Privacy Policy

1. Who we are

ILA Hub (ilahub.com) is operated by ILA Hub Ltd, a company registered in England and Wales (company number 12193340) with registered office at International House, 142 Cromwell Road, London SW7 4EF. ILA Hub Ltd provides independent legal advice services and is the data controller for the personal information described in this policy. If you have any questions, or you want to exercise your data protection rights, contact us at info@ilahub.com.

2. Information we collect

• Booking and appointment details: the name, email, phone number and appointment details of each person receiving advice.
• Transaction details: the lender, solicitor and broker involved in your matter, the loan or facility amount, and any notes you give us about the document you need advice on.
• Documents you upload: the legal and transaction documents you provide through your secure booking link so that your adviser can advise on them.
• Identity verification data: images of your photo ID and a selfie, and the verification result. This is handled by our identity provider and includes biometric data used to match your selfie to your ID.
• Payment and billing information: your billing name and email and a record of your payment. Your full card details are handled by our payment provider and are never seen or stored by us.
• Enquiry messages: the name, email, phone number and message you send us through our contact form.
• Website usage data: the pages you visit, the site you came from and your browser type, together with a first-party identifier stored in your browser to count unique visitors. We also process your IP address briefly to protect the site from abuse.
• How you reached us, recorded with a booking: the website or link that brought you here and the pages you looked at during that visit. This is held only in your browser's memory while the tab is open, is never stored on your device and needs no cookie; it is saved only if you go on to make a booking, and only against that booking.

3. How we use your information, and our lawful bases

• To provide the advice you book, prepare and issue your certificate and take payment: to perform our contract with you.
• To verify your identity so the advice can be relied on: because it is necessary for the service and to establish legal rights. Identity and biometric data is special-category data, which we handle with your explicit consent and with appropriate safeguards.
• To respond to enquiries and manage bookings, payments and refunds: to take steps at your request and for our legitimate interest in running the service.
• To keep records of advice that may be relied on in future disputes: to meet our legal and professional record-keeping obligations.
• To understand how the website is used and to keep it secure: for our legitimate interests, and, for the non-essential analytics identifier, on the basis set out in the Cookies section below.
• To see which websites, searches and pages lead people to instruct us: for our legitimate interest in understanding which parts of our service reach the people who need it. Where this is recorded against your booking it is deleted with your booking record, and you can object at any time using the contact details below.

4. Service providers we use

We use a small number of trusted providers to run the service. They process your data only on our instructions:

• Stripe: card payments and online identity verification.
• Supabase: our secure database and document storage.
• Resend: sending transactional emails such as confirmations, certificates and verification links.
• Google Workspace: creating your video appointment and Meet link.
• Google Analytics: measuring how visitors use this website, and only if you accept analytics cookies.
• Vercel: hosting this website.

We share your certificate only with the people you ask us to, such as your solicitor, broker or lender, and with authorities where the law requires it. We never sell your data.

5. Payments and identity verification (Stripe)

Payments are processed by Stripe. When you pay, you enter your card details directly with Stripe on its secure checkout, so we never see or store your full card number. Stripe holds your payment data under its own security standards, and we keep only your billing name and email and a record of the transaction so that we can issue your invoice.

Identity verification is also carried out by Stripe. Your ID images and selfie are captured and held by Stripe, and we receive only the verification result and your verified name. When you go through to pay or verify, Stripe may set its own cookies on Stripe's pages for fraud prevention and security.

6. Where your data is stored and international transfers

Your information is held in our secure database and file storage. Some of our providers, including Stripe, Google, Resend and our hosting and database providers, are based outside the UK, including in the United States, so your data may be transferred internationally. Where it is, we rely on the safeguards recognised under UK data protection law, such as the UK International Data Transfer Agreement or Addendum, or transfers to countries covered by a UK adequacy decision.

7. Cookies and similar technologies

We keep our use of cookies and browser storage to a minimum.

• Essential: if a member of our team signs in to the staff area, we set a single secure, essential session cookie. It is only ever set for our own staff, never for visitors or customers, and no consent is required for it.
• Analytics: only if you agree, we store a single first-party identifier in your browser to count unique visitors and understand which pages are used. We ask when you first visit and set it only if you accept. It is not shared with anyone and is never used for advertising. On its own it does not identify you; if you go on to make a booking we record it against that booking, so we can see which pages and referrals lead people to instruct us, and from that point it is linked to you and is deleted along with your booking record. You can change or withdraw your choice at any time using the Cookie preferences link in the footer.
• Google Analytics: also only if you agree, we use Google Analytics to measure how the website is used, which sets Google's own cookies in your browser. The Google Analytics script is not loaded at all unless and until you accept, your IP address is anonymised, and we do not enable Google's advertising features, so this data is never used to target advertising to you. Google is based in the United States; see the international transfers section above. Withdrawing consent using the Cookie preferences link stops it immediately.
• Payment provider: when you continue to pay or verify your identity, Stripe may set its own cookies on Stripe's pages for fraud prevention and security.

Separately from the above, when you make a booking we record how you reached the site with that booking, as described in section 2. That involves no cookie and nothing stored on your device, so it does not depend on your cookie choice; it relies on our legitimate interests instead, and you can object to it using the contact details below.

We do not use third-party advertising cookies and we do not track you across other websites.

8. Retention

Records of advice given, certificates issued and identity verification are retained for at least six years, in line with professional record-keeping expectations for advice that may be relied on in future disputes. Enquiry messages that do not lead to a booking are kept for no longer than necessary, normally up to two years. We do not keep personal data for longer than we need it.

9. Your rights

You have rights under UK data protection law to access your personal data, have it corrected or deleted, restrict or object to how we use it, and receive a copy in a portable format. Where we rely on your consent, you can withdraw it at any time. To exercise any of these rights, email info@ilahub.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk), although we would ask you to contact us first so we can try to help.

10. Changes to this policy

We may update this policy from time to time. The date shown at the top of this page tells you when it was last changed.