Privacy notice

Who is responsible for your data

Lextrapolate Limited is the controller of the personal data processed through Judge Yourself. Judge Yourself is a product of Lextrapolate Limited, a company registered in England and Wales (company number 15711888). Registered office: 86-90 Paul Street, London EC2A 4NE. Our Information Commissioner’s Office registration number will be shown here before the service opens.

What we collect

• Your email address, and your typed name: the name you type to acknowledge the guidance on artificial intelligence, with the time.
• The role you are preparing for and your settings: your display name and any reasonable adjustments you set (extra time, longer reading, slower speech, pause in practice).
• Application documents you choose to upload, after you have reviewed the text we read. We remove diversity-monitoring, health, adjustment, character-declaration and referee sections that we can detect before anything is analysed.
• Transcripts of your practice sessions, and the reports and feedback we produce.
• Technical records needed to run and protect the service (sign-in events, rate limits, error reports with all free text removed). When you delete your account we keep a record that a deletion took place, with its time, under the account’s random identifier and nothing else: no name, no email address. That record is deleted 90 days after the deletion completes.

Audio from voice sessions is converted to text as you speak and is not stored.

Why we use it, and on what legal basis

• To provide the service you ask for (sign-in, practice sessions, feedback and reports): necessary for our contract with you (UK GDPR, Article 6(1)(b)).
• To keep the service secure and working (rate limits, abuse prevention, error reports): our legitimate interests in running a secure service (Article 6(1)(f)).
• To improve the exercises, using pseudonymised session records (your account details removed; a transcript may still contain things you said about yourself): our legitimate interests (Article 6(1)(f)). You can object at any time, and we will stop.
• Adjustments you choose to record (for example extra reading time): your explicit consent (Articles 6(1)(a) and 9(2)(a)), which you can withdraw by removing the adjustment.

We do not ask for, and do not knowingly process, health or other special category information in what you upload: we remove the sections we can detect, and we ask you to remove the rest. We do not use your material to train any third party’s models, we do not sell it, and we do not use it for marketing. If your upload contains other people’s details, remove or anonymise them first; we process anything left only to give you feedback.

Automated feedback

Grades and feedback are produced by software and are a practice indication only. No decision with a legal or similarly significant effect on you is made by automated means: we make no decision about you at all, and nothing we produce is shared with the JAC or anyone else.

Who processes it for us

Our processors act on our instructions only. Inference runs in the European Union with zero data retention. Some processors belong to groups based outside the UK. Where personal data may be transferred outside the UK, it is protected by UK adequacy regulations or by the UK International Data Transfer Addendum to the standard contractual clauses [to be confirmed for each processor in the data protection impact assessment].

• Supabase: database, sign-in and file storage (London, UK)
• Netlify: hosting the website and its server functions (functions in London, UK)
• Cloudflare: the live voice connection and domain name service (EU jurisdiction)
• Requesty: routing requests to the language models, with zero data retention (EU)
• Google Cloud Vertex AI and Amazon Web Services Bedrock: the language models, reached through Requesty (EU regions)
• Mistral AI: reading scanned pages of uploaded documents, with zero data retention (EU)
• Speechmatics: turning your speech into text in voice sessions (EU)
• KugelAudio: the voices of the parties and the panel (EU)
• Resend: sign-in and account-deletion emails (EU)
• Sentry: error reports with all free text removed (Frankfurt, Germany)

How long we keep it

• Uploaded documents, the feedback on them, interview plans and any report that quotes them: deleted 90 days after you last use them, or sooner if you delete them.
• Live role-play hearings, for now: a hearing’s transcript is held only by the live hearing service, in the EU. It is deleted 24 hours after the hearing ends, or straight away when you start that role play again. A hearing ends when the chair closes it at the end of its time, or 15 minutes after the service records that no one is connected to it (after a restart of the service that can be later than when you actually left); the 24 hours run from the end the service records. If a deletion is interrupted, it is retried until it completes. Until we connect these transcripts to your account’s records, they are not included in your data download and are not removed when you delete your account: they are deleted on the timetable above instead. We will change this before the service opens to candidates.
• Other session transcripts and reports: kept until you delete them or your account, and deleted in any event after 12 months without a sign-in, with an email warning 30 days before [period to be confirmed].
• Your account (email, name, settings): kept until you delete it, or after 12 months without a sign-in as above.
• Security records (sign-in events, rate-limit counters, error reports): rate-limit counters are deleted within a day; other records are kept for no more than 90 days [to be confirmed].
• Deleting your account removes your data from the live service immediately, except live role-play transcripts, which are deleted on their own timetable above; encrypted backups roll off within the period stated before the service opens.

Your rights

You can download a copy of your data and delete your account from your account page (for now, live role-play transcripts are not part of either: see above). You also have rights to access, correct, restrict and object, and to complain to the Information Commissioner’s Office (ico.org.uk). Contact us first at chris@lextrapolate.com and we will help.