1. Who We Are

This privacy policy applies to all products and services operated by Big Berri Limited, a company registered in England and Wales (Company Number: 16562429), trading as “BigBerri” and “Writford”.

Big Berri Limited is the data controller responsible for your personal data. Our services include the BigBerri website (bigberri.com), Writford AI legal research platform (writford.co.uk), the WebMCP Plugin, Chat Agents, AI SEO, AI Ranking and web development services.

If you have any questions about this policy or our data practices, please contact us at info@bigberri.com.

ICO registration number: ZC119995.

2. What Data We Collect

We collect different categories of personal data depending on how you interact with our services:

3. How We Process Data

All personal data is processed within the United Kingdom unless otherwise stated in Section 7. We apply the following principles to all data processing:

• Your data is processed solely for the purposes described in this policy and never used to train AI models.
• AI query inputs submitted through Writford or Chat Agents are processed in real time and are not retained for model training purposes.
• All data in transit is protected using TLS 1.2 or higher encryption.
• Data at rest is encrypted using industry-standard AES-256 encryption.
• We minimise the data we collect and only process what is necessary for the stated purpose.

4. Sub-Processors

We use the following categories of sub-processors to deliver our services. Each sub-processor is bound by data processing agreements that meet UK GDPR requirements:

• Cloud infrastructure providers — hosting, storage and compute services for our platforms.
• Payment processor — secure payment handling via Stripe for subscription and one-off payments.
• AI model providers — large language model APIs used to power AI features in Writford, Chat Agents and related services.
• Email and communication providers — transactional email delivery and customer support tools.
• Analytics providers — anonymised usage analytics to improve our services.

5. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Account data (name, email, payment records) — retained for the duration of your account and for up to 6 years after closure to meet legal and accounting obligations.
• Usage data (analytics, browsing activity) — retained in anonymised form for up to 24 months, then permanently deleted.
• AI processing logs (query inputs and outputs) — retained for up to 30 days for debugging and service quality purposes, then permanently deleted. These logs are never used for AI model training.
• Communication records — retained for up to 24 months after the last interaction.

When data is no longer required, it is securely deleted or anonymised so that you can no longer be identified from it.

6. Your Rights Under UK GDPR

Under UK data protection law, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.
• Right to rectification — you can ask us to correct any inaccurate or incomplete data.
• Right to erasure — you can request that we delete your personal data where there is no compelling reason for us to continue processing it.
• Right to data portability — you can request that we transfer your data to another organisation in a structured, commonly used, machine-readable format.
• Right to object — you can object to the processing of your personal data where we rely on legitimate interest as the lawful basis.
• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.
• Right to complain — if you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

To exercise any of these rights, please contact us at info@bigberri.com. We will respond to your request within one month, as required by UK GDPR.

7. International Transfers

Your personal data is primarily processed and stored within the United Kingdom. Where it is necessary to transfer data outside the UK (for example, to sub-processors located in other jurisdictions), we ensure that appropriate safeguards are in place, including:

• UK adequacy regulations where the destination country has been deemed to provide an adequate level of data protection.
• International Data Transfer Agreements (IDTAs) or the UK Addendum to EU Standard Contractual Clauses.

8. Cookies

Our websites use only essential cookies that are strictly necessary for the operation of the site. These include session cookies and authentication tokens required to keep you logged in.

We also use localStorage in your browser to store user preferences and session state. This data remains on your device and is not transmitted to our servers.

We do not use any third-party tracking cookies, advertising cookies, or non-essential cookies. No cookie consent banner is required as we only use strictly necessary cookies as defined under UK PECR (Privacy and Electronic Communications Regulations).

9. Children

Our services are designed for professional and business use. We do not knowingly collect or process personal data from anyone under the age of 18. If you are under 18, you must not use our services or provide any personal data to us.

If we become aware that we have collected personal data from a person under 18, we will take steps to delete that data as soon as reasonably possible. If you believe we may have collected data from a minor, please contact us at info@bigberri.com.

10. Security Measures

We take the security of your personal data seriously and implement appropriate technical and organisational measures, including:

• Encryption — TLS 1.2+ for data in transit and AES-256 for data at rest.
• Authentication — secure password hashing, multi-factor authentication where available, and session management controls.
• Rate limiting — API and login rate limiting to prevent brute-force attacks and abuse.
• Access controls — role-based access to personal data, limited to authorised personnel only.
• Regular reviews — periodic security assessments and updates to our infrastructure and processes.

No method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our services, legal requirements, or data practices. Where changes are material, we will notify you by email (if we hold your email address) or by posting a prominent notice on our website at least 30 days before the changes take effect.

We encourage you to review this policy periodically. The “Last Updated” date at the bottom of this page indicates when the policy was most recently revised.