Privacy Policy
Version 4 · Effective 30 October 2026
1. Who this covers
This notice covers people who visit the Azmora website, contact us through it, or hold an Azmora account. It does not cover the client information a law firm enters into Azmora about its own clients. For that, the firm is the data controller and Azmora acts as its data processor (see section 3 of our Terms of Service). If you are a firm's client and want to exercise your rights over that data, please ask your firm.
Azmora is operated by Azmora LTD, company number 17521498, registered office Suite RA01, 195-197 Wood Street, London, E17 3NU. For anything in this notice, email privacy@azmora.co.uk.
2. What we collect
- When you contact us (the form on our contact page, or the sign-up box on our home page): your name, email address and message, and your firm and its size if you give them. If you accept Google Analytics, we also note the previous public page and referring website when you submit a form, to understand how people find us. We use it to reply to you and to follow up about Azmora.
- When you hold an account: your name, work email address, firm, role, and a securely hashed password (we keep only the hashed form, never the password itself). If you sign in with a Google or Microsoft work account, that provider tells us your name, work email address and organisation so we can match you to your firm. We also keep a record of account activity (such as sign-ins and changes made to a matter) so your firm has an audit trail.
- When you report a problem: your message and the page you were on. If you leave the "Include technical details" box ticked, we also receive your browser and device type, the size of your window, and a short list of what just went wrong (a request that failed, an error message, or the kind of pop-up that showed). The automatic technical details are designed to exclude document contents and client details. Please do not put confidential client information in the message; you can untick the technical-details box.
- When your firm subscribes: the firm's name and the billing contact's name and email address. Card or bank details are entered on our payment provider's own page, and we do not hold them.
- To keep the service safe: your IP address is used to limit repeated attempts and abuse. Rate-limit counters are eligible for deletion after 24 hours without an update and are removed by a scheduled cleanup. Hosting and security logs are separate records.
- Website analytics, only if you accept: how visitors use our public pages (pages viewed, approximate location, device and browser type) through Google Analytics and Microsoft Clarity. Clarity also records how pages are used (clicks and scrolling, with text and form fields hidden). See section 5.
3. Who we share it with
We use a small number of service providers to run Azmora: our hosting provider, our database provider, our email delivery provider and our payment provider. Their data-protection roles depend on the service: some act on our instructions, while payment and identity providers may also process information for their own legal and security purposes. Some of them may handle data outside the UK. Where they do, it is subject to the international-transfer requirements of UK data protection law. Contact us for the applicable locations, transfer arrangements and a copy of relevant safeguards. If you accept analytics cookies, Google and Microsoft also receive the usage data described above. We do not sell personal data and we do not use it for advertising.
- Cloudflare - Application hosting (Workers), scheduled backup and deletion processing (EU-constrained Containers), content delivery, DNS and firewall, hosted PDF rendering, and private storage (R2) for cached PDFs (up to 3 days), record-return packages and encrypted database backups (up to 30 days, subject to our firm-record deletion policy). Maintenance can temporarily decrypt backups to restore records or remove a departing firm's data; encryption keys are kept in protected service secrets.
Hosted PDF rendering is transient for the Puppeteer method we use. Private files and backups we manage are removed under our firm-record deletion policy. Workers Logs normally remain for seven days on Paid or three days on Free; other security and service records follow Cloudflare’s purpose-based retention criteria. These periods do not establish a universal physical-erasure deadline.
- Supabase - Database hosting
Live client records are removed under our firm-record deletion policy. Provider recovery backups have a separate cycle: Pro daily backups have a seven-day window, and Free projects can also have up to seven daily recovery backups. API/database log windows are one day on Free and seven days on Pro. These windows are not a verified maximum for every internal copy; restored data must have completed deletions reapplied.
- Microsoft 365 business email - Handling business correspondence and support enquiries
Correspondence is kept according to its business or legal purpose. Exchange deleted-item recovery defaults to 14 days and can be configured up to 30 days after permanent deletion; preservation rules can extend this. Our exact mailbox recovery settings are not independently verified, so this is not a fixed total retention promise. The founder’s tenant evidence places Exchange mailbox data at rest in the United Kingdom.
- Resend - Sending transactional email (invites, reminders, client review, quote, pre-appointment and vault emails)
Email content, attachments and delivery logs are retained for 30 days on our Free plan; Resend also retains backups for seven days. The email/log window follows processing of the message, not the date a firm leaves Azmora. The published information does not specify how those backup and email windows overlap.
- Stripe - Taking subscription payments by Direct Debit or card, and issuing invoices
Billing and payment information is generally retained for five or more years after the later of the business relationship ending or the last transaction, depending on legal and other permitted purposes. This does not include client matter records.
- Ideal Postcodes (when enabled) - UK address search from a typed postcode
Our key is configured with a zero-day retention setting for personal fields in transaction logs. That setting is not a guarantee about every internal provider record; other retention follows the provider’s applicable purposes and terms.
- Microsoft Entra (when enabled) - Staff sign-in, and firm sign-up, with a work account (single sign-on)
Your organisation controls its Microsoft identity account. Sign-in/audit report defaults are seven days on Free or 30 days on P1/P2, with other security and exported records handled separately. Ending Azmora access does not delete your Microsoft account.
- Google Workspace sign-in (when enabled) - Staff sign-in, and firm sign-up, with a work account (single sign-on)
Your organisation or Google controls your identity account and its retention settings. Ending Azmora access does not delete that account. Google retains records according to its published purposes and deletion procedures; no sign-in-specific all-copy deadline is promised.
