Privacy policy

NoReply is a service operated by October Ltd., a company registered in England and Wales (company number 05367776), registered office 5th Floor, 167-169 Great Portland Street, London W1W 5PF. In data protection terms October Ltd. is the “controller” of the personal data described here, which means we decide why and how it is used.

October Ltd. is registered with the Information Commissioner’s Office (ICO), the UK data protection regulator under registration number ZC224524. This policy explains how we handle your information under the UK GDPR and the Data Protection Act 2018.

If you have a question about anything here, email privacy@usenoreply.com and a person will answer you.

Account information: your email address and password. Passwords are stored hashed, so nobody at NoReply can read yours.

Profile information: your name and, if you provide it, your postal address and phone number. Your name appears on the complaints you send, because a complaint has to say who it is from.

Case information: what you tell us about your complaint, the company involved, the amounts and dates, any evidence you upload, and the messages you exchange with the company through us.

Payment information: handled by Stripe. Card details go to Stripe directly and never reach our servers. We see only that a payment succeeded and what plan it was for.

Usage data: anonymous counts of pages and clicks, collected without storing anything on your device or identifying you. This runs under our legitimate interests unless you switch it off in cookie preferences, which you can do at any time. Analytics that do store data on your device stay off until you opt in. Once you sign in, product analytics are linked to your account so we can see how signed-in users move through a case.

This section matters more than the rest, so it is not buried further down.

Complaints are often about the hardest parts of someone’s life. To explain why a company treated you unfairly you may need to tell us about a disability, a health condition, a caring responsibility, or something that happened to you at home. Where lenders and insurers are concerned, that context is frequently the substance of the complaint rather than background to it.

The UK GDPR calls this special category data, and it carries extra protection. It includes information about your health, your race or ethnicity, your religion, your sex life or sexual orientation, your political opinions, your trade union membership, and your genetic or biometric data.

We only ever hold this because you chose to tell us. We do not ask for it as a matter of course, we do not infer it, and we never use it for anything other than the complaint you gave it to us for. It is not used for marketing, it is not used to build a profile of you, and it is not sold under any circumstances.

Where we process it, we rely on two conditions in Article 9 of the UK GDPR: your explicit consent (Article 9(2)(a)), given when you choose to include the detail in your case, and the establishment, exercise or defence of legal claims (Article 9(2)(f)), which is what pursuing a complaint or an ombudsman referral is. The second condition means that if you withdraw consent while a complaint is live, we can still keep the record of what was already sent on your behalf, which you may need if the case escalates.

You can withdraw consent at any time by emailing privacy@usenoreply.com. You can also simply leave sensitive detail out. A complaint often works perfectly well without it, and you should never include your card number, National Insurance number or passport details in a case.

The UK GDPR requires a lawful basis for each purpose. Ours are:

• Performance of a contract: running your account, generating your complaint, sending it, and tracking replies. This is the service you signed up for.
• Consent: analytics cookies and other device storage, marketing email, and the sensitive detail described above. You can withdraw consent at any time.
• Legitimate interests: anonymous, cookieless measurement of how the site is used, so we can find what is broken. We assessed this against your interests before relying on it, and you can object by switching measurement off in cookie preferences.
• Legitimate interests: keeping the service secure, preventing abuse, and improving how it works using aggregated usage data rather than the contents of your cases. We have weighed this against your rights and use the least data that achieves it.
• Legal obligation: keeping records we are required to keep, such as payment records for UK tax purposes.

Writing your complaint needs AI, and that means your case details are sent to specialist providers who process them on our behalf. We think you should know exactly who, and exactly what they get, so here it is in full.

• Anthropic (Claude): your complaint description, case details, and any messages you send in the case chat. Used to analyse your case and draft your letter.
• Google (Gemini): the contents of evidence files you upload, including images and text extracted from documents. Used to work out what your evidence shows and how it supports your case.
• Perplexity: your complaint description and the company name. Used to research the consumer law that applies to your situation.
• ElevenLabs and OpenAI: audio you record, if you describe your complaint by voice instead of typing. Used only to transcribe it.
• Exa and Firecrawl: the company name and website only. These never receive your complaint or your personal details. Used to find the right complaints contact.

