LEGAL
Privacy policy
Last updated 25 September 2026
This policy explains how the Police Assist AI mobile app and the website at policeassistai.com (together, “the service”) handle personal data.
Who we are
The service is operated by Matrix Consultancy Services Ltd, 1205 Sand Dune House, Beachview Terrace, Gibraltar GX11 1AA (“we”, “us”). We are the controller of the personal data described here. Contact us about privacy at jasoncisarello@gmail.com.
What we collect
| Data | Why | Lawful basis |
|---|---|---|
| Email address | Creating and signing in to your account, verification and password-reset codes, service messages | Contract |
| Password | Stored only as a one-way Argon2 hash; we cannot read it | Contract |
| Account dates (created, free-access end, subscription end) | Deciding whether you have access | Contract |
| Your chats: the messages you send, the assistant’s replies and the sources it cited | Showing your chat history and answering follow-up questions in context | Contract |
| Answer ratings you choose to give, with any note | Reviewing and correcting the library | Legitimate interests |
| Usage records: time, chosen jurisdiction, number of AI tokens used, outcome | Daily question allowance, cost control, abuse prevention | Legitimate interests |
| Subscription status from Apple or Google, via RevenueCat | Confirming a paid subscription | Contract |
| IP address and request details in server logs | Security, rate limiting and troubleshooting | Legitimate interests |
We do not collect your name, phone number, location, contacts or advertising identifiers. The app contains no advertising, analytics or tracking tools, and we do not sell personal data.
Your chats
When you ask a question, the text is processed to find relevant legal sources and to generate an answer. Recent messages from the same chat are included so follow-up questions are understood in context. Chats are saved to your account in our London database so you can return to them. They stay until you delete them in the app under History, or delete your account. We do not use them for anything else: staff have no tool to read them, they are not used to train AI models, and application logs never contain their text.
Rating an answer. If you rate an answer (for example “Wrong law cited”), that answer, the question it replied to and any note you add are shared with our reviewers so we can correct the library. Ratings are deleted with the chat or your account.
Voice input
If you tap the microphone, your phone’s built-in speech recognition (provided by Apple on iPhone and Google on Android) turns your speech into text. The recording is handled under Apple’s or Google’s own privacy terms and, where the phone supports it, on the device itself. We never receive audio, only the text of the question you send.
Data kept on your phone
Saved reports, notes, redactions, recent and saved searches, and quiz results are stored only on your phone. They are not sent to us unless you choose to share or export them. You can export or delete them in Account → Data Management; they are also removed when you delete your account in the app.
Who processes data for us
- Amazon Web Services hosts the service, database, file storage, email delivery and logs in London (eu-west-2). Question text is converted into a search representation there.
- Amazon Bedrock (United States). Your question text is sent to an AI model run by AWS in US regions, first to turn it into legal search terms and then, with the matching source excerpts, to generate the answer. No account identifier or email address is sent with it. The data is not used to train the model.
- OpenAI (United States). If the AWS model is unavailable, the same data is sent to OpenAI’s API for those steps instead. No account identifier or email address is sent with it. OpenAI does not use this data to train its models and may keep it for up to 30 days to monitor for abuse.
- RevenueCat manages subscription status. It receives a random account identifier (not your email) and purchase information from Apple or Google.
- Apple and Google process payments under their own privacy policies. We never see your card details.
Transfers to the United States rely on the EU–US Data Privacy Framework and the UK extension where the recipient is certified, or otherwise on standard contractual clauses.
How long we keep it
- Account data: until you delete your account.
- Chats: until you delete them or your account.
- Sign-in sessions: 30 days. Verification and reset codes: 30 minutes.
- Server logs: 30 days. Database backups: up to 7 days.
- After account deletion, usage and administrative audit records are kept without your email address, for cost, capacity and security reporting.
Deleting your account
Delete your account at any time in the app under Account → Delete account, or at api.policeassistai.com/account. This deletes your account, email address, chats, sessions and your RevenueCat customer record. Deleting the account does not cancel a store subscription; cancel it in your Apple or Google account settings.
Your rights
Under the Gibraltar GDPR and UK GDPR you can ask for access to, correction or deletion of your data, and object to or restrict processing. Email jasoncisarello@gmail.com. You can complain to the Gibraltar Regulatory Authority (gra.gi) or, in the UK, the Information Commissioner’s Office (ico.org.uk).
Security
Data is encrypted in transit and at rest. Passwords are hashed and session tokens are stored only as hashes. Administrator access is restricted and logged.
Children
The service is intended for adults and is not directed at children under 18.
Changes
We will post changes here and update the date above. Significant changes will be notified in the app or by email.