Privacy Policy
Arc and Delta Ltd (trading as Aricase) | England and Wales
Last updated: 3 November 2026
Privacy summary
This summary explains the key points of our Privacy Policy. The full policy below contains the detailed legal information.
Aricase uses your personal data to create and manage your account, provide the Aricase platform, process your case information, generate AI-assisted outputs, check the quality of those outputs, let our staff monitor case quality and safety, process payments, keep the service secure, and respond to support requests.
Because Aricase helps with employment disputes, the information you choose to provide may include sensitive information such as health or disability details, pregnancy or maternity information, trade union membership, racial or ethnic origin, religious beliefs, sexual orientation, gender reassignment, or other protected-characteristic information.
We use trusted service providers for hosting, database storage, authentication, file storage, AI processing, payments, email delivery, analytics, error monitoring, and security. Some providers may process data outside the UK.
We do not sell your personal data. We do not use your case data to train AI models, and we do not permit our AI providers to use your personal data to train their models.
You have rights over your personal data, including the right to ask for access, correction, deletion, restriction, portability, objection, and withdrawal of consent where consent is the basis for processing.
You can contact us about privacy or data rights at support@aricase.ai.
1. Introduction
This Privacy Policy explains how Arc and Delta Ltd (trading as Aricase) collects, uses, stores, and protects your personal data when you use the Aricase platform ("Platform"). We comply with the UK General Data Protection Regulation ("UK GDPR") as tailored by the Data Protection Act 2018 ("DPA 2018") and the Privacy and Electronic Communications Regulations 2003 ("PECR").
2. Data Controller
Arc and Delta Ltd (trading as Aricase)
Registered in England and Wales
Companies House number: 17240873
Registered office: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Registered with the Information Commissioner's Office (ICO)
Email: support@aricase.ai
We do not have a designated Data Protection Officer. Data protection queries should be directed to support@aricase.ai.
3. Personal Data We Collect
We collect the following categories of personal data:
Account Data
- full name
- email address
- password (stored as a hashed credential - we never see your actual password)
- account creation date and activity timestamps
Case Data
- employment details: employer name, job title, employment dates, salary
- details of your employment dispute: nature of claim, key events, dates
- documents and files you upload as evidence (e.g. letters, payslips, emails)
- text you enter into AI chat sessions
- AI-generated outputs including draft documents and case analyses
- your goals and desired outcomes relating to the dispute
Special Category Data
Because employment disputes may involve protected characteristics, the case data you provide may include special category personal data under UK GDPR Article 9, such as:
- health or disability information
- racial or ethnic origin
- religious or philosophical beliefs
- trade union membership
- pregnancy or maternity status
- sexual orientation or gender reassignment
Your case may also include information about criminal allegations or offences, for example an allegation your employer has made against you or one you make against someone else.
See section 5 for the legal basis on which we process this sensitive data.
Payment Data
- whether you have bought a Case Pass for a case, and when
- the date and amount of each payment, and any promotional code applied
- your confirmation at checkout that you want the Case Pass to start immediately, and when you gave it
- payment status for each purchase (e.g. paid, failed, refunded, disputed)
- a record of how much you have used Ari on each case, which we use to apply what is free and our fair-use policy
- payment processor customer ID and payment reference
We do not store your card number or payment method details. These are held securely by our payment processor.
Communications Data
- emails you send to support@aricase.ai
- records of support interactions
Technical Data
- IP address
- browser type and version
- device type and operating system
- pages visited and features used (collected via analytics - see section 9)
- timestamps of logins and activity
If you use Ask Ari on our website
If you ask a question in the Ask Ari chat on our public website, we process your question and our answer through our AI providers (section 10) to answer it, and your IP address to prevent abuse. The conversation is kept for 30 minutes so that follow-up questions make sense, using a cookie that is needed for the chat to work, and is then deleted. Please do not include personal details in a question; you do not need an account to use it.
Do you have to give us your data?
You need to give us your email address to create an account. Everything else is optional, but Ari can only help with what you choose to share.
