Privacy Policy

BOUCH is a trading name of Paul Boucherat, a sole trader based in the United Kingdom. This policy covers the hosted civic AI assistant at civic.bouch.dev and the “UK Civic AI Assistant” Chrome extension that connects to it.

Data controller: Paul Boucherat, paul@bouch.dev. For privacy related to the BOUCH website or the open-source Claude Code plugins, see the main BOUCH privacy policy.

You ask a question in plain English about UK law, your rights, government services, or public records. The service sends your question to a large language model, which decides which official UK data sources to query, retrieves information from them, and writes you an answer with citations. The service is free, requires no account, uses no tracking cookies, and runs no advertising or analytics.

We collect only what is necessary to answer your question and to keep the service working.

We do not collect your name, email, address, phone number, account information (there are no accounts), tracking cookies, location data, payment information, mobile device identifiers, or social-media data.

Your question and the tool calls used to answer it — Performance of a contract (Art. 6(1)(b)): we cannot answer you without processing your question.

Operational logs— Legitimate interests (Art. 6(1)(f)): we use this data to debug failures, improve answer quality, and monitor for abuse. The data is minimal, kept short-term, and not used to identify or profile you. You can object at any time — see “Your rights” below.

The only third parties that receive your data are services we use to deliver the answer.

We do not sell or share your data with advertisers, data brokers, social networks, or analytics providers. By default, OpenAI does not use API data to train models — see their API data usage policies.

OpenAI processes data in the United States. The transfer is covered by the UK-compliant Standard Contractual Clauses in their Data Processing Addendum. We do not transfer data to any other non-UK jurisdiction beyond Fly.io's US corporate location, with UK-region operational data.

Operational logs (question + tool calls) are deleted after 30 days. Server access logs are retained by Fly.io for 30 days by default. Anything you ask us to delete is removed on receipt of a verified request. We do not maintain long-term backups of the operational log.

You have the right to access, rectify, erase, restrict processing of, object to processing of, or port your personal data. You can also withdraw consent at any time where consent is the lawful basis.

Because there are no accounts, the only way to identify your data in our logs is by approximate time and content of the request. To exercise any right, email paul@bouch.dev with as much context as possible. We will respond within one calendar month.

If you're unhappy with how we've handled your data, you can complain to the Information Commissioner's Office (helpline: 0303 123 1113).

The service runs over HTTPS (TLS). Operational logs are stored with standard filesystem permissions and are not exposed publicly. Given the short retention and minimal content, log files are not separately encrypted at rest beyond what the hosting provider supplies. No transmission over the internet is fully secure — please don't include passwords, payment details, or sensitive credentials in your questions.

We use no cookies, no tracking pixels, no fingerprinting, and no analytics. The Chrome extension uses Manifest V3 with no tracking permissions; the website serves a single static page with no third-party scripts.

This service is intended for the general public and is not directed at children under 13. If you believe a child has used the service and you'd like the related logs removed early, email paul@bouch.dev.

If you are a resident of a US state with consumer privacy rights (California CCPA/CPRA, Virginia CDPA, or similar), you have the right to know what we collect, have it deleted, and opt out of any “sale” or “sharing” of your data. We do not sell or share personal information for advertising or commercial purposes. To exercise your rights, email paul@bouch.dev.

If we change this notice materially, we'll update the “Last updated” date at the top and, where appropriate, post a visible notice on civic.bouch.dev. There is no mailing list to notify because we don't collect email addresses.

Questions about this policy: paul@bouch.dev