If your case contains sensitive detail of the kind described above, it reaches the providers that receive your case description and evidence. That is the practical consequence of asking software to write about your situation, and it is why the section above asks you to include only what the complaint actually needs.

Each of these processes your data under contract, on our instructions, and none of them are permitted to use it to train their models. We do not sell your case data, and we do not use the contents of your cases to train any model of our own.

We use AI to assess your case, suggest the law that applies, and draft your letter. Those outputs are suggestions. Nothing is sent to a company until you have read it and chosen to send it, and no decision with a legal effect on you is made by software alone.

We are not a law firm and this is not legal advice. Any assessment of how strong your case looks is an opinion generated from what you told us, not a prediction of the outcome.

We do not sell your data. We share information only in these circumstances:

• The company you are complaining about: they receive the complaint you wrote and chose to send, including your name and whatever details you put in it. This is the point of the service, but it is worth stating plainly.
• AI providers: Anthropic, Google, Perplexity, ElevenLabs, OpenAI, Exa and Firecrawl, as set out above.
• Infrastructure: Supabase hosts our database and stores your evidence files. Vercel hosts the site. Stripe processes payments and receives your payment details directly rather than through us. Resend sends our email.
• Analytics: PostHog, Vercel Analytics and Visitors for anonymous measurement, plus Seline and Google Analytics once you accept analytics cookies. Each is described in our cookie policy. These receive usage data, not the contents of your cases.
• Legal requirements: we may disclose information where the law requires it, or to establish or defend legal claims.
• With your consent: anything else you explicitly ask us to share.

Some of the providers above are based outside the UK, mainly in the United States or the European Economic Area. Where data leaves the UK, the transfer is covered either by UK adequacy regulations or by the UK International Data Transfer Addendum to the European Commission’s Standard Contractual Clauses, together with checks on the safeguards the provider has in place.

You can ask us for details of the safeguards applying to any particular transfer by emailing privacy@usenoreply.com.

We keep your account and case data for as long as your account is open, and for six years after it closes or after your last activity, whichever is later. Six years is not arbitrary: it matches the limitation period for most consumer claims in England and Wales, so a case you filed today is still available if it becomes relevant years later.

Complaints are not a one-afternoon job, and a case you filed eight weeks ago is exactly the one you need when it is time to escalate to an ombudsman, so we do not delete cases on a short timer while an account is live.

Evidence files are different, and go sooner. Photographs of receipts, statements and letters are the most sensitive thing we hold, and they have done their job once your complaint is written and the outcome is known. We delete them twelve months after a case is resolved, or after twenty-four months with no activity on it. Twelve months clears any realistic ombudsman timeline, so the file is still there if the company reopens the argument.

You will always get thirty days’ notice before that happens, with the date and a reminder to download anything you want to keep. Your case, your letters and the correspondence all stay: it is only the uploaded files that go.

Ask us to delete your account and we will remove your cases, evidence files and messages. We keep the minimum we are legally required to, such as records of payments, which UK tax law requires us to hold for six years.

The AI providers listed above do not retain your case data as their own record; they process it to return a result and it is not kept for their purposes.

Your data is stored using industry-standard encryption. We use Supabase for our database infrastructure, which provides:

• Encryption at rest and in transit
• Row-level security, so your cases are readable only by your account
• Regular security audits and compliance certifications

If a breach ever occurs that is likely to result in a risk to your rights and freedoms, we will report it to the ICO within 72 hours and tell you directly where the risk to you is high.

Under the UK GDPR you have the right to:

• Be informed: know how your data is used, which is what this page is for
• Access: request a copy of the personal data we hold about you
• Rectification: have inaccurate information corrected
• Erasure: have your data deleted, subject to records we must keep by law
• Restrict processing: ask us to pause using your data while a concern is resolved
• Object: object to processing based on our legitimate interests, and to direct marketing at any time
• Portability: receive your data in a machine-readable format, or have it sent elsewhere
• Withdraw consent: at any time, without affecting processing already carried out

To exercise any of these, email privacy@usenoreply.com. We will respond within one month. There is no charge.

We would rather hear it first, so please email privacy@usenoreply.com and give us the chance to put it right. It would be a poor complaints service that handled its own complaints badly.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection, at any time and without asking us first. They can be reached at ico.org.uk/make-a-complaint or on 0303 123 1113.