4. Third-Party Personal Data
Your case may include personal data about other people, such as your employer, managers, colleagues or witnesses. We process it only to help you prepare your case, relying on our legitimate interests in helping people establish, exercise or defend legal claims (UK GDPR Article 6(1)(f)) and, for sensitive data, on the conditions in section 5. Please share only what is relevant to your dispute.
We do not contact the people named in a case, because doing so would involve disproportionate effort and could seriously impair the purpose of the processing (Article 14(5)(b) UK GDPR). We publish this notice instead. If you believe we hold data about you in someone else's case, you can contact us at support@aricase.ai.
5. Special Category Data - Legal Basis
Where your case includes special category personal data, we process it under Article 9(2)(f) UK GDPR: processing necessary for the establishment, exercise or defence of legal claims. This covers building your case, producing AI-assisted outputs for it, and checking the quality and safety of those outputs.
Where your case includes information about criminal allegations or offences, we process it under paragraph 33 of Schedule 1 to the Data Protection Act 2018 (legal claims).
6. How and Why We Use Your Personal Data
The table below sets out the main purposes for which we process your personal data and the legal basis under UK GDPR Article 6 that we rely upon.
| Purpose | Legal Basis (UK GDPR Art. 6) |
|---|---|
| Creating and managing your account | Art. 6(1)(b) - performance of a contract |
| Providing the Platform and its features | Art. 6(1)(b) - performance of a contract |
| Processing one-off Case Pass payments | Art. 6(1)(b) - performance of a contract |
| Sending transactional emails (receipts, account alerts) | Art. 6(1)(b) - performance of a contract |
| Processing your case data through AI to generate outputs | Art. 6(1)(b) - performance of a contract |
| Internal monitoring of case quality and safety by our staff | Art. 6(1)(f) - legitimate interests (keeping the Platform accurate and safe) |
| Automatically grading the quality of AI-generated outputs, using AI models from providers other than the one that produced them | Art. 6(1)(f) - legitimate interests (checking the accuracy and safety of outputs) |
| Making sure the free start is used once per email address | Art. 6(1)(f) - legitimate interests (preventing abuse of the free service) |
| Answering questions in the Ask Ari chat on our website | Art. 6(1)(f) - legitimate interests (answering visitors' questions about employment law and our service) |
| Maintaining fraud prevention, security, and abuse protection | Art. 6(1)(f) - legitimate interests (protection of our services and users) |
| Improving the Platform and fixing bugs (using anonymised or aggregated data) | Art. 6(1)(f) - legitimate interests (improving our service) |
| Recording a small number of account events, such as signing up or buying a Case Pass (section 9) | Art. 6(1)(f) - legitimate interests (understanding how the service is used) |
| Responding to support queries | Art. 6(1)(f) - legitimate interests; Art. 6(1)(b) where query relates to the contract |
| Complying with legal obligations (e.g. tax, accounting records) | Art. 6(1)(c) - legal obligation |
| Defending or pursuing legal claims | Art. 6(1)(f) - legitimate interests |
7. AI Processing
The Platform transmits your case data to third-party AI service providers to generate responses, document drafts, case analyses, and other outputs. These AI model providers, and the routing service that reaches them, are described in section 10. They may change from time to time; you can ask us for the current list at any time by emailing support@aricase.ai.
We do not permit our AI providers to use your personal data to train their models. AI-generated outputs are informational and may contain errors - see our Terms & Conditions section 4.
8. Automated Decision-Making
AI-generated outputs (case analyses, assessments, document drafts) are informational guidance only, not decisions about you. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing of your special category data.
Two things happen automatically:
- if use of a case goes well beyond fair use, Ari pauses new work on it (Terms & Conditions section 10); and
- the free start is offered once per email address.
In either case you can email support@aricase.ai, explain your situation and ask for a person to look at the decision, and we will review it. You can also challenge the decision.
9. Cookies and Analytics
Strictly Necessary Cookies
Session authentication cookies are required for the Platform to function. If you use Ask Ari on our public pages, a cookie that lasts 30 minutes keeps your conversation together. No consent is required for these.
Analytics (consent required)
We use PostHog (PostHog, Inc., EU-hosted) for usage analytics - for example, which pages are visited and where users encounter difficulties. On our public pages, PostHog also makes masked session recordings: all text and anything you type is hidden, and nothing is recorded inside your account. When you are signed in, analytics events are linked to your account ID. PostHog does not store cookies or identifiers on your device. Data is processed in the European Union.