- Google Analytics (when enabled) - Counting visits to the public marketing pages, only after the visitor accepts
Our user-data and event-data settings are two months, with reset on new activity off. Expired data is deleted through Google’s monthly process; standard aggregated reports are separate. Where the processor terms’ deletion conditions apply, system deletion can take up to 180 days, subject to legal requirements.
- Microsoft Clarity (when enabled) - Seeing how the public marketing pages are used (clicks and scrolling, with text and form fields hidden), only after the visitor accepts
Playback recordings are retained for 30 days. Click/heatmap data and labelled or favourited sessions are retained for nine months, including backups, under the current product documentation. These are consented public-site records, separate from firms’ client files.
Our database is hosted in London, United Kingdom.
4. Why we may use it
- To run your account and the service we rely on our legitimate interests in providing and administering the service to your firm for staff account details. Where you personally contract with us, we rely on contract for processing necessary to perform that contract.
- To answer enquiries, provide support and keep the service secure we rely on our legitimate interest in running a safe business. You can object (see section 6).
- For optional website analytics and consented form-attribution data we rely on your consent. You can withdraw it at any time.
- To take payment and keep financial records we rely on legal obligations for records we must keep for tax and accounting, and legitimate interests to administer your firm’s subscription and billing contacts. Contract applies where the billing contact personally contracts with us.
5. Cookies and similar storage
We use essential storage for sign-in, security and requested features. Optional analytics and session recordings need your choice. Cookie settings remembers that choice for 180 days on this browser; clearing browser storage resets it. Rejecting optional tools does not prevent use of the service.
| What | Why | Needs your consent? |
|---|---|---|
| A one-time marker that a page was reloaded after the site was updated | Stops a page that loaded without its styling from reloading in a loop. Cleared when the tab closes. | No - used for the requested feature |
| A note that you closed the "your browser is out of date" message | So the message does not come back on every page during the same visit. It is cleared when you close the tab and is never sent to us. | No - used for the requested feature |
| Sign-in session cookies | Keep you signed in and protect against forged requests. The application applies a 45-minute idle timeout and a seven-day absolute session limit; authentication flow cookies may expire sooner. | No - used for the requested feature |
| Browser storage inside the app (autosaved drafts, remembered filters, a dismissed cover-page note, having seen the branding prompt) | So a half-finished form or your place in a list is not lost. Stays on this device until the app clears it or you clear browser storage; use a trusted device for client work. | No - used for the requested feature |
| Your email address, if you tick Remember me on the sign-in page | Fills in your email next time you sign in on this device, until you untick the box or clear browser storage. Your password is never stored, and it does not keep you signed in. Untick the box to forget it. | No - used for the requested feature |
| A note that you dismissed the "finish setting up your firm" reminder | So the reminder does not come back on every page during the same visit. It is cleared when you close the tab and is never sent to us. | No - used for the requested feature |
| The email address (and team size note) you typed on the home page, and whether you chose "start free trial" or "subscribe" | Carries it to the sign-up or contact form so you do not type it twice, and lets the plan choice after sign-up lead with the option you picked. Cleared the moment that page reads it, or when you close the tab. It is only sent to us when you press the button on the home page (see the privacy policy, section 2, When you contact us): if you then do not finish signing up we keep the address as an enquiry so we can follow up once. | No - used for the requested feature |
| The last two public pages you viewed after accepting Google Analytics, and the referring website | Optional attribution: if you accept Google Analytics and then submit a form, we can see which page you came from. Cleared when you close the tab, never used to follow you between visits, and sent to us only if you submit a form. | Yes - only if you accept |
| Your cookie choice | Remembers your separate Google Analytics and Microsoft Clarity choices for 180 days in this browser, so we do not keep asking. You can change them using Cookie settings or clear browser storage. | No - used for the requested feature |
| Google Analytics cookies (_ga, _ga_*) | Count visits to our public pages. Not loaded inside the app, and never on pages that carry client information. | Yes - only if you accept |
| Microsoft Clarity cookies (_clck, _clsk, CLID, ANONCHK, MR, MUID, SM) | Show us how visitors use our public pages, with text and form fields hidden. Not loaded inside the app, and never on pages that carry client information. | Yes - only if you accept |
You can change your mind at any time:
6. Your rights
Under UK GDPR you can ask us for a copy of your personal data, to correct it, to delete it, or to restrict or object to how we use it, and you can withdraw any consent you gave. Where the right applies, you can also ask for the personal data you supplied in a reusable electronic format. We respond without undue delay, normally within one month; if the law allows extra time, we explain why. These rights have conditions and exceptions. Withdrawing consent does not affect processing that was lawful before withdrawal.
If you are unhappy with how we handle your data, please complain to us first, using the details at the foot of this page. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office (ico.org.uk) at any time.
Your account data is separate from your firm's client files. Removing a staff account does not by itself delete those files. For requests about information in a client file, contact the firm responsible for that file; if you contact us, we will help the firm handle your request. You can contact us about your own account data whether or not you still have subscription access.
Accounts are intended for adult professionals. Client records may include information about children, handled on the firm’s instructions rather than as children’s accounts.
Staff account details may be supplied by your firm’s administrator or your chosen work-account sign-in provider. Account and security information is needed to provide access; enquiry and optional analytics information is voluntary.
We update this notice when our processing changes, show the effective date above and explain material changes before using personal data for a new purpose.
We do not make decisions about you by automated means that have legal or similarly significant effects.
To exercise a right or ask a question, email privacy@azmora.co.uk or use the details on our contact page.