Privacy Policy

Version: 14 November 2026

Who operates Practice

Practice is operated by Rori Hinds trading as Practice, at Flat 13, Grand Union Building, 55 Northgate Street, Leicester, LE3 5BZ, United Kingdom. Contact hello@practice.cx for support, privacy questions or requests about your information.

Practice is for business and professional use. We are responsible for account administration, billing, security, support and our own analytics. When a customer puts their clients' information into Practice, we normally process it on that customer's instructions. Our Data Processing Agreement covers that work. Contact the relevant business first about information it supplied; we can help route requests.

What we collect and why

We process account and team details; prompts, conversations, uploaded files, saved work and memory; client contacts and information submitted through customer pages; sharing, signature and communication records; subscription and transaction records; and technical logs needed to run and protect the service. Information may come from you, your workspace administrator, your clients, connected services or public research sources.

We use this information to provide your requested work, save and retrieve content, manage access, send authorised messages, process payments, provide support, investigate faults and prevent abuse. Stripe handles payment-card information; Practice stores related payment and subscription records rather than full card numbers.

If you request hands-on setup support, we store your telephone number with your account name, email address and the date of your request in our private support inbox. Practice can call you about onboarding and support; this does not sign you up for marketing calls or messages. You can change your number or withdraw the request and remove it in Settings under Your account, or contact hello@practice.cx. These support details are not added to your AI workspace context or analytics.

Connected email/calendar features access information within your granted permissions. Relevant messages or attachments may enter an AI task. Disconnecting stops future access through that connection but does not erase saved workspace content or recipients’ copies.

For information we control, our legal bases are contract to serve individual customers; legitimate interests for business administration, security, support and limited operational measurement; legal obligations for required records; and consent for optional analytics or marketing where required. We balance legitimate interests against individual rights. Customer content is processed on the business’s instructions, not by treating every upload as consent.

AI and other suppliers

Relevant instructions and content are sent to the suppliers performing a feature. This includes AI models, image generation, search, document processing and memory. Standard chat uses DeepSeek models hosted by DeepInfra, and Advanced chat uses Anthropic. Follow-up suggestions may send a short conversation excerpt to DeepInfra even when Advanced is selected. Other enabled tools can use additional suppliers. Selecting a main model does not limit all processing to that provider.

Memory retains useful conversation information for later retrieval. We use Mem0 on a paid plan. Its published paid-plan terms restrict customer-content use to providing the service and support, with separate provisions for aggregated and de-identified data. Queries, file text and memory may contain personal information. Provide only what is necessary; highly sensitive, children’s or specially regulated information needs an express agreement and suitable safeguards.

Our supplier list explains who receives information, for what purpose, and the relevant processing locations and protections. Suppliers have different storage and data-use rules: we do not promise that every provider offers zero retention or excludes all model training.

DeepInfra's published terms incorporate a data-processing agreement and state that customer content is not used for general model training. For models it hosts, its zero-retention commitment is subject to stated exceptions, including legal and security requirements, authorised support investigations and optional features with separate retention. These are not promises that all operational records or every supplier retain no data. See DeepInfra's Terms, sections 5 and 7. Before the November 2026 provider change, Standard chat and follow-up suggestions used DeepSeek's direct API; changing provider does not retrospectively change that supplier's handling of earlier requests.

Processing may take place outside the UK. Where required, we use an applicable adequacy arrangement or approved contractual safeguards and assess the transfer. You can ask us for information about the safeguards used.

Sharing and publication

Your workspace permissions and sharing choices determine who can access your work. You may publish material or share it with named recipients or anyone holding a link. Businesses collecting information through Practice-hosted pages are responsible for their own notices and uses of that information.

Revoking a link does not recall downloaded, forwarded or otherwise independently held copies. We may disclose information where legally required or necessary to investigate misuse or defend legal rights.

Cookies, storage and analytics

We use cookies and browser storage for sign-in, security, access permissions and service state. Authentication and payment suppliers may also use necessary storage when you use their services.

If you allow optional analytics, PostHog receives public page views, referring domains, campaign tags and an anonymous visitor identifier. After sign-in, that identifier can link the first consented visit to a trial start, successfully completed tasks and a first paid subscription for up to 30 days. These events exclude message content, client documents and email addresses. The identifier is still pseudonymous information, not a guarantee that the data is anonymous.

PostHog uses our EU project. Practice does not enable session replay, advertising pixels or general click capture in this integration. Change your choice through Analytics preferences in the public footer or account settings. Withdrawal stops future optional collection and linked conversion exports; it does not automatically erase events already collected. Contact us for a deletion request. Essential service records are separate from optional analytics.

Reddit advertising measurement

With your separate permission, we store the Reddit ad-click reference in your browser and link it to your account for up to 30 days. We send Reddit that reference, completed signup events and the date, currency and amount of your first paid subscription to measure and improve our advertising. We do not send Reddit your name, email address, prompts, client information or workspace URLs through this integration. This is separate from PostHog analytics and is off until you choose it. You can decline or withdraw in Privacy preferences on the website or in account settings; withdrawal stops future exports but does not recall events already sent. Expired attribution is removed by our scheduled cleanup. Reddit processes the events under its Privacy Policy and may process them outside the UK. Contact us to request help with previously shared data.

How long we keep information

We retain workspace content to provide the service and let you return to saved work. Cancelling a subscription stops future renewal under your billing terms; it does not request deletion. Saved work and unused paid credits are retained for a return, while needed for this purpose. We review retention when you request closure or deletion.

The first-visit attribution expires after 30 days and is then removed from the account by scheduled cleanup. Internal product-event records expire after 90 days. Unattached draft chat uploads normally become eligible for cleanup after 24 hours without further upload activity; files attached to conversations or saved elsewhere have a different lifecycle. These periods do not describe PostHog's storage, provider logs, all workspace content or backups.

We retain billing and transaction evidence as required for tax, accounting and disputes, and support and security records for as long as needed to resolve the issue or investigate misuse. Retention depends on the type of record, applicable duties and whether a dispute or investigation remains open. Optional analytics events have a separate provider retention lifecycle; the 30-day attribution window is not an event-deletion promise.

You may request workspace closure, export or deletion at hello@practice.cx. We verify authority and identify any records that must be retained for payments, tax, fraud prevention, disputes or signed agreements. We explain the applicable process and exceptions. Copies in backups and suppliers' systems may follow separate restricted retention periods; deletion is not necessarily immediate across every system.

Your rights

Depending on applicable law and circumstances, you may request access, correction, deletion, restriction, portability or object to processing. You can object to legitimate-interest processing and direct marketing, and withdraw consent without affecting earlier lawful processing. Contact hello@practice.cx. We may need to verify your identity and will respond within the applicable legal time limits.

You may complain to the UK Information Commissioner's Office or another competent regulator. Practice's outputs are AI-assisted; customers must review them and must not use them as the sole basis for decisions with legal or similarly significant effects on a person.

We will date material updates and communicate them appropriately. A revised notice does not itself authorise a new use requiring consent.