Privacy Policy

Copacetic Technologies Ltd is a company registered in England and Wales (No. 14820019), with its registered office at 12 Lincoln's Inn Fields, London WC2A 3BP. Our Data Protection Officer can be reached at privacy@copacetic.co.

Account data: your name, email address, job title, firm details and password (stored only in hashed form via our authentication provider).

Billing data: billing name, address and payment-card details (processed by our payment provider; we do not store full card numbers).

Usage and technical data: IP address, device and browser type, log data, and information about how you use the Service, collected via cookies and similar technologies.

Customer Data: data you upload to operate your matters, which may include personal data about your clients and third parties. We process this only on your instructions as a processor.

To provide the Service and perform our contract with you (Article 6(1)(b)): creating your account, delivering features, processing payments and providing support.

For our legitimate interests (Article 6(1)(f)): securing and improving the Service, preventing fraud and abuse, and communicating about service changes — balanced against your rights.

With your consent (Article 6(1)(a)): optional analytics cookies and marketing emails, which you may withdraw at any time.

To comply with legal obligations (Article 6(1)(c)): tax, accounting and responding to lawful requests.

Where Customer Data includes special category data (for example, data revealing health or criminal-offence information within a matter), you are responsible for ensuring an appropriate lawful basis and condition under Articles 9 and 10. We process such data solely to provide the Service and under appropriate safeguards.

We share personal data only with sub-processors who help us deliver the Service, under written contracts requiring equivalent protection. Our key sub-processors include our cloud hosting provider (UK region), Auth0 (authentication) and our payment processor.

We may disclose data where required by law, to enforce our Terms, or to protect the rights, safety or property of Copacetic, our users or others. We do not sell personal data, and we do not use Customer Data to train third-party AI models.

Your data is hosted in the United Kingdom. Where any processing involves a transfer outside the UK, we rely on adequacy regulations or the International Data Transfer Agreement (or UK Addendum to the EU Standard Contractual Clauses) together with appropriate supplementary measures.

We retain account and billing data for as long as your account is active and for up to 7 years thereafter to meet legal and accounting requirements. Customer Data is retained for the life of your account and deleted within 30 days of account closure, unless you delete it sooner or law requires otherwise.

We apply encryption in transit (TLS 1.2+) and at rest (AES-256), role-based access controls, audit logging, least-privilege access for staff, and regular security reviews. Authentication is provided by Auth0 with support for two-factor authentication.

Under the UK GDPR you have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent. Where we process Customer Data as a processor, requests from data subjects should be directed to the relevant customer (the controller).

To exercise your rights, email privacy@copacetic.co. We will respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

We use strictly necessary cookies to operate the Service and, with your consent, optional analytics cookies. See our Cookie Policy for details and to manage your preferences.

We may update this policy from time to time. Material changes will be notified by email or in-product notice. The "last updated" date above shows when this version took effect.