Who is responsible
86Hours
124 City Road, London, EC1V 2NX
Privacy contact: secure contact form
Information we process
We process account identity and settings; a one-way password hash and unique salt; essential session records; business and contact details; subscription and transaction references; case, debtor and invoice details entered by the account holder; timeline notes; generated-document records; uploaded evidence; support messages; and security and service activity. Passwords are not stored in readable form. If you connect Google or Microsoft email, access and refresh tokens are encrypted and used to send only messages you approve. We do not ask for or store your mailbox password. Stripe handles card details and returns billing identifiers and payment status to 86Hours.
The site also records limited usage analytics including page path, referring website, country, device category and a one-way pseudonymous visitor identifier. Raw IP addresses and full browser identifiers are not retained in the analytics table.
Why we use it and our lawful bases
We use account, case and billing data to perform our contract with you: creating and securing the account, providing case-management features, generating letters and PDF evidence packs, processing approved actions and supporting billing. We use limited security, support and service analytics where necessary for our legitimate interests in operating, protecting and improving 86Hours. We retain transaction and compliance records where necessary to meet legal obligations. Where the law requires consent for a particular activity, you can withdraw that consent.
Where information comes from
Most information comes directly from the account holder. Case records may contain information about debtors, contacts or other people supplied by the account holder. We also receive payment and subscription updates from Stripe and, when you connect it, authorisation and sending information from Google.
Who we share it with
Cloud hosting, database and private-file storage providers process product data on our behalf. Stripe processes checkout, payment and subscription data. Google processes authorised outbound email when you connect that feature. Professional advisers, regulators or law-enforcement bodies may receive information where reasonably necessary or legally required. We do not give uploaded case content to advertisers.
International processing
Some service providers operate internationally. The 86Hours account database and authentication logic are part of the hosted 86Hours application rather than a separate identity platform. Account creation and password recovery do not require an external identity or email-delivery service. Where personal data is transferred outside the UK, we rely on an applicable adequacy decision or contractual and organisational safeguards recognised by UK data-protection law.
Retention
Usage analytics are automatically removed after 180 days. Account, case and evidence records are kept while the account is active so that the service and exports remain available. You may archive cases in the product and request account or case deletion through the secure contact form. Support requests are kept while needed to respond, handle a complaint and meet legal obligations. We remove data when it is no longer needed for the service, legal claims, fraud prevention, security, tax or accounting duties. Limited records may remain in protected backups until the normal backup cycle completes.
Your data-protection rights
Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to processing, and to receive portable data. You may also withdraw consent where processing relies on consent. Use the secure contact form to exercise a right. We may need to verify identity and may retain information where the law permits or requires it.
You can complain to the UK Information Commissioner's Office at ico.org.uk/make-a-complaint. Please contact us first if you would like us to try to resolve the issue.
Administrative access
Access to the operations console is restricted to explicitly authorised owner email addresses. The console provides a read-only support view of customer accounts and case summaries; it does not provide controls to edit client claims or open their evidence attachments.
Security and cookies
We use slow salted password hashing, hashed private recovery codes, random server-side session tokens, secure browser cookies, account isolation, private object storage, encrypted connected-email tokens, signed payment notifications and access controls intended to protect product data. Recovery codes are shown once, stored only as hashes and replaced after use. No online service can guarantee absolute security. The service uses essential account and security technologies needed to sign users in and keep sessions working. We do not use case records or uploaded evidence for targeted advertising.
Your responsibility for third-party data
If you enter information about a debtor, customer or other person, you are responsible for having a lawful basis to use it, providing any notice required by law and keeping it accurate. Do not upload more personal information than is reasonably necessary for the case.
Updates and contact
We may update this notice when the service or legal requirements change. Material changes will be highlighted in the service where appropriate. Submit privacy questions and requests through the secure contact form.