Skip to content

Privacy Policy

Last updated: October 2026

1. Who we are

BrokerTools is the data controller for the personal data described in this policy. Contact us at admin@morebroking.com.

2. Data we collect

We collect the minimum data necessary to provide our service:

  • Email address — provided during signup, used for account management and billing.
  • Usage metrics — API call counts and costs, stored for billing and spending limits.
  • Email voice (Runner, optional) — if you save a description of your writing style, we store it with your account and send it to the AI model with each Runner draft. Do not include client details in it.
  • Session cookies — HttpOnly cookies for web authentication. Not accessible to JavaScript.
  • Analytics data — anonymised page views and performance metrics collected via Vercel Analytics. No personal data is collected and no cookies are used for analytics.

3. Legal basis for processing

We process your data under the following legal bases (UK GDPR Article 6):

  • Contractual necessity — processing your email, session, and usage data is necessary to provide the BrokerTools service you signed up for.
  • Legitimate interests — collecting anonymised analytics to improve the service, and maintaining billing records for accounting purposes.

4. Documents you upload

When you use BrokerTools (Blotter, Bordereaux, Runner, or Specimen), your documents are processed as follows:

  • Files are parsed in memory on our Vercel servers in London (UK) and sent to AWS Bedrock for AI analysis.
  • Short retention: Uploaded files and extracted document text are retained for up to 24 hours, then automatically deleted. We do not retain them beyond that window.
  • AWS Bedrock: Your document content is sent to Claude (Anthropic) via AWS Bedrock. Under the AWS Bedrock service terms, your data is not used to train AI models and is not retained after processing.
  • Regional processing: AI processing uses AWS Bedrock's European service, which runs only in AWS data centres in Europe.
  • Workflow processing (Specimen): Specimen runs each analysis through Inngest, a workflow provider in the United States, which handles document text and analysis results while the analysis runs.
  • If you connect your own Anthropic API key: your document content is sent to Claude directly on your own Anthropic account instead of AWS Bedrock. Anthropic processes it under your own agreement with Anthropic, in the regions Anthropic's API uses (which may be global or the United States), not in our European setup. Our 24-hour deletion covers only what we hold; what Anthropic keeps, and for how long, is governed by your agreement with Anthropic.

5. How we use your data

  • To provide the BrokerTools service (file processing, extraction, merging, reconciliation).
  • To manage your account, billing, and spending limits via Stripe.
  • To send service-related communications (e.g. billing notifications).
  • To monitor and improve service performance via anonymised analytics.

6. Data storage, security, and retention

  • Account data (email, API key, spending, your Runner email voice if you save one, and your Anthropic API key if you connect one, which is stored encrypted and used only to run your own work) is stored in Upstash Redis (London, UK; encrypted at rest) and Stripe. Account data is retained until you request deletion of your account; you can clear your email voice yourself at any time in Runner, and remove your Anthropic API key at any time on your Account page, which deletes it.
  • Document data (uploaded files and extracted document text) is retained for up to 24 hours, then automatically deleted.
  • All connections use HTTPS/TLS encryption in transit.
  • Session cookies are HttpOnly, Secure, and SameSite=Lax.

7. International data transfers

Our application servers and account database run in London (UK), uploaded files are held in Frankfurt (Germany), and AI processing occurs in AWS data centres in Europe. However, some of our service providers (Vercel, Stripe, Upstash) may process data outside the UK. These transfers are protected by appropriate safeguards including Standard Contractual Clauses and the providers' respective data processing agreements. Specimen also uses Inngest, a workflow provider whose service runs in the United States. If you connect your own Anthropic API key, AI processing happens on your Anthropic account and may take place outside the UK and EU, including in the United States; that choice, and the transfer it involves, is yours.

8. Your rights (UK GDPR)

Under UK data protection law, you have the right to:

  • Access the personal data we hold about you.
  • Request correction of inaccurate data.
  • Request deletion of your account and associated data.
  • Object to processing of your personal data.
  • Data portability — receive your data in a structured format.

To exercise any of these rights, contact admin@morebroking.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

9. Third-party services

10. Changes to this policy

We may update this policy from time to time. Changes will be posted on this page with an updated date.

11. Manage cookie preferences

You can review or change your cookie consent at any time. Withdrawing consent is as easy as giving it — use the link below to clear your current decision; the consent banner will reappear on the next page load so you can decide again.