Privacy Policy.

This Privacy Policy explains how Kyra Law Limited (“Kyra Law”, “we”, “us”, or “our”) collects, uses, and protects information about visitors to our website at kyralaw.co.uk and any subdomain we operate.

If you are an existing client of Kyra Law, the way we handle your contract and matter data is governed by the Terms of Engagement and Data Processing Addendum we sign with you, not by this policy. This policy otherwise covers website visitors only, with one exception: the section on call recording and AI transcripts below applies to anyone who speaks to us on a call, whether or not you are a client.

Who we are

Kyra Law Limited is a company registered in England & Wales (company number 17111866) at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ. We are registered with the Information Commissioner's Office (ICO) under reference ZC131108.

What information we collect

When you visit our website, we collect a small amount of information automatically:

• Aggregated analytics. We use Vercel Web Analytics, a privacy-friendly, cookieless service. It records page views, referrers, and approximate location (country or region) using a daily-rotated hashed identifier derived from your IP address. We never see your raw IP, and we cannot identify you as an individual from analytics data.
• Performance measurements. We use Vercel Speed Insights to measure how quickly our pages load for you. This is also cookieless and anonymous.
• Error monitoring. If something on the site breaks, we use Sentry to capture the error so we can fix it. Sentry may briefly record your IP address and the URL you were on at the time. We rely on our legitimate interest in keeping a secure, working website.

If you contact us by email or any contact form, we will receive whatever information you choose to share with us (typically your name, email address, and the content of your message).

Call recording and AI transcripts

We may record and automatically transcribe calls and meetings, including introductory calls, client calls, and internal calls. We use Notion AI meeting notes to produce a written transcript and an AI-generated summary of what was discussed.

We tell you before the call, not during it. Our meeting invitations say that the call may be transcribed by an AI notetaker and point you to this policy, so you know before you accept.

You can turn it off. If you would rather we did not, tell us at the start of the call — or let us know beforehand — and we will turn it off for that call. You can also ask us to stop partway through, or ask us to delete the transcript afterwards. Declining will never affect the advice or service you receive.

What this captures and what we keep:

• What is captured. What is said on the call, the names of the participants, the date and time, and an AI-generated summary with any action points.
• Transcripts and notes only. We do not keep the audio or video recording. It is deleted once the transcript has been produced; only the written transcript, summary, and notes are retained.
• Why we do it. To keep an accurate record of your instructions and the advice we give, so that we are listening to you rather than typing, and so the matter record is complete. For clients, transcripts and notes form part of the matter file and feed the systems we use to run your matter.
• Lawful basis. Our legitimate interest in keeping an accurate record of what was discussed and agreed, and — for clients — our contract with you. Because we give notice in advance and let you switch recording off on request, we have assessed the privacy impact as proportionate. You can object at any time, as above.
• Not used to train AI. Call content is not used to train publicly available AI models, and we do not sell or share it for that purpose.

AI transcripts and summaries are not perfect and can misattribute or mishear what was said. A transcript is an internal working record, not a formal record of our advice — the advice we give you is what we confirm in writing.

How we use your information

• To understand how the website is performing in aggregate.
• To diagnose and fix technical issues.
• To respond to enquiries you send us.
• To keep an accurate record of calls and meetings, the instructions you give us, and the advice we give you.
• To meet legal obligations, for example responding to lawful requests from public authorities.

We do not use your information to build a profile about you, target you with ads, or sell it to third parties. We do not send direct marketing without your consent.

Lawful bases under UK GDPR

• Legitimate interests for aggregated analytics, performance measurement, error monitoring, and recording and transcribing calls. We have assessed that this processing has minimal privacy impact and is something a reasonable visitor or caller would expect, and you can object to it.
• Consent where we ask for it (for example, if we ever offer a newsletter). You can withdraw consent at any time.
• Contract where you have entered into a Terms of Engagement with us, processing your contact details to deliver the agreed services.
• Legal obligation where the law requires us to retain or share information.

Who we share your information with

We share information only with the following categories of service provider, each of whom acts as our processor or sub-processor and is contractually bound to handle data securely:

• Vercel Inc. (United States): website hosting, analytics, and performance.
• Functional Software, Inc. trading as Sentry (United States): error monitoring.
• Resend (Resend.com, United States): email delivery, if you contact us by email.
• Notion Labs, Inc. (United States): workspace, matter records, and AI meeting notes, including call transcripts and summaries.

We do not share your information with anyone else except where required by law or with your explicit consent.

International transfers

Some of our service providers are based in the United States. We rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses to ensure your information receives equivalent protection when transferred outside the UK.

How long we keep information

• Analytics and performance data: aggregated only, retained by Vercel for up to 12 months. Individual events are not linked to you personally.
• Error logs: retained by Sentry for 90 days.
• Call transcripts and notes: audio and video are not retained. Transcripts and summaries are kept for the life of the matter and for six years afterwards, in line with our file-retention practice, unless you ask us to delete them sooner.
• Email correspondence: kept while we handle your enquiry and for a reasonable period afterwards (typically up to two years), then deleted.

Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you.
• Correct any inaccurate information.
• Ask us to erase your information.
• Restrict or object to processing.
• Receive your information in a portable format.
• Withdraw consent, where we rely on consent.
• Lodge a complaint with the ICO at ico.org.uk.

To exercise any of these rights, email joey.irwin@kyralaw.co.uk or julian.ritter@kyralaw.co.uk.

Cookies and similar technologies

See our Cookies Policy for details. In short, we do not set tracking, advertising, or marketing cookies. The only browser storage we use is necessary for security, error monitoring, and remembering that you have dismissed our cookie banner.

Children

Our website is not directed to children under 16 and we do not knowingly collect personal data from children.

Changes to this policy

We may update this policy from time to time. The “last updated” date at the top will tell you when. For material changes, we will give you reasonable advance notice on the website.