Privacy notice
Last updated 19 October 2026
Wellbriefed is a service that councils use so that their staff can send instructions to their in-house legal team. This notice explains what personal data the service handles, who is responsible for it, and your rights. Wellbriefed is run by Wellbriefed.
Who is responsible for your data
Your council decides why and how the information in Wellbriefed is used. It is the controller. Wellbriefed is its processor: we hold and process the information only to provide the service, on the council's written instructions, under a contract with it.
If you have a question about how your information is used, or want to exercise your rights, contact your council's data protection officer first. We will help your council respond.
We are the controller only for information you send us directly, such as an enquiry to hello@wellbriefed.co.uk.
What information is held
- Your account: your name, work email address, role, and the legal teams you belong to.
- Instructions and documents: what officers send to Legal, including any personal data about other people that a matter needs, and the documents attached.
- Activity: a record of actions taken on each matter (for example, who allocated it and when), and when restricted matters are opened.
- Technical information: sign-in records and basic logs kept by our hosting providers to keep the service secure and working.
How it is used
To provide the service to your council: receiving and routing instructions, tracking their progress, sending notification emails, producing reports for your legal team, keeping the service secure, and providing support. We do not sell data, use it for advertising, or use it to train artificial intelligence models.
Lawful basis
Your council relies on its own lawful basis, usually that processing is needed for a task in the public interest or for its official functions. For enquiries sent to us directly, we rely on our legitimate interest in replying.
Where it is stored and who helps us
Information is stored in London, United Kingdom. We use these service providers, each under a contract that protects your data:
- Supabase for the database, document storage and sign-in, hosted in London.
- Vercel to run the website, set to run in London.
- Resend to deliver notification emails. Emails contain references and status updates only, not case details. Resend may process email addresses and message content outside the UK, under the UK's approved safeguards for international transfers.
- Microsoft, if your council uses “Sign in with Microsoft”, to confirm who you are.
How long it is kept
Your council sets how long closed matters are kept, after which they and their documents are deleted automatically. Your account is kept while you are a member of your council's Wellbriefed, and removed when your council removes you. Short-term backups are kept for disaster recovery and are overwritten on a rolling basis. When a council stops using Wellbriefed, its data is returned to it on request and then deleted.
How it is protected
- Encryption in transit and at rest.
- Each council's data is kept separate by rules enforced in the database itself.
- Officers can see only their own instructions. Restricted matters can be seen only by the people the Head of Legal chooses.
- Documents are downloaded through links that expire after 60 seconds.
- A permanent record is kept of key actions.
Cookies
Wellbriefed uses only the cookies needed to keep you signed in. There are no analytics, advertising or tracking cookies, so there is nothing to opt in or out of.
Your rights
You have rights to access your personal data, and to have it corrected, erased or restricted, or to object to its use, in the circumstances set out in UK data protection law. Contact your council to use them, or write to privacy@wellbriefed.co.uk and we will pass your request on. You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes
We will update this notice if the way we handle information changes, and show the date above.