1. Who we are and what this policy covers
Phaselab, Inc., ("Phaselaw", "we", "us"), provides the Phaselaw software that helps organisations respond to regulated disclosure obligations.
This policy explains how we handle personal data in two different roles.
Where we are the controller. This policy covers personal data about:
- visitors to our website, phase.law;
- people who contact us, book a demo, attend our events or receive our communications;
- users of our platform, such as the name, email and login details of people who hold an account; and
- contacts at our customers, prospects, partners and suppliers.
Where we are the processor. When a customer uses Phaselaw to handle a request, it uploads documents that may contain personal data about requesters, employees and other people. We process that content only on the customer's documented instructions, under a data processing agreement. The customer is the controller of that data and decides how it is used. If your personal data is in material a Phaselaw customer is processing, for example because you made a subject access request to that organisation, please contact that organisation to exercise your rights. If you contact us instead, we will pass your request to the relevant customer where we can identify them.
2. Personal data we collect
We do not ask for special category data (for example health information) about our contacts or users. Customer content uploaded to the platform may contain any kind of personal data; we handle it as a processor under section 1.
3. How we use personal data and our lawful bases
Under UK and EU data protection law we must have a lawful basis for each use. We rely on the following.
Where we rely on legitimate interests, we have weighed them against your rights and expectations. You can ask us for details of that assessment.
We do not sell personal data. If you accept marketing cookies, we use Google Ads and LinkedIn tags to measure our advertising, relying on your consent. Some US state laws treat this as "sharing" for targeted advertising; you can withdraw consent at any time through Cookie Preferences.
4. AI and automated processing
Phaselaw uses AI models to help customers find, classify and redact information in documents. These models run on Amazon Web Services' Bedrock service within our own AWS environment in the same AWS region where the customer's account is hosted.
- No training on customer data. We do not use customer content, or personal data within it, to train, fine-tune or otherwise improve AI models, or for any other product development. Our model providers do not use it either.
- Human review. Phaselaw suggests redactions and classifications. The customer's own staff review the output and decide what is disclosed. We do not make decisions based solely on automated processing that produce legal or similarly significant effects on anyone.
- Usage data. We may use usage and performance data, such as feature use and error rates, to improve the platform. This data does not include the content of customer documents.
5. Who we share personal data with
We share personal data only with the parties below, and only as far as they need it.
- Service providers. These act on our instructions under written contracts. They include cloud hosting and AI inference (Amazon Web Services), authentication (Auth0), analytics (PostHog), CRM and marketing (HubSpot) and payments (Stripe). Our current list of sub-processors for customer data is on our Trust Center.
- Advertising platforms. If you accept marketing cookies, Google and LinkedIn receive information about your visit, such as pages viewed and demo requests, to measure our campaigns. They handle it under their own privacy policies.
- Your organisation. If your account is provided by your employer, your organisation's administrators can see your account details and activity.
- Professional advisers. Lawyers, accountants and auditors, under a duty of confidentiality.
- Authorities. Regulators, courts or law enforcement, where the law requires it or to protect our rights or others' safety.
- Buyers or investors. A party involved in a merger, acquisition or financing, under confidentiality obligations.
We may share aggregated or de-identified information that cannot reasonably identify anyone.
6. Where data is stored and international transfers
Each customer chooses where its account is hosted: the United Kingdom, the European Union or the United States, on Amazon Web Services. Customer content and AI processing for that account stay in the chosen region. Product analytics from the platform (PostHog) is processed in the EU for UK and EU accounts, and in the US for US accounts.
Phaselab, Inc. is based in the United States, and some of our team and service providers are outside the UK and EU. Our staff access customer content from outside its hosting region only when a customer specifically asks us to, for example to resolve a support issue. Business data that is not customer content, including website analytics (PostHog) and our CRM and marketing records (HubSpot), may be processed in the United States.
When personal data leaves the UK or the European Economic Area, we protect it with the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK Addendum, together with additional safeguards where needed. You can ask us for a copy of the relevant safeguards.
7. Cookies and similar technologies
We use cookies and similar technologies on our website and platform. Strictly necessary cookies are always on. In the UK, the EU, the EEA and the United States, analytics and marketing cookies stay off until you accept them. You can change your choice at any time through the "Cookie Preferences" link at the bottom of every page.
Until you accept, and if you decline, our website sets only the cookie that remembers your choice. HubSpot still records an anonymous page view without cookies or any identifier that persists between pages. Google receives a cookieless signal that consent was refused, which it uses only for aggregate measurement. PostHog, Google Ads and LinkedIn do not load.
You can also block or delete cookies in your browser settings, though some features may then stop working. The UK Information Commissioner's Office explains cookies at ico.org.uk.
8. Security
We protect personal data with technical and organisational measures suited to the sensitive material our customers handle. These include:
- encryption at rest (AES-256) and in transit (TLS 1.2 or higher);
- single sign-on, multi-factor authentication and role-based access controls;
- annual penetration testing by a CREST-accredited firm;
- an independent SOC 2 report and Cyber Essentials certification.
Details and reports are available on our Trust Center. No system is perfectly secure, and if a breach affects your personal data we will notify you and the regulator as the law requires.
9. How long we keep personal data
We keep personal data only as long as we need it for the purposes in section 3.
We may keep data longer where the law requires it or to resolve a dispute, and we may keep anonymised data indefinitely.
10. Your rights
To exercise any right below, email privacy@phase.law. We will respond within one month, which we may extend by up to two further months for complex requests; we will tell you if we do. We may need to verify your identity first. We do not charge a fee unless a request is manifestly unfounded or excessive, in which case we may charge a reasonable fee or decline and explain why.
UK, EU and EEA. You have the right to:
- access your personal data and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use your data;
- object to processing based on our legitimate interests, and to direct marketing at any time;
- receive data you gave us in a portable format;
- withdraw consent at any time, where we rely on it; and
- complain to a data protection regulator. In the UK this is the Information Commissioner's Office (ico.org.uk). In the EU or EEA it is the authority where you live or work (list). We would welcome the chance to address your concern first.
United States. Depending on where you live, state law may give you rights to know, access, correct and delete your personal data and to opt out of its sale or use for targeted advertising. We do not sell personal data. We will honour these requests wherever the law gives you the right, and we will not discriminate against you for making one.
Canada. You can access and correct your personal data, and withdraw consent, under PIPEDA and applicable provincial law. You can also complain to the Office of the Privacy Commissioner of Canada.
Data in customer content. If your data is in material a Phaselaw customer is processing, see section 1. The customer handles your request, and we help them.
11. Children, changes to this policy, and contact
Children. Phaselaw is a business service and is not directed at children under 16. We do not knowingly collect their personal data as a controller. If you believe we have, contact us and we will delete it.
Changes. We will update this policy when our practices change and show the new effective date at the top. For material changes we will also notify account holders by email or in the platform before the change takes effect.
Contact. Questions or requests about this policy go to:
Phaselab, Inc. (Phaselaw)
228 Park Ave S #52518, New York, NY 10003, USA
privacy@phase.law
+1 (646) 631-0601
Representatives. Individuals and data protection supervisory authorities in the EU/EEA, and individuals and the ICO in the UK, may also contact our representatives under Article 27 of the EU GDPR and UK GDPR:
- EU: DP-Dock GmbH, Attn: Phaselab, Inc., Ballindamm 39, 20095 Hamburg, Germany
- UK: DP Data Protection Services UK Ltd., Attn: Phaselab, Inc., 16 Great Queen Street, Covent Garden, London, WC2B 5AH, United Kingdom
Both can be reached at phaselab@gdpr-rep.com (dp-dock.com).