On our public pages we also use Google Analytics (Google LLC; data may be processed in the USA) to measure visits and how people use the site. Google Analytics sets cookies on your device (_ga and _ga_<ID>, kept for up to 2 years). We have switched off Google's advertising features, signals and personalisation, and it never runs inside your account.
We will only use PostHog and Google Analytics if you have given your consent via the cookie banner. You can withdraw your consent at any time by clicking "Cookie preferences" in the footer and selecting Decline. Withdrawing consent stops all further analytics capture in your browser immediately and removes the Google Analytics cookies.
Account events (no consent required)
Separately from the browser analytics above, our servers record a small number of account events in PostHog - for example, that you signed up, how you told us you heard about us, the domain of your email address, and that you were offered or bought a Case Pass. These are linked to your account ID and never include your case content. They do not use cookies or read anything from your device, so your cookie choice does not affect them. We rely on our legitimate interests in understanding how the service is used (UK GDPR Article 6(1)(f)). You can object at any time by emailing support@aricase.ai.
Website statistics (on unless you decline)
On our public pages (not inside your account) we count visits with three cookieless tools: Ahrefs Web Analytics (Ahrefs Pte. Ltd., Singapore), Vercel Analytics and Vercel Speed Insights (Vercel Inc., USA). They tell us which pages people visit, where they arrive from, how quickly pages load and how often the sign-up buttons are clicked and the sign-up page is opened. When a page loads, your browser sends them the page address, the referring website and technical details such as your browser and device type and your IP address, from which an approximate country is derived. They do not set cookies, and we do not use them to identify you. We rely on our legitimate interests in understanding how our public information is used and keeping the site working well (UK GDPR Article 6(1)(f)). You can turn them off at any time: click "Cookie preferences" in the footer and select Decline.
No advertising cookies or retargeting pixels are used, and we do not use Meta Pixel or Google's advertising features.
10. How We Share Your Personal Data
We share your personal data only with the categories of service provider below, who help us run the Platform. We do not sell your personal data. We can send you a list of the current providers on request.
| Category | Purpose | Location |
|---|---|---|
| Hosting and database | Hosting the Platform, and storing your account, case data and files | UK, EU and USA |
| AI model providers | Generating case guidance, analysis and documents from your case information, grading the quality of those outputs, and reading text from image-format evidence uploads | USA |
| AI routing service | Passing AI requests, including your case data, to the AI model providers | USA |
| Payment processor | Processing Case Pass payments | USA and EU |
| Email delivery | Sending account emails, receipts and alerts | USA |
| Analytics and website statistics | The tools described in section 9 | EU, USA and Singapore |
| Security and infrastructure | Bot and abuse protection, rate limiting, background jobs, and short-term storage of Ask Ari conversations (deleted after 30 minutes) | USA and EU |
| Error and service monitoring | Monitoring errors and the reliability of AI requests, using technical data and account and case reference numbers, not your case content | USA and EU |
| Internal alert service | Alerts to our team about sign-ups, case activity and support messages | Outside the UK |
We may also disclose your personal data to:
- law enforcement or regulators where required by law or court order
- legal advisers in connection with the establishment or defence of legal claims
- a purchaser or prospective purchaser of our business, subject to appropriate confidentiality obligations
11. International Data Transfers
Some of the providers in section 10 are outside the UK. Where a recipient is in a country with UK adequacy regulations, we rely on those. Where a recipient is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on that. Otherwise we use the ICO's International Data Transfer Addendum to the EU Standard Contractual Clauses, or an International Data Transfer Agreement, as UK GDPR Chapter V requires. You can ask us for a copy of the relevant safeguards by emailing support@aricase.ai.
