules, practice directions) from publicly available sources including:
This data is Crown Copyright and/or made available under open licences. Serverity does not claim ownership of legal source material. Currency monitoring may have delays — always verify critical legal sources independently.
| Data Type | Retention Period |
|---|---|
| Account information | Until account deletion + 30 days |
| Legal case data and documents | Until account deletion + 30 days |
| AI processing logs | 90 days (rolling) |
| Usage analytics | 24 months (aggregated after 12 months) |
| Billing records | 7 years (legal requirement) |
| Encrypted backups | 90 days after data deletion |
| Cookie consent preferences | 12 months |
You can request early deletion at any time. Account deletion removes all personal and case data within 30 days, except where retention is required by law (e.g., billing records).
Under the UK General Data Protection Regulation, you have the following rights:
To exercise any right, email privacy@serverity.ai. We will respond within one month. You can also use the data export and account deletion features within Serverity directly.
If we become aware of a data breach that poses a risk to your rights and freedoms, we will notify you and the ICO within 72 hours as required by UK GDPR.
Serverity uses the following cookies:
You can change your cookie preferences at any time via the cookie settings in your account, or by clearing your browser cookies. See our cookie consent banner for controls on first visit.
Some of our processors (Anthropic, OpenAI, Stripe, Google) are based in the United States. These transfers are protected by:
We ensure all international transfers have appropriate safeguards as required by UK GDPR Chapter V.
Serverity is not intended for use by anyone under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact privacy@serverity.ai and we will delete it promptly.
We may update this Privacy Policy from time to time. Material changes will be notified via email and in-app notification at least 14 days before taking effect. The "last updated" date at the top of this page indicates the most recent revision.
If you are unhappy with how we handle your data, please contact us first at privacy@serverity.ai. We will do our best to resolve your concern.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO):