Privacy policy
1. Who we are
Conveysure AML ("Conveysure", "we", "us") provides anti-money-laundering compliance software for law firms and licensed conveyancers in the United Kingdom. This notice explains how personal data is handled when you visit our website, register a firm account, or are asked by your solicitor or conveyancer to provide identity and financial information through our secure client portal.
You can contact us about anything in this notice at [email protected].
2. The two roles we play with your data
Under UK GDPR we act in two different capacities, and your rights are exercised differently in each:
- As a controller — for data about visitors to this website and the staff of firms that register an account (names, work email addresses, login and audit records). For this data, contact us directly.
- As a processor — for data about clients of law firms (buyers, sellers, gift donors and related parties) that is collected through the client portal or uploaded by firm staff. Here the law firm handling your transaction is the controller: it decides what is collected and why, and we process it only on the firm's instructions. If you are a client of a firm, requests about your data should go to that firm first; we will assist them in responding.
3. The data we collect and why
3.1 Firm staff and website visitors (we are the controller)
- Account data — name, work email address, role (e.g. fee earner, MLRO, admin), password (stored only as a salted hash), and firm details including SRA number.
- Usage and audit data — sign-in events, actions taken in the product (an audit trail is itself a regulatory requirement for our customers), and the IP address associated with security-relevant events such as failed logins and password resets.
- Correspondence — emails you send us.
We do not use third-party advertising or analytics cookies. The only cookie we set is a strictly necessary session cookie that keeps you signed in.
3.2 Clients of law firms (we are the processor)
When a firm uses Conveysure to run customer due diligence on a property transaction, we process on the firm's behalf:
- Identity data — name, date of birth, nationality, address, contact details, and copies of identity documents such as passports or driving licences.
- Financial data — bank statements, payslips, tax returns, gift letters and other source-of-funds evidence, together with details of the transaction (property address, purchase price, funding structure).
- Screening data — the results of checks against the UK sanctions list, politically-exposed-person (PEP) lists, Companies House records, and adverse media searches.
- Questionnaire answers and messages — information you submit through the client portal and messages exchanged with the firm.
The firm collects this data to comply with its legal obligations under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 ("MLR 2017"). Providing it is a legal requirement of the firm acting for you — if it is not provided, the firm is unlikely to be able to act on your transaction.
4. Lawful bases for processing
Where we are the controller (our own account administration, security and correspondence), we rely on the following bases under Article 6 of the UK GDPR:
| Processing | Lawful basis (UK GDPR Art. 6) |
|---|---|
| Creating and administering a firm's staff accounts and service communications | Performance of a contract (6(1)(b)) |
| Security logging, account lockout, abuse prevention | Legitimate interests (6(1)(f)) — keeping the service and the firms' data secure; we consider this necessary and not overridden by the interests of users, who would reasonably expect it |
| Replying to emails and complaints sent to us | Legitimate interests (6(1)(f)) — responding to the person who contacted us |
Where we are the processor (a firm's customer due diligence on its clients), we do not choose a lawful basis: the firm does, as controller, and tells us what to do. The firm's basis is normally legal obligation (6(1)(c)) under the Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017. Where the information handled includes criminal-offence data (for example an allegation reported in the news, or a conviction), it is the firm, as controller, that must identify the additional condition required by Article 10 UK GDPR and Schedule 1 to the Data Protection Act 2018 and keep any required appropriate policy document. We do not use client data for our own purposes, including marketing or training our own or anyone else's models.
5. Automated analysis and AI
Conveysure uses software and AI models to help firms review evidence — for example extracting transactions from bank statements, drafting risk narratives and flagging unusual credits for review. Some of this is deterministic rules (for example a calculated working risk rating and the escalation flags that follow from it), and some is AI-drafted text. These outputs assist the firm's professional judgment; they do not replace it. The decisions that matter most to you — whether the firm accepts a source of funds, clears a sanctions or PEP match, escalates to the Money Laundering Reporting Officer, or acts for you at all — are recorded by a named person at the firm, not by the software. The risk rating calculated by the software is a working rating that the firm reviews. An AI suggestion can raise the level of scrutiny applied to a matter but cannot lower it or clear a check.
When AI is used, our servers first read the document (text extraction and character recognition run on our own infrastructure). What is sent to the AI provider is the extracted text or structured findings the task needs — not the original file. We mask account numbers, sort codes, IBANs, card numbers, National Insurance numbers and passport numbers before sending. Names, amounts, dates and transaction descriptions are sent because the analysis cannot be done without them. Our AI provider is OpenAI (its API service). The provider's published terms state that data sent through its API is not used to train its models unless the customer opts in. AI outputs about an identifiable person are personal data like any other and can be corrected by the firm.
