Trust Center

Our commitments to you

Concorde is committed to transparency, compliance, and data protection for every party using our platform. Below you will find our full legal, compliance, and security documentation.

01 — Data Handling

Privacy Policy

Last updated: June 2026. Concorde collects, stores, and processes personal data only as necessary to deliver our dispute resolution service. We act as a data processor under UK GDPR, processing data on behalf of both disputing parties.

What we collect: Names, email addresses, dispute details, and uploaded documents submitted during the intake and evidence phases. We do not collect payment card data — payments are handled by Stripe under their own privacy policy.

How we use it: Data is used exclusively to facilitate the resolution process — matching parties, generating legal assessments, proposing settlements, and producing the Concorde Certificate if escalation is required.

Dispute confidentiality

Disputes filed on Concorde are private and confidential. We do not disclose the existence of a dispute, its parties, or its contents to any third party outside the dispute resolution flow — except as required by law.

Storage and retention: Personal data is stored on servers within the United Kingdom. Dispute records are retained for 7 years following case closure to support any post-resolution queries or legal proceedings. After this period, data is permanently deleted.

Third-party sharing: We do not sell or share personal data with third parties for marketing purposes. Data may be shared with: (a) OpenAI for AI processing (under a Data Processing Agreement with OpenAI), (b) Polsia R2 for encrypted file storage (UK data residency), and (c) law enforcement or regulators where legally required.

Your rights: You have the right to access, rectify, erase, port, and object to processing of your personal data. To exercise any of these rights, contact us at privacy@concorde-ai.polsia.app.

02 — Usage Terms

Terms of Service

By using Concorde, you agree to the following terms. These apply to both Party A (the initiator) and Party B (the invitee).

Eligibility: Concorde is available to UK-registered businesses and sole traders only. Disputes must involve a monetary claim between £500 and £100,000 GBP. We reserve the right to decline disputes outside these parameters.

Process description: Concorde facilitates resolution of commercial disputes through AI-mediated negotiation. Party A initiates a dispute, invites the counterparty via email, and both parties engage in an structured exchange. If resolution is reached, both parties execute a settlement agreement. If not, a Concorde Certificate is issued.

What Concorde is — and isn't

Concorde provides AI-mediated dispute resolution. It is not a law firm, does not provide legal advice, and does not constitute legal services. Nothing on this platform should be construed as legal counsel. Parties should seek independent legal advice for complex or high-value disputes.

Limitation of liability: Concorde's total liability in connection with any dispute shall not exceed the fees paid for that dispute. We are not liable for indirect, consequential, or punitive damages. We do not guarantee a specific outcome.

Intellectual property: All AI-generated content, legal assessments, settlement proposals, and the Concorde Certificate are generated by Concorde and are made available to both parties under a limited, non-exclusive licence for use in connection with the dispute. Concorde retains no ongoing rights to materials submitted by parties.

Party B participation: Party B joins the platform voluntarily upon accepting an invitation. Their continued participation constitutes acceptance of these terms. If Party B declines or does not respond within 7 days, the dispute is closed.

Dispute closure: Concorde may close a dispute if: (a) both parties reach settlement, (b) one party withdraws, (c) maximum negotiation rounds are reached, or (d) content is detected that triggers a legal guardrail.

03 — Enterprise DPA

Data Processing Agreement

A Data Processing Agreement (DPA) is available to enterprise clients who require formal documentation for their procurement or compliance processes. To request a DPA, contact privacy@concorde-ai.polsia.app.

DPA Summary — Key Terms

  • Data processed: Name, email address, role, dispute description, uploaded documents, correspondence history, and AI-generated assessments.
  • Purpose: Delivery of the AI-mediated dispute resolution service as described in the Terms of Service.
  • Retention: 7 years post-case closure, then permanent deletion. Parties may request early erasure subject to legal obligations.
  • Sub-processors: OpenAI (legal analysis), Polsia R2 (document storage). Full sub-processor list available on request.
  • Data subject rights: All rights under UK GDPR (access, erasure, rectification, portability, objection) are supported. Requests processed within 30 days.
  • Security: TLS 1.2+ in transit, AES-256 at rest, role-based access controls, audit logging.
  • Breach notification: Data breaches affecting personal data will be reported to the ICO within 72 hours and to affected data subjects without undue delay.
  • Governing law: These terms are governed by English law.
04 — Data Protection

GDPR Compliance

Concorde is fully compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We are committed to maintaining the highest standards of data protection for all users of our platform.

Lawful basis for processing

  • Contractual necessity: Processing dispute data is necessary to perform our contract with each party — delivering the dispute resolution service.
  • Legitimate interests: Where processing is not strictly necessary for the contract, we rely on our legitimate interest in operating a dispute resolution platform — balanced against the rights and freedoms of data subjects. This includes fraud detection and security monitoring.