12. Data Retention
We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account legal obligations and legitimate operational needs.
| Data Category | Retention Period | Trigger |
|---|---|---|
| Case data, chat history, uploaded documents, and AI-generated outputs | While your account is open; deleted within one month after you ask us to close it | Your case file is not deleted for non-payment. If you do not sign in for 3 years, we will email you and delete your case data 60 days later unless you sign in. You can ask us to delete it sooner at any time. |
| Account data (name, email) | While your account is open; deleted within one month after you ask us to close it | Subject to any legal retention obligations (for example, payment records below). |
| Sign-ups whose email address was never confirmed (name, email) | The account is deleted after 24 hours; your name and email are kept in a record of unconfirmed sign-ups until you ask us to delete them | To prevent abuse of sign-up and to answer questions about an unconfirmed account. |
| A one-way code made from your email address | Kept after your account is deleted | So that the free start is given once per email address (section 8). Your email address itself is not kept in this record, and the code is never used to contact you; it is only compared when someone signs up with the same address again. |
| Payment and billing records | 7 years | From transaction date - for tax and accounting purposes |
| Support communications | 2 years | From date of communication - for audit and dispute resolution purposes |
| AI usage logs (technical, no personal content) | 180 days | For service monitoring and capacity planning |
| Error and security logs | 90 days | Rolling retention for security monitoring |
| Website and app analytics (Ahrefs Web Analytics, Vercel Analytics, PostHog, Google Analytics) | Google Analytics: 14 months. The others: each provider's standard retention period for its analytics service | To understand how the site and app are used and to fix problems, as described in section 9 |
To close your account or ask for your data to be deleted, email support@aricase.ai. Our team carries out the closure. We will delete or anonymise your personal data where there is no legal obligation requiring us to retain it, and will respond within one month. Payment records subject to tax law retention obligations cannot be deleted early.
13. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:
- encryption of personal data in transit (TLS) and at rest
- access controls and authentication requirements for our staff and systems
- database-level access controls restricting your data to your own account
- monitoring and logging of security events
- breach detection and incident response procedures
No system is completely secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay as required by UK GDPR Article 34.
14. Your Rights
Under UK GDPR and DPA 2018, you have the following rights in relation to your personal data:
- Right of access (Article 15) - to request a copy of the personal data we hold about you ("subject access request" or "SAR")
- Right to rectification (Article 16) - to request correction of inaccurate or incomplete personal data
- Right to erasure (Article 17) - to request deletion of your personal data where it is no longer necessary or where you have withdrawn consent (subject to retention obligations - see section 12)
- Right to restriction of processing (Article 18) - to request that we limit how we process your personal data in certain circumstances
- Right to data portability (Article 20) - to receive your personal data in a structured, commonly used, machine-readable format where processing is based on consent or contract and carried out by automated means
- Right to object (Article 21) - to object to processing based on our legitimate interests, including profiling
- Rights related to automated decision-making - where a decision that significantly affects you is made solely by automated means, to ask for a person to look at it, give your view and challenge it (see section 8)
- Right to withdraw consent - where processing is based on consent, to withdraw that consent at any time without affecting the lawfulness of prior processing
We will not charge a fee for exercising your rights in normal circumstances. We will respond to requests within one calendar month, or notify you of an extension (up to a further two months) where the request is complex.
15. How to Exercise Your Rights
Email support@aricase.ai with the subject line "Data Rights Request". We may ask you to verify your identity. We will respond within one calendar month.
16. How to Complain About Your Data
Step 1: Complain to us
Email support@aricase.ai with "Data complaint" in the subject line, or use our contact form. We will acknowledge your complaint within 30 days and tell you the outcome.
Step 2: The ICO
You also have the right to complain to the Information Commissioner's Office: ico.org.uk | 0303 123 1113
17. Marketing Communications
We do not send marketing emails. All communications are transactional. If we introduce marketing in future, we will seek your prior consent.
18. Children
The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact us at support@aricase.ai and we will delete it promptly.
19. Changes to This Policy
We may update this Privacy Policy from time to time. The "last updated" date at the top of this page reflects the current version.
Where changes are material, we will take reasonable steps to notify you before or when the changes take effect, for example by email, an in-app notice, or another appropriate method.
Non-material changes, such as clarifications, formatting changes, corrections, or updates required to reflect minor operational changes, may be made by updating this page.
20. Contact
Arc and Delta Ltd (trading as Aricase)
71-75 Shelton Street, Covent Garden, London, WC2H 9JQ
Email: support@aricase.ai