Privacy and your information

Who is responsible

Newbould & Co Solutions Limited, trading as Who Cares Justice Universal, is responsible for WCJU's use of your information. Company number: 10645024. Registered office: The Hermitage, 15a Shenfield Road, Brentwood, Essex, England, CM15 8AG.

For privacy questions or to exercise your rights, contact support@wcjuniversal.co.uk. Start with a brief request, not copies of sensitive records. We may need to check your identity or authority before releasing information.

What information is held

Existing reports may contain names, contact details, dates of birth, addresses, accounts of harm, health or safeguarding information, financial losses, complaints, evidence and information about other people. Accounts hold identity and contact information; payments and appointments hold service, transaction and booking details. General enquiries collect your name, email, optional phone number and message.

Information is used to respond to enquiries, administer accounts and paid services, and manage existing cases. We are reviewing the purpose and lawful basis for each use, including the additional legal conditions for sensitive and criminal-offence information. A checkbox alone does not establish those conditions. New sensitive intake will remain paused pending that review.

Service providers and access

Lovable Cloud provides hosting, accounts, database and private file storage. Stripe processes card payments through a managed connection; card details are entered in Stripe's payment interface rather than the harm report. Google sign-in is available. Google Fonts supplies website fonts.

Authorised administrators can access existing cases; signed-in reporters can view reports linked to their account. File access remains private. Existing notifications may contain a case reference, organisation, harm categories and submission time, or payment service and amount. They are sent through managed email to the authorised owner inbox.

The case AI helper previously sent the narrative, organisation and start date through Lovable's AI Gateway to an OpenAI model. It is now blocked. We are seeking written confirmation of applicable sensitive-data permission, processing countries, retention, support access and international-transfer safeguards. We do not claim that all processing is UK-only or independently verified.

Suppliers and public intelligence

There is no automatic supplier case-sharing or public case-publication service in this application. An introduction must have appropriate authority, disclosure and safeguards, including transparency about any commercial referral arrangement. Identifiable case information must not be disclosed merely because you submitted a report. Any future anonymised intelligence publication requires a separate privacy and re-identification review.

Saved drafts, cookies and analytics

The paused report page does not open old drafts or save new answers. Drafts saved previously may remain in your browser or account; they have not been silently deleted. Anyone sharing your browser may be able to access old browser data. Ask us about a saved draft or remove site data using your browser's settings if you choose.

Account sign-in uses persistent session storage. The site also uses navigation preferences, hosting security cookies and platform analytics/performance scripts. Google font requests reveal ordinary connection information to Google. We are confirming the purposes, durations and recipients of platform tracking, and whether consent or an objection option is required. This interim notice is not a substitute for those controls. Session recording was not active in the audit visit; that does not guarantee every platform setting.

Retention and deletion

Existing records are being preserved during the review. A purpose-specific retention schedule, legal-hold process and complete deletion arrangements across files, email, logs and backups are not yet independently verified. We will explain the applicable retention or restriction decision when responding to a request rather than promise immediate deletion everywhere. Documented daily database backups do not include evidence files.

Your rights

Depending on the circumstances, you can request access, correction, erasure, restriction or portability, object to processing, and withdraw consent where consent is the basis. These rights have limits, including protection of other people's information and legally justified retention. We normally respond within one month, subject to applicable identity checks and lawful extensions.

You can complain to the Information Commissioner's Office. Contacting us first does not remove that right.