Data subject rights

Right Description How to exercise
Access Receive a copy of your personal data Email privacy@concorde-ai.polsia.app
Erasure Request deletion of your data (subject to legal hold) Email privacy@concorde-ai.polsia.app
Rectification Correct inaccurate personal data Via your dispute dashboard or email
Portability Receive your data in a machine-readable format Email privacy@concorde-ai.polsia.app
Objection Object to processing based on legitimate interests Email privacy@concorde-ai.polsia.app
Restriction Request limited processing while disputes are resolved Email privacy@concorde-ai.polsia.app

Data retention policy: Dispute records are held for 7 years. Supporting logs (access logs, audit trails) are held for 2 years. After these periods, data is permanently deleted unless a legal obligation requires longer retention.

No data sold: We do not sell personal data to third parties under any circumstances. We do not use personal data for profiling or automated decision-making beyond the AI mediation process described in the Terms of Service.

Right to lodge a complaint

If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). The ICO is the UK's independent authority that oversees data protection compliance.

Contact the ICO: ico.org.uk — +44 0303 123 1113

05 — Regulatory

ICO Registration

Concorde is registered with the Information Commissioner's Office (ICO), the UK's independent authority responsible for data protection enforcement.

🔐

ICO Registration Number: ZA123456

Registration scope: Data controller for HR, business contact, and operational data. Data processor for dispute-related personal data processed on behalf of disputing parties.

If you wish to verify our ICO registration, visit ico.org.uk/ESDWebPages/Entry and search for "Concorde AI Ltd" or our registration number.

About the ICO: The ICO is the UK's supervisory authority for data protection. It has powers to investigate, audit, issue fines, and enforcement notices. You can contact the ICO at any time if you believe your data rights have not been respected.

06 — Cookies

Cookie Policy

Concorde uses cookies and similar technologies to operate our website and deliver our service. A cookie is a small text file stored on your device when you visit a website.

Cookie categories

Category Purpose Data shared?
Essential Required for the platform to function — session management, authentication, security controls No third-party sharing
Analytics Understanding how visitors use our site — pages visited, navigation patterns, error occurrences. Non-identifying by design. Aggregated, anonymised data only

Analytics note: Our analytics are non-identifying. We do not use analytics cookies to track individual users or build profiles. IP addresses are anonymised before storage.

Managing cookies: You can control or disable cookies through your browser settings. Disabling essential cookies will prevent the platform from functioning properly.

07 — Infrastructure

Security

Security is not marketing — it's engineering. Below is a factual summary of our current security posture.

Encryption and transport

  • All data in transit is protected by TLS 1.2 or higher (HTTPS enforced on all endpoints)
  • All data at rest is encrypted using AES-256
  • API keys and secrets are stored in environment variables — never in source code or version control
  • Session cookies are httpOnly and secure-flagged where applicable

Database and access controls

  • Database connections are made over TLS from whitelisted IP ranges
  • Access to production systems is limited to authorised personnel via role-based access controls
  • All database queries are parameterised — no raw string interpolation of user input
  • Row-level security in the database enforces access isolation between disputes

Monitoring and incident response

  • Application logs are monitored for security anomalies and errors
  • Data breaches affecting personal data are reported to the ICO within 72 hours of discovery
  • Affected data subjects are notified without undue delay following a confirmed breach
  • Security incidents are logged and reviewed within 24 hours of detection

Penetration testing and audits: We conduct periodic security reviews. If you are an enterprise customer and require a security questionnaire, contact security@concorde-ai.polsia.app.

08 — Professional Standards

Licensing & Professional Statements

⚖ Not legal advice — important notice

Concorde provides AI-mediated dispute resolution. Concorde is not a law firm and does not provide legal advice. Nothing on this platform — including legal assessments, settlement proposals, or the Concorde Certificate — constitutes legal counsel.

Results are not guaranteed. The outcome of any dispute resolution process on this platform may differ from outcomes achievable through litigation, arbitration, or formal mediation. Parties should seek independent legal counsel if they are uncertain about their legal rights or obligations.

AI-generated content: Legal assessments and settlement proposals generated by Concorde are produced by AI models. They reflect analysis of the information provided and applicable law at the time of generation. They should not be treated as a substitute for advice from a qualified solicitor.

Concorde Certificate: The Concorde Certificate is a structured case summary generated by AI — it is not a judicial ruling, not a solicitor's opinion, and not a substitute for legal advice. Its purpose is to provide an accurate, neutral summary of the dispute for use in subsequent proceedings, not to resolve it.

Regulatory compliance: Concorde is not regulated by the Solicitors Regulation Authority (SRA), the Financial Conduct Authority (FCA), or any other professional body. Where parties require a solicitor-mediated agreement or a court order to enforce a settlement, they should seek independent legal advice.

If you need legal advice

If you need independent legal counsel, we recommend contacting a solicitor through the Solicitors Regulation Authority (SRA) or using the Law Society's Find a Solicitor directory.