Skip to content
regSpace
Book a demo

Last updated: 23 June 2026

Privacy policy

This policy explains how Rated Counsel Limited, trading as regSpace ("regSpace", "we") collects and uses personal data when you visit regspace.ai, request a demo, submit a complaint or data-subject request through a complaints form we host, or use our regulatory intelligence services (the "Service").

1. Who we are

Rated Counsel Limited, trading as regSpace, is a company registered in England and Wales (company number 11812572), with its registered office at 5 Golden Mede, Waddesdon, England, HP18 0NG. regSpace is the data controller for the personal data described in this policy, except where we act as processor for a customer (for example complaints submitted through a form we host for that customer, as described in sections 2 and 3). For matters relating to your personal data, you can contact us at hello@regspace.ai. Our registration with the UK Information Commissioner’s Office is in progress, and we will publish our registration number here once it has been issued.

2. Personal data we collect

  • Account data: name, business email, employer, role, and authentication identifiers when you or a colleague signs up to the Service.
  • Submitted content: internal policies, contracts, and related documents a customer uploads to the Service for analysis. Treated as customer-confidential and isolated per tenant.
  • Complaints and data-subject request data: where you submit a complaint or a data-subject request through a complaints form we host for one of our customers, we collect your name, your email address, the text of your complaint or request, and the engagement type you select (for example access, rectification, erasure, restriction, portability, objection, or a general complaint). To stop automated abuse of the public form, we derive a one-way, keyed hash (HMAC-SHA256) of the source IP address and store that hash alone for rate-limiting; the raw IP address is discarded. On these submissions we act as processor for the customer who operates the form.
  • Usage data: pages visited, features used, and interactions with weekly digests, in aggregate and pseudonymous form.
  • Technical data: IP address, user agent, and device type, for security and abuse prevention.
  • Contact data: the information you provide when you request a demo or contact us, and any correspondence we exchange.

3. How and why we use personal data

We process personal data under the following UK GDPR / EU GDPR legal bases:

  • Performance of a contract: to provide the Service to your employer.
  • Legitimate interests: to secure, operate, and improve the Service; to contact prospective clients about regulatory intelligence services relevant to their business.
  • Consent: for optional marketing communications, where you have opted in.
  • Legal obligation: to comply with applicable laws and respond to valid legal process. This includes handling complaints and data-subject requests so that our customers can meet their own obligations under Article 77 of the UK GDPR, the Data Protection Act 2018, and section 164A of the UK Data (Use and Access) Act 2025 (complaints to a controller). On those submissions the underlying legal obligation rests with the customer who operates the complaints form, and we process the data on their behalf to support it.

4. Analytics on regspace.ai and app.regspace.ai

Both surfaces use Vercel Web Analytics and Vercel Speed Insights to understand which pages help buyers most and to monitor real-user performance (Core Web Vitals such as Largest Contentful Paint, Time to First Byte, Cumulative Layout Shift). These services do not set cookies; they derive an anonymous, hashed visitor identifier from your IP address and user-agent on each request and discard the source data immediately. No personal data is stored and no cross-site tracking is performed. Vercel Inc. acts as our processor for this data; see the sub-processor list for transfer mechanism and country of operation.

Although the legal floor under UK PECR / EU e-Privacy does not require consent for cookieless analytics of this kind, we treat analytics as optional and default it to off until you opt in via the cookie banner. Global Privacy Control and Do Not Track signals are honoured automatically. See the cookie policy for the per-category breakdown and how to change your choice.

5. AI processing, model providers, and sub-processors

The Service uses large language models to draft regulatory intelligence. By default, classification and extraction run on Google Vertex AI (Gemini), and drafting, policy redlines, and review run on Anthropic Claude (via Google Vertex AI, with the direct Anthropic API as a fallback). A customer may instead bring their own Anthropic or Google Gemini key, in which case inference for that tenant runs under the customer’s own account and provider terms; this is an optional governance accommodation and does not change the price. We send only the prompt and the retrieved text needed for each task.

We do not use customer content to train any model, and our model providers do not train their models on it. We rely on enterprise endpoints under zero-retention or no-training terms where the provider offers them.

Beyond the model providers, we rely on a small set of sub-processors and recipients to run the Service, including Google Cloud Platform (hosting, database, storage, and key management), Anthropic (Claude inference), Langfuse (agent-trace observability), Postmark (transactional email), Stripe (payment and subscription processing), Cloudflare (DNS and abuse protection), Vercel (website and portal hosting), Firebase Authentication (sign-in), and GitHub (source-code hosting and deployment). For the full list, the scope of each recipient’s access, and the transfer mechanism that applies, please see our sub-processor list.

6. International transfers

The regSpace application and document storage are hosted in the UK (Google Cloud europe-west2, London), the database is hosted in the UK (AWS eu-west-2, London, managed by Neon), and your tenant data is stored there. AI drafting calls are made to the model providers in their own regions, which sit outside that hosting region: Claude through Google Vertex AI in the EU (europe-west1), Gemini on Vertex’s global endpoint, and Anthropic’s direct API for some deployments. The request payload for those calls is regulatory text plus the policy snippets being drafted against. The residency region agreed at onboarding is recorded against your tenant and governs the region you are provisioned into as we add regions. Some of the sub-processors listed above (for example US-based providers) operate outside the UK and EEA. Where any transfer outside the UK or EEA is necessary, we rely on the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses) and the EU Standard Contractual Clauses, supplemented as required by the relevant transfer-impact assessment.

7. Retention

We retain personal data only for as long as necessary to provide the Service and meet our legal obligations. Client-submitted content is retained under the terms of the applicable Master Services Agreement and deleted within 30 days of termination unless extended by written request.

8. Your rights

Depending on your jurisdiction you may have rights to access, correct, delete, port, restrict, or object to our processing of your personal data. You can exercise these rights by writing to hello@regspace.ai. You can also complain to your data protection authority (in the UK, the ICO).

9. Security

Security controls are described in our security page. In summary: schema-per-tenant isolation, per-tenant customer-managed encryption keys (CMEK) enforced at the storage-bucket level, a hash-chained audit trail, and LLM endpoints operated under zero-retention or no-training terms where the provider offers them.

10. Changes

We may update this policy from time to time. Material changes will be notified to account holders. The "Last updated" date above always reflects the current version.