6. Who we share data with
- The law firm acting for you — all client data belongs to and is visible to your firm; that is the purpose of the service.
- Our service providers (sub-processors) — application and database hosting (Render), file storage (an S3-compatible object-storage provider, or the database), an email delivery provider for service emails (SendGrid or an SMTP provider), an AI provider (OpenAI, section 5) and, if enabled, error monitoring (Sentry; configured to send no request bodies, cookies, variable values or user identity). Some of these providers or their group companies are outside the UK. Where personal data is transferred outside the UK we rely on a UK-approved transfer mechanism; customer firms can obtain the current provider list, locations and mechanism from us.
- Screening data providers — searches are run against the public UK sanctions list (OFSI), Companies House, sanctions/PEP data services and news sources. A search necessarily discloses the name being searched to the provider.
- Authorities — a firm may be legally required to disclose information to the National Crime Agency or other authorities (for example in a Suspicious Activity Report). By law neither the firm nor we may tell you when this happens ("tipping off"). We may also disclose data where required by law or court order.
We never sell personal data.
7. How long we keep data
- Client due-diligence records — MLR 2017 Reg. 40 requires firms to keep CDD records for five years from the date the transaction is complete or the business relationship ends. The product counts the period from the matter's completion date (not from the date a document was uploaded), will not delete anything sooner than five years after it, and holds any record whose completion date has not been recorded. Deletion is not automatic: it takes place only when the firm's administrator instructs it by running the retention job, and a firm may keep records for longer.
- Raw bank statement data — a firm may configure removal of the raw statement file and analysis ahead of the rest of the record, but never earlier than the same five-year floor, and only after the matter's completion date is recorded.
- Firm account data — kept for the life of the firm's subscription. On termination the firm's records are available for export for 30 days and are then deleted, subject to any legal retention obligation.
- Sign-in sessions and one-time tokens — expired or used password-reset, email-verification and invitation tokens and ended sessions are deleted automatically after a short grace period (7 days).
- Audit logs — kept for the same period as the records they relate to, because they evidence regulatory compliance.
- Backups — deleted data can remain in database backups until those backups are replaced; we do not restore a backup selectively, and after any restore all sign-in sessions are revoked.
8. How we protect data
- Traffic to the service is carried over HTTPS (TLS).
- Access is restricted by role and by firm — each firm's data is isolated and staff of one firm cannot see another firm's matters.
- Passwords are stored only as salted hashes; sign-in session tokens are stored only as digests; repeated failed logins lock the account; sessions expire automatically.
- Client portal access uses single-use invitation links with expiry and one-time-passcode verification.
- Actions on compliance records are written to an audit trail.
9. Your rights
Under UK GDPR you have the right to:
- access a copy of your personal data (the controller carries out a reasonable and proportionate search for it);
- have inaccurate data rectified;
- request erasure (note: data a firm must keep under MLR 2017 cannot be erased before the statutory retention period ends);
- restrict or object to processing based on legitimate interests;
- data portability for data you provided under a contract;
- ask for human intervention and to contest a decision based solely on automated processing that has a legal or similarly significant effect — as set out in section 5, decisions about you are taken by people.
Some rights are limited where the law says so — for example, a firm may be unable to tell you about a Suspicious Activity Report. Each such limit is applied case by case. If you are a client of a law firm, please direct requests to the firm handling your matter (the controller). If you are firm staff or a website visitor, contact us directly.
10. If you came here from a firm's client portal
The firm that invited you is the controller of what you enter in its portal. It should give you its own privacy notice, which tells you why it collects your information, who it shares it with and how to exercise your rights. This page does not replace it: it describes only ConveySure's role as the firm's service provider and our own use of staff and visitor data. Please ask the firm if you cannot find its notice.
11. Contact and complaints
Questions, requests or concerns: [email protected].
Data-protection complaints
If you are unhappy with how we handled your personal data as a controller, email [email protected] with the subject "Data protection complaint" (or write to us at the address above once completed). We will acknowledge your complaint within 30 days of receiving it — we aim to do so much sooner — make appropriate enquiries, keep you informed and tell you the outcome without undue delay. A complaint about how a law firm handled your data should go to that firm first; we will help it respond where it concerns the service we provide.
You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office: ico.org.uk or 0303 123 1113.