Privacy Policy

Last updated: 26 October 2026

This policy explains how PHD Interactive Ltd ("we", "us", "PolicyDiary") collects, uses and protects your personal data when you use policydiary.co.uk.

Data controller: PHD Interactive Ltd, Monomark House, 27 Old Gloucester Street, London, WC1N 3AX
ICO registration number: Z1046419
Contact: hello@policydiary.co.uk

1. What data we collect

Account data: Your name, email address, practice name, website URL, professional body, ICO registration number.

Intake answers: Your responses to our onboarding questions about your practice.

Website scan data: Technical information about third-party tools detected on your website.

Payment data: Payment is processed by Stripe. We do not store your card details. We retain records of transactions for accounting purposes.

Usage data: Standard server logs including IP addresses, browser type, and pages visited.

Complaints data: If you submit a data protection complaint about our service, we retain the complaint and our response.

Clinical Will data (if you use Clinical Wills): whether you have bought a Clinical Will; its status, review dates and certificate number; your executor’s email address and their responses (pack sent, confirmed, can’t act, asked for their key), and when and from which IP address a key was used; your emergency-key choice and the words you typed to confirm it; your waiting period; how far you have got in the will builder (the furthest step reached) and when you saved your keys. Your will and client list are encrypted in your browser and we cannot read them; for that information we act as your processor on your behalf.

Notifications: if you turn on notifications, the subscription details your browser gives us so we can send them.

Support messages: when you email us, your message and our reply.

Executors: if a practitioner names you as their clinical executor, see our notice for clinical executors.

Reciprocal executor directory (if you list yourself on our directory page; no account needed): your name, your professional body if you choose one, your town or area, and your email address. Your name, professional body and town or area are shown on the public page; your email address is never shown. We use it to send you the PIN that confirms your listing or its removal, and the messages people send you through the page. If you send someone a message through the directory, we email your name, email address and message to them so they can reply to you. We don’t store your message; our email provider (Resend) keeps a copy of sent emails, including PIN emails, for a limited time.

2. How we use your data

Article 6 lawful basis: Article 6(1)(b) UK GDPR — contract. Processing is necessary to provide the PolicyDiary service you have subscribed to.

We use your data to: generate your compliance documents, host your compliance page, send you service emails (login codes, renewal reminders, complaint notifications), and improve the PolicyDiary service.

If you use Clinical Wills we also use your data to run that service: reminders about your yearly review, your client list and your executor, your public certificate, and the executor pack and notices we send to your executor on your behalf (Article 6(1)(b), contract).

We answer support emails, sometimes with the help of an AI drafting assistant (Article 6(1)(f), legitimate interests in answering you quickly and well).

If you list yourself in the reciprocal executor directory, we show your listing and pass messages on to you because you asked us to (Article 6(1)(a), consent). You can withdraw at any time by removing your listing. Messages sent through the directory are passed on at the sender’s request (Article 6(1)(f), legitimate interests in putting practitioners in touch).

Analytics and advertising cookies on policydiary.co.uk are used only with your consent (Article 6(1)(a)); see the Cookies section below.

We do not sell your data to third parties, and we never use your clients’ information, your documents or your clinical will for advertising.

3. AI document generation

Your practice details and intake answers are sent to Anthropic's Claude API to generate your compliance documents. Anthropic processes this data as a data processor on our behalf. Anthropic's servers are located in the USA. We rely on Standard Contractual Clauses (SCCs) as the transfer safeguard. For more information see Anthropic's privacy policy.

Our team may also use Anthropic to help draft replies to support emails. Anything in your message that looks like a Clinical Will key is removed before it is sent. Your clinical will and client list are never sent to Anthropic; we cannot read them.

4. Third-party processors

We use the following third-party services to operate PolicyDiary:

• Stripe (USA) — payment processing
• Resend (USA) — transactional email delivery
• Anthropic (USA) — AI document generation
• Cloudflare (USA) — DNS, CDN, and Turnstile spam protection
• DigitalOcean (London, UK) — cloud hosting. Clinical wills and client lists are stored here in encrypted form only.
• Web push services (Apple, Google, Mozilla) — only if you turn on notifications; they deliver short notifications to your devices, which never include your will or client details
• Google, Reddit, Meta (USA) — analytics and advertising on policydiary.co.uk, only if you accept cookies (see Cookies below)

Where data is transferred to the USA, we rely on Standard Contractual Clauses (SCCs) or International Data Transfer Agreements (IDTAs). The USA does not currently have a UK adequacy decision.

4a. Analytics and advertising

With your consent only, we use Google Analytics (Google LLC, USA) to understand how visitors use policydiary.co.uk, and the Reddit pixel (Reddit, Inc., USA) and Meta pixel (Meta Platforms, USA/Ireland) to measure and improve our advertising. They collect information such as the pages you visit, how you arrived and your browser type, and may link visits to your accounts with those companies. None of them load until you click Accept in our cookie banner. Transfers to the USA rely on the safeguards described in section 4. Details and how to change your choice are in the Cookies section below.

5. How long we keep your data

• Account data: for the duration of your subscription plus 6 years (accounting/legal requirements)
• Generated documents: for the duration of your subscription
• Financial records: 6 years (HMRC requirement)
• Server logs: 90 days
• Data protection complaints: 6 years
• Clinical will, client list and executor details: 6 years after your Clinical Will subscription ends, then deleted (sooner if you choose Start again or ask us)
• Notification subscriptions: until you turn notifications off or your browser stops accepting them
• Reciprocal executor directory: a listing comes off the page when you remove it or after 90 days, and is deleted within a day of that at the latest; a PIN works for 10 minutes, and it and any listing waiting for it are deleted within a day at the latest; messages sent through the directory are not stored by us (our email provider keeps a copy of sent emails for a limited time)
• Support emails: as long as needed to resolve your request; we do not keep AI drafts
• Your cookie choice: 12 months, then we ask again

6. Your rights

Under UK GDPR you have the right to: access your data, correct inaccuracies, request erasure (subject to legal retention requirements), restrict or object to processing, and data portability.

To exercise any right, contact us at hello@policydiary.co.uk. We will conduct a reasonable and proportionate search in response to subject access requests, in accordance with the Data (Use and Access) Act 2025.

7. Data protection complaints

Under the Data (Use and Access) Act 2025, you have the right to complain directly to us about how we handle your data. Contact us at hello@policydiary.co.uk. We will acknowledge your complaint within 30 days.

You may also complain to the Information Commission (ICO): ico.org.uk/make-a-complaint / 0303 123 1113 / ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.

8. Cookies

Always on (strictly necessary):

• Login session — keeps you signed in to your dashboard (up to 30 days).
• pd_consent_v2 — remembers whether you accepted or declined optional cookies (12 months).
• Clinical Wills, stored in your browser only: a key that keeps your will unlocked on that device, your text-size choice, and whether you have dismissed the ‘What happens now’ box. These never leave your device. The key is removed when you choose Forget this device or clear this site’s data in your browser, and stops working if you choose Sign out all other devices on another device; Safari may also remove it after about 7 days without a visit. Your will is not affected: enter your Recovery Key to unlock it again. Before you have saved your keys (at the end of your will), this key is the only way into your draft, so if it is removed the draft cannot be opened and you would start again.

Only if you click Accept:

• Google Analytics (_ga and similar) — how visitors use the site (up to 2 years).
• Reddit pixel (_rdt_uuid) — measuring our Reddit advertising (up to 90 days).
• Meta pixel (_fbp) — measuring our Facebook and Instagram advertising (up to 90 days).

If you decline, or make no choice, none of the optional cookies or scripts are loaded. To change your choice, clear the cookies for policydiary.co.uk in your browser and the banner will ask again; you can also opt out of Google Analytics at tools.google.com/dlpage/gaoptout.